fix: allowlist three new cryptography advisories in the sidecar scan

[igolubic]

scan on main is red, and no commit caused it.

What happened

The job was green at 16:24 on 2026-08-03 and red at 22:27 the same day, with nothing Python-related in between. Three advisories against cryptography 46.0.7 were published upstream between 21:17 and 21:27 UTC, and pip-audit fetches the advisory database live on every run, so an unchanged tree flips colour the moment they land. The four open Dependabot PRs are failing on the identical step, which is the confirmation that this is time-based rather than commit-based.

Advisory	CVE	Severity	Fix in
GHSA-g6cj-pr64-35w5	CVE-2026-69247	high	50.0.0
GHSA-jwv3-5hgf-82ww	CVE-2026-69249	high	49.0.0
GHSA-m2h6-j472-rp4c	CVE-2026-69248	medium	49.0.0

Why they are not reachable here

All three are in TLS and X.509 code paths:

• 69247 a Bleichenbacher oracle in PKCS#7 EnvelopedData decryption. The sidecar decrypts no PKCS#7.
• 69249 duplicate self-signed intermediates causing exponential path building. The sidecar builds no certificate chains.
• 69248 the verifier accepting wildcard DNS names, escaping permittedSubtrees name constraints. The sidecar verifies no certificates.

cryptography is not declared in requirements.txt; it arrives only as a transitive dependency of presidio-anonymizer. The service imports no part of it (no ssl, no x509, no pkcs7 anywhere in app/), publishes no ports, speaks plain HTTP behind the model-gateway seam, terminates no TLS and parses no certificates. That is the same reasoning already recorded for GHSA-537c-gmf6-5ccf.

Why the pin is not simply bumped

The ceiling is upstream, not ours:

presidio-anonymizer 2.2.363  requires  cryptography <47.0.0, >=46.0.4
presidio-anonymizer 2.2.364  requires  cryptography <49.0.0, >=48.0.1   (newest release)

The fixes land in 49.0.0 and 50.0.0, so no published presidio release permits a cryptography that resolves any of the three. Upgrading presidio would clear the previously allowlisted GHSA-537c-gmf6-5ccf (fixed in 48.0.1) but none of the new ones. The allowlist is the only route until upstream widens the constraint, and the comment records that constraint as the revisit trigger rather than a calendar date, noting it is also when the hash-locked tree should be regenerated.

Verification

Run locally on Python 3.12, matching the sidecar base image and the setup-python pin, with the exact CI command:

No known vulnerabilities found, 4 ignored
exit 0

Resolving the lock on an older Python fails on unrelated grounds, exactly as the comment above setup-python predicts: exceptiongroup is a version-conditional dependency and is not hash-pinned.

Scope

Comments and four --ignore-vuln flags in .github/workflows/ci.yml. No application code, no lock file, no threshold lowered. The Trivy and npm audit gates are untouched.

Separate, not fixed here

Dependabot PR #296 (node base image digest bump) fails docker-build with apk add ... exit code 127: the bumped digest is not Alpine, so the OCR packages the vision half added cannot install. main's docker-build is green. That PR should not be merged as-is.