From b97c406b010da0b6b326409fdf56692046b34dac Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 7 Apr 2026 11:53:28 +0000
Subject: [PATCH] Update cryptography minimum version to >=42.0.0

This prevents older versions of cryptography with known CVEs from being installed. Also adds a journal entry documenting the risk.

Co-authored-by: kingkillery <200727508+kingkillery@users.noreply.github.com>
---
 .jules/sentinel.md | 4 ++++
 pyproject.toml     | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..0b6809f
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2025-04-07 - Vulnerable Dependency Range
+**Vulnerability:** The `pyproject.toml` configuration allowed `cryptography>=3.1`, which includes versions with known critical vulnerabilities (like CVE-2023-23931 and CVE-2020-25659).
+**Learning:** Overly broad dependency ranges for security-critical packages like `cryptography` can accidentally introduce vulnerabilities if an older, affected version satisfies the constraint. It's safer to have tighter bounds or specifically exclude vulnerable major versions.
+**Prevention:** Establish a process to regularly review and update minimum required versions for dependencies that deal with encryption, authentication, or other sensitive operations. Use a minimum version that is known to be patched against historical CVEs.
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index a613152..edecf98 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -10,7 +10,7 @@ readme = "README.md"
 requires-python = ">=3.10"
 urls = { Homepage = "https://github.com/jbarrow/commonforms" }
 dependencies = [
-    "cryptography>=3.1",
+    "cryptography>=42.0.0",
     "formalpdf==0.1.6",
     "huggingface-hub>=0.35.3",
     "onnx>=1.19.1",