Remove cryptography upper version bound

[vkomarov-r7]

Hey there, wanted to open a follow-on issue to #343. Would it be possible for you guys to remove the <39.0.0 part in the cryptography package? The same case as described previous issue has occurred again (via https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-3315328).

The fix is in version 39.0.1, but nobody that also depends on oci can update at this time.

I believe this should be a safe change for projects to make based on cryptography's API Stability Policy, which states that:

• Public APIs will not be removed or renamed without providing a compatibility alias.
• The behavior of existing APIs will not change.

[github-anurag]

@vkomarov-r7
Thanks for bringing this up. We are evaluating moving the upperbound to support 39.0.1, but we need to think about it a bit because it seems 39.0.1 drops support for certain OS versions and OpenSSL versions, and we’re worried about negatively impacting our existing users on those OpenSSL versions / OS versions.

Refer: https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst#3900---2023-01-01

[alexenoname]

I join @vkomarov-r7 in his request. It seems that only "cryptography==39.0.1" fixes CVE-2023-0401 and CVE-2023-0286 vulnerabilities. These vulnerabilities are marked as HIGH by various vulnerability scanners thus making usage of your library a security risk.

Will really appreciate your effort on this one.

[ahopkins]

This is a real blocker for us. Libs with upper bounds is bad practice for downstream users' applications. Please consider heavily removing this boundary and dealing with various version limitations in your code for compat issues.

[vkomarov-r7]

@github-anurag: @vkomarov-r7 Thanks for bringing this up. We are evaluating moving the upperbound to support 39.0.1, but we need to think about it a bit because it seems 39.0.1 drops support for certain OS versions and OpenSSL versions, and we’re worried about negatively impacting our existing users on those OpenSSL versions / OS versions.

Refer: https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst#3900---2023-01-01

That makes sense. If there are backwards-incompatible changes that need to be made (and they can't be corrected in the code), would you consider releasing this change in a 3.0.0 version of the package?

[bhagwatvyas]

Hi all, we are testing the changes internally for supporting 39.0.1. I expect that we will have the version with the fix out in the next 2 weeks.

[bhagwatvyas]

This has been fixed in version 2.95.0.