Update cryptography requirement from >=46.0.5 to >=46.0.7

[dependabot]

Updates the requirements on cryptography to permit the latest version.

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07

* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25

• SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10

* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

• Dropped support for win_arm64 wheels_.
• Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0.
.. _v46-0-2:

</tr></table>

... (truncated)

Commits

• 622d672 46.0.7 release (#14602)
• 91d7288 Cherry-pick #14542 (#14543)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Security Sentinel Report

Severity	Count
CRITICAL	52
HIGH	0
MEDIUM	9

Severity	Finding	File	Details
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34514: AIOHTTP has CRLF injection through multipart part content type header construction
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34517: AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34520: AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34518: AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34525: AIOHTTP accepts duplicate Host headers
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34513: AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34516: AIOHTTP has a Multipart Header Size Bypass
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34519: AIOHTTP has HTTP response splitting via \r in reason phrase
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-34515: AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windo
CRITICAL	Vulnerable dependency: aiohttp	pyproject.toml	CVE-2026-22815: aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage
CRITICAL	Vulnerable dependency: PyJWT	pyproject.toml	CVE-2026-32597: PyJWT accepts unknown crit header extensions
CRITICAL	Hardcoded secret	tests/test_tunnel_setup.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_tunnel_setup.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_tunnel_setup.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_tunnel_setup.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_channels.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_ssh_fabric.py	Pattern matched: (?:API_KEY
CRITICAL	Hardcoded secret	tests/test_telegram_webhook.py	Pattern matched: (?:API_KEY

...and 45 more.
This PR is blocked by CRITICAL findings.