Skip to content

chore: bump cryptography to ~=49.0 #680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gjtorikian merged 1 commit into from
Jul 1, 2026
Merged

chore: bump cryptography to ~=49.0 #680

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ authors = [{ name = "WorkOS", email = "sdk@workos.com" }]
requires-python = ">=3.10"

dependencies = [
"cryptography~=48.0",
"cryptography~=49.0",

@greptile-apps greptile-apps Bot Jun 30, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Dependency range narrowed
The new cryptography~=49.0 requirement resolves to >=49.0,<50.0, so packages pinned to the current 48.x line can no longer install this SDK even though the PR says the goal is to allow >=48. This changes the published package contract in the opposite direction from the requested lower-bound widening and will force downstream consumers off 48.x immediately.

Suggested change
"cryptography~=49.0",
"cryptography>=48",
Artifacts

Repro: pip resolver script for a temporary consumer pinned to cryptography 48.x

  • Contains supporting evidence from the run (text/x-shellscript; charset=utf-8).

Repro: verbose pip output showing ResolutionImpossible for cryptography==48.0.0 versus workos cryptography~=49.0

  • Keeps the command output available without making the summary code-heavy.

Repro: uv resolver script attempted for a temporary consumer pinned to cryptography 48.x

  • Contains supporting evidence from the run (text/x-shellscript; charset=utf-8).

Repro: uv resolver attempt output showing uv was unavailable

  • Keeps the command output available without making the summary code-heavy.

Repro: wheel metadata extraction attempt output showing build tooling was unavailable

  • Keeps the command output available without making the summary code-heavy.

View artifacts

T-Rex Ran code and verified through T-Rex

Prompt To Fix With AI 
This is a comment left during a code review.
Path: pyproject.toml
Line: 11

Comment:
**Dependency range narrowed**
The new `cryptography~=49.0` requirement resolves to `>=49.0,<50.0`, so packages pinned to the current 48.x line can no longer install this SDK even though the PR says the goal is to allow `>=48`. This changes the published package contract in the opposite direction from the requested lower-bound widening and will force downstream consumers off 48.x immediately.

```suggestion
  "cryptography>=48",
```

How can I resolve this? If you propose a fix, please make it concise.

"httpx~=0.28",
"pyjwt~=2.12",
"typing_extensions~=4.0; python_version < '3.11'",
Expand Down
Loading
Loading