[aebrahim]

This pin is dangerous because it prevents future CVE's in a critical library from being upgraded. For example, installing the latest version of beam right now forces a version of cryptography vulnerable to CVE-2026-69247.

[github-actions]

Assigning reviewers:

R: @claudevdm for label python.

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[github-actions]

Reminder, please take a look at this pr: @claudevdm

[github-actions]

Assigning new set of reviewers because Pr has gone too long without review. If you would like to opt out of this review, comment assign to next reviewer:

R: @jrmccluskey for label python.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

[jrmccluskey]

This is probably one of the safer deps to unpin the upper bound for given that it carries few transitive dependencies. I would also suggest pushing the lower bound up further given that 39.0.0 is nearly four years old, but that can be done in a follow-up.