fix(google-auth): raise cryptography lower bounds

[j-flat]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #18260 🦕

Summary

Raise the cryptography lower bound in google-auth so unit tests can install on Python 3.14 and so older Pythons no longer allow releases with known high-severity CVEs.

Python	Before	After
3.10–3.13	>= 38.0.3	>= 46.0.5
3.14+	>= 41.0.5	>= 50.0.1

Lower-bound constraints are updated to match: testing/constraints-3.10.txt pins 46.0.5, testing/constraints-3.14.txt pins 50.0.1.

Rationale

• Python 3.14: cryptography==41.0.5 has no 3.14 wheels, so nox -s unit-3.14 fails with ResolutionImpossible. 50.0.1 is the first release with Python 3.14 support.
• Python 3.10–3.13: 46.0.5 is the first release that fixes CVE-2026-26007. The previous floor (38.0.3, and the 3.14 pin of 41.0.5) also included CVE-2023-49083.

This does not pin users to a specific cryptography version. Pip still installs a current compatible release unless something else constrains it. Anyone still depending on cryptography < 46.0.5 (or < 50.0.1 on 3.14) will need to upgrade that package.

Test plan

• nox -s unit-3.12 (or another 3.10–3.13 interpreter) in packages/google-auth
• nox -s unit-3.14 in packages/google-auth
• Confirm install resolves with the updated constraints files and no longer requests cryptography==41.0.5 on 3.14

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the minimum required versions of the cryptography dependency in setup.py, bumping it to >= 46.0.5 for Python versions below 3.14 and to >= 50.0.1 for Python versions 3.14 and above. The corresponding pinned versions in the testing constraint files (constraints-3.10.txt and constraints-3.14.txt) have also been updated to match. There are no review comments, and I have no feedback to provide.

[daniel-sanche]

Hey @j-flat, thanks for looking in to this

Python 3.10–3.13: 46.0.5 is the first release that fixes CVE-2026-26007. The previous floor (38.0.3, and the 3.14 pin of 41.0.5) also included CVE-2023-49083.

In general, we do not bump up dependency ranges due to reported CVEs. Our policy is to allow customers to manage their own patching cadence unless a vulnerability renders the library fundamentally insecure in standard configurations. Bumping up the minimum dependency comes with a cost to users, so we prefer to leave the decision in their hands.

These specific CVEs (CVE-2026-26007, CVE-2023-49083) should not be relevant to google-auth, because we do not use the impacted methods, so we should not bump versions for that reason alone.

Python 3.14: cryptography==41.0.5 has no 3.14 wheels, so nox -s unit-3.14 fails with ResolutionImpossible. 50.0.1 is the first release with Python 3.14 support.

How are you determining 3.14 support? I could be in favor of bumping this, seeing that the current lower bound doesn't declare 3.14 support. But 50.0.1 was just released last week. That seems like a large jump, and it could be painful for users managing other dependencies. 46.0.0 declares 3.14 support in it's classifier. Do you encounter problems with that version?