Bump cryptography from 48.0.1 to 50.0.0 in /src/azure-cli

[dependabot]

Bumps cryptography from 48.0.1 to 50.0.0.

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31

* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table> 

... (truncated)

Commits

• dcb7050 Prepare for 50.0.0 release (#15372)
• 53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
• d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
• 908773d Bump downstream dependencies in CI (#15368)
• 2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
• c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
• 67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
• 95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
• 6954733 Release the GIL during DH and DSA parameter generation (#15364)
• 6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
• Additional commits viewable in compare view

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution Dependabot (@dependabot)[bot]! We will review the pull request and get back to you soon.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR updates the pinned cryptography dependency version across platform-specific Azure CLI Python 3 requirements files.

Changes:

• Bump cryptography from 46.0.7 to 50.0.0 in Windows requirements
• Bump cryptography from 46.0.7 to 50.0.0 in Linux requirements
• Bump cryptography from 46.0.7 to 50.0.0 in macOS (Darwin) requirements

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/azure-cli/requirements.py3.windows.txt	Updates pinned cryptography version for Windows runtime deps
src/azure-cli/requirements.py3.Linux.txt	Updates pinned cryptography version for Linux runtime deps
src/azure-cli/requirements.py3.Darwin.txt	Updates pinned cryptography version for macOS runtime deps

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Yong Zhang (yonzhan)]

bump cryptography

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because no new test file was added (tests/**/test_*.py).

The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. This is informational — a regression test is encouraged where it makes sense, but not required. If a test file is added in a later commit, the live test will run automatically.

[azure-client-tools-agent]

Automated CI Review — Failing Checks

This PR (cryptography 46.0.7 → 50.0.0) currently has 68 of 86 checks failing, spanning nearly every category:

• Lint/style: azdev-style, azdev-linter, Check CLI Style, Check CLI Linter
• Builds: Windows MSI/ZIP (x86/x64), Homebrew Formula, macOS (Intel/ARM64), Debian/RPM packages across Bookworm/Bullseye/Jammy/Noble/RHEL/Azure Linux (AMD64/ARM64)
• Test suites: Azure.azure-cli main build, Azure.azure-cli Full Test (all Python 3.12/3.14 profile-latest instances), Unit Tests for Core and Telemetry (Python 3.12/3.14)
• Other: Codegen Coverage, PerformanceCheck (Python 3.12/3.14), Verify latest index assets, Check License, History, and DocMap, Verify requirements.*.txt (Windows/Linux/Darwin)

This breadth of failure strongly suggests the cryptography 50.0.0 upgrade introduces a breaking change (e.g., API removal/behavior change) that affects core CLI functionality, packaging, and test collection — not an isolated/flaky failure. A maintainer should review whether:

1. cryptography 50.0.0 requires compatible pinning/adjustments elsewhere in azure-cli before this bump can merge, or
2. This bump needs to wait until a smaller/patch version is available, or downstream consumers are updated first.

Representative failing runs:

• Build: https://github.com/Azure/azure-cli/runs/92167492473
• Full Test: https://github.com/Azure/azure-cli/runs/92162586739
• Style: https://github.com/Azure/azure-cli/actions/runs/32217616414/job/95961966436
• Linter: https://github.com/Azure/azure-cli/actions/runs/32217616255/job/95961965707

Leaving this for maintainer/human review given the scope of the breakage.

[azure-client-tools-agent]

Live test skipped

⏭️ Skipping the live test for this revision because no changed test file was found (tests/**/test_*.py).

The live-test pipeline runs only the test files a PR changes, so there is nothing to execute for this commit. A skipped live test is not a passing test result. The Agent review separately checks whether the affected command module includes focused regression tests or updated recordings. If a test file is changed in a later commit, the live test will run automatically.

[azure-client-tools-agent]

Automated CI Review — Failing Checks

The live-test dispatch was skipped (this PR changes no runnable test files matching tests/**/test_*.py), and CI shows 66 of 78 checks failing, including:

• Azure.azure-cli (main build) — 42 errors: https://dev.azure.com/azclitools/5147fa83-336e-44ef-bbe0-c86b8ae86cbb/_build/results?buildId=340320
• Azure.azure-cli Full Test — 16 errors: https://dev.azure.com/azclitools/5147fa83-336e-44ef-bbe0-c86b8ae86cbb/_build/results?buildId=340321
• azdev-linter (x2), azdev-style (x2) — failing
• All downstream package builds (Deb/Rpm/Homebrew/Windows MSI/ZIP/macOS) and Automation Full Test instances are failing as a consequence of the core build failure.

Action needed: The primary build failure must be fixed first — please inspect the 42 build errors in the linked Azure DevOps build (buildId=340320), as all other failures appear to cascade from it. Push a fix commit and the downstream checks should re-run automatically.