Bump cryptography from 47.0.0 to 48.0.0

[dependabot]

Bumps cryptography from 47.0.0 to 48.0.0.

Changelog

Sourced from cryptography's changelog.

48.0.0 - 2026-05-04

* **BACKWARDS INCOMPATIBLE:** Support for Python 3.8 has been removed.
  ``cryptography`` now requires Python 3.9 or later.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 CRL whose inner
  ``TBSCertList.signature`` algorithm does not match the outer
  ``signatureAlgorithm`` now raises ``ValueError``. Previously, such CRLs
  were parsed successfully and only rejected during signature validation.
* Added support for :doc:`/hazmat/primitives/asymmetric/mlkem` and
  :doc:`/hazmat/primitives/asymmetric/mldsa` when using OpenSSL 3.5.0 or
  later, in addition to the existing AWS-LC and BoringSSL support. This means
  post-quantum algorithms are now available to users of our wheels.

Note: Going forward, we do not guarantee that all functionality

in cryptography will be available when building against

OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

Commits

• 8e03e30 bump for 48.0.0 release (#14796)
• 295e0d2 Add AGENTS.md with CLAUDE.md symlink (#14794)
• 104a2de Bump BoringSSL, OpenSSL, AWS-LC in CI (#14793)
• 67ec1e5 call check_length early on AesSiv::encrypt (#14792)
• b2da57a changelog for mldsa/mlkem for openssl (#14791)
• 3cf44ad ML-KEM OpenSSL support (#14781)
• 2e31639 ML-DSA OpenSSL support (#14773)
• 5affe5a fix rust nightly clippy (#14790)
• 2e73ca4 bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (#1...
• 82ebd3b Bump BoringSSL, OpenSSL, AWS-LC in CI (#14785)
• Additional commits viewable in compare view

[github-actions]

🤖 Claude Code Review

---

Code Review

Summary: This PR bumps cryptography from 47.0.0 to 48.0.0 in development-requirements.txt.

---

Code Quality

• ✅ Style guide — Single-line change in a requirements file; no style concerns.
• ✅ No commented-out code — N/A.
• ✅ Meaningful variable names — N/A.
• ✅ DRY principle — N/A.
• ✅ Defects / security — cryptography is a dev-only dependency. Bumping to 48.0.0 is a security-positive change (dependency upgrades for the cryptography library are typically security-motivated). No concerns.
• ✅ Project memory (.claude/CLAUDE.md) — No project memory file found; nothing to consider.

---

Testing

• ✅ Unit/integration tests — No logic changes; dependency version bump only. No new tests required.
• ✅ Edge cases / coverage — N/A.

---

Documentation

• ✅ README — No changes needed for a dev-dependency version bump.
• ✅ API docs — N/A.
• ✅ Inline comments — N/A.
• ❌ CHANGELOG.md — CHANGELOG.md exists and follows Keep a Changelog format, but this dependency bump is not reflected under [Unreleased]. Dependency bumps in development requirements are typically noted (e.g., - Bump cryptography from 47.0.0 to 48.0.0). Consider adding an entry.

---

Security

• ✅ No hardcoded credentials — N/A.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs — N/A.
• ✅ No license files (.lic / AQAAAD strings) — None present.

---

Overall Assessment

Minor issue: The CHANGELOG.md does not include an entry for this dependency bump. Everything else is clean — this is a straightforward, low-risk dev-dependency version upgrade.

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

PR Code Review — cryptography 47.0.0 → 48.0.0

Scope: Single-line dependency bump in development-requirements.txt (line 5).

---

Code Quality

• ✅ Style guide — No code changes; requirements file format is unchanged.
• ✅ No commented-out code — N/A.
• ✅ Meaningful variable names — N/A.
• ✅ DRY principle — N/A.
• ✅ Defects — No logic changes. The bump is a straightforward pin update for a dev-only dependency. No runtime impact.
• ✅ .claude/CLAUDE.md — No project-level CLAUDE.md exists at the repo root; no concerns.

---

Testing

• ✅ Unit/integration tests — N/A; no functional code changed.
• ✅ Edge cases / coverage — Existing test suite covers any cryptography usage; no new test surface introduced.

---

Documentation

• ✅ README — No update needed.
• ✅ API docs — N/A.
• ✅ Inline comments — N/A.
• ❌ CHANGELOG.md not updated — CHANGELOG.md has no entry for this dependency bump. The [Unreleased] section contains only placeholder text (Thing 4, Thing 5). A dependency update entry should be added under [Unreleased], e.g.:

  ### Changed
  - Bump cryptography from 47.0.0 to 48.0.0
  

• ✅ Markdown formatting — No markdown files modified in this PR.

---

Security

• ✅ No hardcoded credentials — None.
• ✅ Input validation — N/A.
• ✅ Error handling — N/A.
• ✅ No sensitive data in logs — N/A.
• ✅ No .lic files or AQAAAD strings — None present.

---

Summary

Category	Status
Code Quality	✅
Testing	✅
Documentation	❌
Security	✅

One actionable item: Add a CHANGELOG.md entry under [Unreleased] for the cryptography version bump (development-requirements.txt, line 5).

Automated code review analyzing defects and coding standards