[emmy-devop]

Requested by @drafty

🔴 Review tier: HIGH — human review required

• Release: merging to main triggers the SDK release automation and publishes to PyPI.
• Deps: permits cryptography 49 and upgrades the locked cryptography/CFFI variants while retaining Python 3.8 support.
• Security: fixes parsing of the existing encrypted token-cache format; encryption and authentication remain unchanged.

What

Supersedes #96 without modifying or closing it. Permit cryptography>=40.0.0,<49.0.1 and regenerate uv.lock using uv --no-config lock --upgrade-package cryptography --default-index https://pypi.org/simple (uv 0.12.9). Python 3.8 resolves cryptography 47.0.0; tested Python 3.9–3.13 resolve 49.0.0. Only cryptography and its CFFI dependency change package versions; regeneration also adds upstream artifact upload timestamps.

Why the original CI failed

The original run logs have expired (GitHub HTTP 410). Surviving job metadata shows successful dependency installation/lint followed by pytest exit status 4 on Python 3.8/3.9, with 3.11/3.12 passing. Reproducing PR #96 at 0297d428 on Python 3.8 confirms import/collection fails because Pydantic cannot evaluate usage: Usage | None; the same annotation exists in its parent, so this was pre-existing, not a cryptography incompatibility. Main already fixes it in 699d53b (Optional[Usage]), which this branch inherits. The original PR changed only pyproject.toml and still installed locked cryptography 43.0.3.

Current main also has an independent intermittent test_load_save_token_disk failure (run): splitting random salt bytes on :: corrupts salts containing :: or ending in :. Parse the existing fixed 16-byte salt and validate the separator instead, in both sync and async loaders. Stored bytes remain compatible. Deterministic tests exercise all sync/async writer-reader combinations and malformed headers; eight collision cases fail before the fix.

How tested

• Original PR Python 3.8 reproduction: expected collection error above.
• Before parser fix: deterministic regression cases 8 failed / 4 passed.
• Final full pytest suites with coverage across Python 3.8, 3.9, 3.10, 3.11, 3.12, 3.13: 150 passed each.
• ruff check asknews_sdk, wheel build, and git diff --check.

Risk / rollback

Major cryptography upgrade and token-cache parsing require human review. Python support is not dropped; the resolver selects compatible versions. The dependency floor remains 40.0.0 as in the original proposal (this is not a mandatory minimum-security-version policy change). No workflows, release configuration, token format, KDF, or encryption algorithms change. Revert this commit and release a follow-up version if needed. No merge, tag, or publication performed by this task.