Bump cryptography requirements to be <42 instead?
jauderho opened this issue · comments
When I build sslyze, GitHub scans complains that I'm not using a 41.0.x version. Bumping to 41.0.x should line up with pyopenssl constraints of cryptography!=40.0.0, !=40.0.1, <42 and >=38.0.0
Line 102 in fccf7f9
Fixed in v5.2.0.
Note that pyOpenSSL locked cryptography to "cryptography>=38.0.0,<42,!=40.0.0,!=40.0.1" until PyOpenSSL version 23.2.0 (see https://github.com/pyca/pyopenssl/pull/1221/files#diff-60f61ab7a8d1910d86d9fda2261620314edcae5894d5aaa236b821c7256badd7), so this still fails to install if the version of PyOpenSSL installed is lower than that (you only have a dependency on the major version).
I had to add an explicit dependency on pyOpenSSL>=23.2.0 before I could get cryptography 41.0.4 and sslyze 5.2.0 to install together.