From de7eab5aa12ec612ec15270def6d1e25fcdfe39f Mon Sep 17 00:00:00 2001 From: Nick Mastoris Date: Fri, 18 Sep 2026 08:16:59 +0300 Subject: [PATCH 1/5] Pin cryptography<47 in dev requirements cryptography 47.0.0 removed legacy curves (e.g. SECT571R1) still referenced at import time by cryptojwt's EC JWK module, breaking test collection across the suite on all Python versions. --- requirements-dev.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index 5c518bd6..c73594d6 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -5,4 +5,5 @@ pytest-isort>=1.3.0 pytest-localserver>=0.5.0 flake8 bandit -urllib3<1.27 \ No newline at end of file +urllib3<1.27 +cryptography<47 \ No newline at end of file From 153e994189320deef24d6091c04dd87fcdb4cefd Mon Sep 17 00:00:00 2001 From: Nick Mastoris Date: Fri, 18 Sep 2026 08:28:52 +0300 Subject: [PATCH 2/5] Stop using python setup.py install in CI python setup.py install invokes easy_install, which re-resolves idpyoidc's own install_requires independently of requirements-dev.txt. It ignores the cryptography pin, fetches pyOpenSSL's latest release (which needs a newer cryptography), and then fails outright since modern cryptography sdists ship no setup.py for easy_install to run. Installing requirements-dev.txt and the package together in one pip call lets the resolver pick a pyOpenSSL version compatible with the pinned cryptography instead. --- .github/workflows/python-app.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index a9f4eaac..1881d8b5 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -32,9 +32,7 @@ jobs: - name: Install dependencies run: | python -m pip install --upgrade pip - if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi - if [ -f requirements.txt ]; then pip install -r requirements.txt; fi - python setup.py install + pip install -r requirements-dev.txt -e . - name: Install flake8 run: pip install flake8 - name: Lint with flake8 From 588347b820fc78de465fdb09a7890c77c1b141bd Mon Sep 17 00:00:00 2001 From: Nick Mastoris Date: Thu, 24 Sep 2026 08:49:03 +0300 Subject: [PATCH 3/5] Bump cryptojwt minimum to 1.11.0 --- setup.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setup.py b/setup.py index 6d99efdf..ae50eed9 100644 --- a/setup.py +++ b/setup.py @@ -69,7 +69,7 @@ def run_tests(self): "Programming Language :: Python :: 3.11", "Topic :: Software Development :: Libraries :: Python Modules"], install_requires=[ - "cryptojwt>=1.8.4", + "cryptojwt>=1.11.0", "pyOpenSSL", "filelock>=3.0.12", 'pyyaml>=5.1.2', From a0a687f12988319adfcf404a6f2ed44e36a720e5 Mon Sep 17 00:00:00 2001 From: Nick Mastoris Date: Thu, 24 Sep 2026 08:49:03 +0300 Subject: [PATCH 4/5] Drop Python 3.8/3.9 from the test matrix --- .github/workflows/python-app.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 1881d8b5..00ce71b1 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,8 +18,6 @@ jobs: fail-fast: false matrix: python-version: - - '3.8' - - '3.9' - '3.10' - '3.11' From ab1b78cb0ea6d0b016c23941cb2028699480b67c Mon Sep 17 00:00:00 2001 From: Nick Mastoris Date: Thu, 24 Sep 2026 08:51:58 +0300 Subject: [PATCH 5/5] Drop cryptography<47 pin, no longer needed with cryptojwt 1.11.0 cryptojwt 1.11.0 fixes the EC JWK module's reference to legacy curves cryptography 47 removed, which is what the pin in de7eab5 worked around. --- requirements-dev.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index c73594d6..5c518bd6 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -5,5 +5,4 @@ pytest-isort>=1.3.0 pytest-localserver>=0.5.0 flake8 bandit -urllib3<1.27 -cryptography<47 \ No newline at end of file +urllib3<1.27 \ No newline at end of file