This is an automated email from the ASF dual-hosted git repository.
jrmccluskey pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/beam.git
The following commit(s) were added to refs/heads/master by this push:
new cc24fdfabaf Remove upper bound pin for cryptography. (#40180)
cc24fdfabaf is described below
commit cc24fdfabafc4b5822e1a5f76a72d034297905b1
Author: Ali Ebrahim <[email protected]>
AuthorDate: Wed Sep 30 07:44:51 2026 -0700
Remove upper bound pin for cryptography. (#40180)
This pin is dangerous because it prevents future CVE's in a critical library
from being upgraded. For example, installing the latest version of beam
right
now forces a version of cryptography vulnerable to CVE-2026-69247.
---
sdks/python/setup.py | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sdks/python/setup.py b/sdks/python/setup.py
index 26a68d7c9fe..f5dbf28e2a0 100644
--- a/sdks/python/setup.py
+++ b/sdks/python/setup.py
@@ -416,7 +416,7 @@ if __name__ == '__main__':
},
ext_modules=extensions,
install_requires=[
- 'cryptography>=39.0.0,<51.0.0',
+ 'cryptography>=39.0.0',
'fastavro>=0.23.6,<2',
'fasteners>=0.3,<1.0',
'grpcio>=1.33.1,<2,!=1.48.0,!=1.59.*,!=1.60.*,!=1.61.*,!=1.62.0,!=1.62.1,!=1.66.*,!=1.67.*,!=1.68.*,!=1.69.*,!=1.70.*',
# pylint: disable=line-too-long
