From c46bdc395ba2eab147255c6f52ca2701c747b6fd Mon Sep 17 00:00:00 2001 From: Ali Ebrahim Date: Fri, 18 Sep 2026 11:11:19 -0700 Subject: [PATCH] Remove upper bound pin for cryptography. This pin is dangerous because it prevents future CVE's in a critical library from being upgraded. For example, installing the latest version of beam right now forces a version of cryptography vulnerable to CVE-2026-69247. --- sdks/python/setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sdks/python/setup.py b/sdks/python/setup.py index 5ea8257a4b4b..ff4fcebcd46e 100644 --- a/sdks/python/setup.py +++ b/sdks/python/setup.py @@ -416,7 +416,7 @@ def get_portability_package_data(): }, ext_modules=extensions, install_requires=[ - 'cryptography>=39.0.0,<51.0.0', + 'cryptography>=39.0.0', 'fastavro>=0.23.6,<2', 'fasteners>=0.3,<1.0', 'grpcio>=1.33.1,<2,!=1.48.0,!=1.59.*,!=1.60.*,!=1.61.*,!=1.62.0,!=1.62.1,!=1.66.*,!=1.67.*,!=1.68.*,!=1.69.*,!=1.70.*', # pylint: disable=line-too-long