Upgrade to use python package cryptography 43

[fmorriso]

Please upgrade your python SDK to use python package cryptography >= 43.

Every time I upgrade packages for my Python project, I have to back-level cryptography to < 43 as shown below:

pip install cryptography<43

I would be nice if you would upgrade oci to use cryptography>=43 to alleviate me having to constantly downgrade to < 43.

[sodul]

The upper limits are counter productive for requirements, they should only be set if there are known compatibility issues.

[fmorriso]

sodul: when using some db packages like pymongo or sqlite, OCI chokes if cryptography >= 43.

[sodul]

Interesting, so the bug is that there are actual compatibility issues between OCI, pymongo and newer cryptography. Is this documented/tracked?

I noticed #681 but there is no mention of the problem there.

[gshamgar-r7]

This is a must due to this security issue: https://security.snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-7886970

[jyotisaini]

Thanks all for reporting this. My team is currently working on upgrading cryptography pkg and i'll update here once we have it updated and released.

[vmsilvamolina]

Hey @jyotisaini! I sent a PR about that a few weeks ago: #699. Can you approve it? Thanks!

[jyotisaini]

Hi @vmsilvamolina thanks for the PR. This has been fixed internally and will be released on 01/8.

[vmsilvamolina]

Was it a typo? Could it be October 8? Thank you for your response!

[jyotisaini]

Sorry about that. I meant 10/8.

[bhagwatvyas]

This has been fixed in v2.135.2