deps: pin aiohttp, cryptography and h2 for the August-2026 CVE batch

[szjanikowski]

Unblocks the CVE audit (pip-audit) gate, which has been red on main since the 2026-08-10 TestPyPI canary.

Why now

Five advisories across three transitive packages, none introduced by a change of ours. pip-audit reads a live advisory database, so the gate went red on an unchanged tree — main is still at 61a91c3, and every PR inherits the failure:

• The weekly publish.yml canary on main has failed five weeks running (08-10, 08-17, 08-24, 08-31, 09-07). Last green: 08-03.
• Heatmap variant with the T2 bounty row outlined #78 has been red on exactly this since 2026-08-24, with lint, mypy and all four test-matrix legs green — the audit job is its only failure.

What's pinned

package	locked	advisory	fix
aiohttp	3.14.1	PYSEC-2026-3545 / 3546 / 3547	3.14.3
cryptography	49.0.0	PYSEC-2026-3552	50.0.0
h2	4.3.0	PYSEC-2026-3628	4.4.1

• aiohttp — request smuggling via the WebSocket upgrade path; an out-of-bounds heap read in the C response parser while building an error message for a malformed response; RSV1 frames decompressed without a negotiated permessage-deflate.
• cryptography — pkcs7_decrypt_* distinguished RSA decryption outcomes both by result and by timing: a Bleichenbacher oracle against the content-encryption key (introduced in 44.0.0).
• h2 — a header block carrying more than one Host header is forwarded whole, a request-smuggling primitive (CWE-444) once HTTP/2 is downgraded to HTTP/1.1. This is h2's first explicit floor; it reaches the tree through harbor's e2b / grpclib / httpx path and had no lower bound of its own.

No first-party code is affected — nasde serves no HTTP and decrypts no PKCS#7. The pins keep the supply chain clean and the gate green; they are not patching a reachable bug here.

Blast radius

Resolution moves exactly four packages:

aiohttp       3.14.1 -> 3.14.3
cryptography  49.0.0 -> 50.0.1
h2             4.3.0 -> 4.4.1
hpack          4.1.0 -> 4.2.0

harbor stays at 0.19.0 and litellm at 1.87.0.

A blanket uv lock --upgrade also clears the advisories, but drags ~40 packages including rich 14 → 15 (a major, and rich carries the entire CLI surface — run summary tables, pricing_report), plus opik 2.0→2.2, starlette 1.3→1.6 and typer 0.27. Deliberately not taken here; that refresh deserves its own PR with eyes on the output.

Verification

• ruff check — all checks passed
• ruff format --check — 60 files already formatted
• mypy src/nasde_toolkit/ — no issues in 33 source files
• uv run pytest — 463 passed
• nasde --version / --help — banner and command table render fine
• uv export … | pip-audit --strict --ignore-vuln PYSEC-2025-183 on py3.12 (the exact CI command) — No known vulnerabilities found, exit 0

The disputed pyjwt advisory PYSEC-2025-183 keeps its existing ignore — still no upstream fix, still transitive-only.

No end-to-end benchmark run was performed: this touches no runner, evaluator or agent code, and every LLM run in this project is individually authorized by the owner.

Follow-ups (not in this PR)

• harbor 0.19 → 0.22 — I diffed the wheels: every contract nasde depends on is unchanged (setup() signature, the ADR-012 skill-injection command is byte-identical, JobConfig changes are purely additive, opik's monkey-patch targets all survive). Cost is a litellm floor bump to 1.92 that pulls in boto3/botocore. Wants a smoke run before landing.
• rich 15 / opik 2.2 — worth a look; opik may have fixed the token-usage bug that ADR-006's monkey-patch works around.

🤖 Generated with Claude Code

https://claude.ai/code/session_01V9M7964Dzo5cHXsL13GZpj

---

Generated by Claude Code