fix(deps): bump click/cryptography/pip floors + clerk 6→7 (pip-audit --strict, CI #590) - #214

Why

CI run #590 (run 32779720467) — the Test & Deploy check on Dependabot PR #201 (eslint 9.39.4 → 10.9.0) — failed at the Dependency scan (pip-audit) step. uv run pip-audit --strict reported 5 known vulnerabilities in 3 packages after new 2026-08 advisories landed in the PyPA Advisory DB:

The Backend tests job runs on every PR to master (including frontend-only Dependabot bumps), so a stale backend lockfile blocks this eslint PR even though the eslint change is unrelated.

Root cause

The constraint-dependencies floors in backend/pyproject.toml were still at the old fixed versions (pip>=26.1.2, cryptography>=48.0.1, no click constraint), and uv.lock pinned those exact versions. The three new 2026-08 advisories are not satisfied by the old floors.

Fix

Raise the floors — pip>=26.2, cryptography>=50.0.0, add click>=8.3.3 — and regenerate uv.lock:

• click 8.3.1 → 8.4.2 (fixes PYSEC-2026-2132)
• pip 26.1.2 → 26.2.1 (fixes PYSEC-2026-3721)
• cryptography 48.0.1 → 50.0.0 (fixes all three: 3552/3553/3554)
• clerk-backend-api 6.0.1 → 7.0.0 (forced: clerk 6.0.1 caps cryptography<49.0.0, incompatible with >=50.0.0; clerk 7.0.0 was released 2026-08-11 specifically to raise the cap to <51.0.0)

⚠️ clerk-backend-api 6→7 is a major bump

The 7.0.0 release notes list several Breaking API-shape changes (error/verification types on email_addresses, phone_numbers, sessions, role_sets, instance_settings, etc.). The app only uses clerk_backend_api.Clerk (the client) and clerk_backend_api.security.AuthenticateRequestOptions — neither is in the breaking-changes list — and the full 699-test suite passes with the bump applied (in-memory DB, mocked auth). Still flagging for review attention since the breaking changes are real and a live-credentials smoke test is worth doing before deploy.

Verified locally (mirrors the CI job)

uv run ruff check            -> All checks passed
uv run pip-audit --strict    -> No known vulnerabilities found   ← was failing here
uv run pytest -q            -> 699 passed in 12.48s

Note

This is the same root cause addressed by sibling draft PRs #207 and #208 (created by parallel CI triage runs minutes apart). Opening this one anyway per the per-run triage contract; recommend the human pick one and close the rest to avoid duplicate review load. PR #185 (the Dependabot clerk 6→7 bump) is the upstream fix for the cryptography cap but doesn't itself touch the click/pip constraints, so it's complementary rather than a substitute.