fix: raise cryptography floor and bump js-yaml for Guardian prod vulns

[rockygeekz]

Summary

• Raise cryptography minimum from >=37 to >=50.0.0 so Guardian OSV scans stop flagging the whole legacy range.
• Bump js-yaml in schema tests from 4.3.0 to 5.4.1 (CVE-2026-59870 fix is not backported to 4.x).
• Regenerate uv.lock and test/schemas/package-lock.json.

Test plan

• CI green on tox
• Schema tests pass (cd test/schemas && npm test)

Summary by CodeRabbit

• Chores

  • Raised the minimum supported version of the cryptography dependency.
  • Upgraded the YAML parsing dependency used by schema tests.
  • Updated development tooling and dependency version constraints for improved compatibility and maintenance.

• Tests

  • Improved schema test handling for empty and comment-only YAML files.
  • Maintained validation coverage for both complete schemas and subschemas.
  • Improved error handling for invalid YAML while preserving expected validation behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ad95cc30-5135-4a37-ba1d-eea593301f71

📥 Commits

Reviewing files that changed from the base of the PR and between 5ed5208 and c19a8bc.

📒 Files selected for processing (1)

• .pre-commit-config.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request raises the cryptography minimum version, upgrades js-yaml, changes the team-devtools hook revision, updates Renovate constraints, and centralizes YAML loading in schema tests.

Changes

Dependency and schema test updates

Layer / File(s)	Summary
Dependency and tooling constraints pyproject.toml, renovate.json, test/schemas/package.json, .pre-commit-config.yaml	The minimum cryptography version changes to >=50.0.0. The Renovate upper bound changes to <51. The js-yaml version changes to ^5.4.1. The team-devtools hook revision changes to commit c44381c.
Schema test YAML loading test/schemas/src/schema.spec.ts	Schema tests use loadYamlFile, which returns null for empty files, returns {} for comment-only files, and rethrows other parsing errors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c19a8

The tooling dependency pin changes without altering hook configuration, and no current merge-blocking risk is identified.

Suggested reviewers: sudhirverma

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main dependency security updates: raising the cryptography version floor and upgrading js-yaml for Guardian vulnerabilities.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}