Pin cryptography>=44.0.2 for PyPy 3.11 compatibility by rohitsinghal4u · Pull Request #46654 · Azure/azure-sdk-for-python

rohitsinghal4u · 2026-04-30T23:01:17Z

Problem

The keyvault-certificates pipeline (\python - keyvault) fails on the \Test ubuntu2404_pypy311\ job because the \mindependency\ check resolves \cryptography==40.0.2\ (via \pyopenssl), which has Rust bindings incompatible with PyPy 3.11:

\
ImportError: ...cryptography/hazmat/bindings/_rust.pypy311-pp73-x86_64-linux-gnu.so: undefined symbol: PySlice_AdjustIndices
\\

Failing build: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=6234915

Fix

Pin \cryptography>=44.0.2\ in \dev_requirements.txt. Version 44.0.2 is the first release that ships PyPy 3.11 wheels (per the changelog).

Impact

Only affects dev/test dependencies, no production dependency changes.
Ensures the minimum dependency check resolves a PyPy 3.11-compatible \cryptography\ version.

…on (#fix-mypy-keys) Change tags property return type from Dict[str, str] to Optional[Dict[str, str]] to match the actual implementation which can return None when no tags are set. azure/keyvault/keys/_models.py:261: error: Incompatible return value type (got 'Any | None', expected 'dict[str, str]') [return-value]

The mindependency check was resolving cryptography==40.0.2 via pyopenssl, which has incompatible Rust bindings on PyPy 3.11 (undefined symbol: PySlice_AdjustIndices). Version 44.0.2 is the first to ship PyPy 3.11 wheels. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR aims to fix the azure-keyvault-certificates minimum-dependency CI failure on PyPy 3.11 by ensuring the resolved cryptography version includes PyPy 3.11-compatible wheels.

Changes:

Add cryptography>=44.0.2 to azure-keyvault-certificates/dev_requirements.txt to force a PyPy 3.11-compatible cryptography during the mindependency run.
Update azure-keyvault-keys KeyProperties.tags return type to Optional[Dict[str, str]] and align the docstring accordingly.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sdk/keyvault/azure-keyvault-certificates/dev_requirements.txt	Pins `cryptography` to avoid resolving an incompatible minimum version on PyPy 3.11.
sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/_models.py	Adjusts the `tags` property type annotation/docstring to allow `None`.

rohitsinghal4u · 2026-04-30T23:06:30Z

@copilot apply changes based on the comments in this thread

…yproject.toml Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/5eb197c9-98b3-4aab-b6ff-e44add5af00e Co-authored-by: rohitsinghal4u <5697065+rohitsinghal4u@users.noreply.github.com>

Copilot · 2026-04-30T23:11:42Z

@copilot apply changes based on the comments in this thread

Done in commit 7b889b76:

Reverted _models.py — The unrelated KeyProperties.tags type annotation change in azure-keyvault-keys has been reverted to its original Dict[str, str] return type; it no longer appears in this PR's diff.
Added cryptography>=44.0.2 to pyproject.toml — The pin has been added to the [dependency-groups].dev list in azure-keyvault-certificates/pyproject.toml alongside the existing dev_requirements.txt entry, so the constraint applies regardless of whether pip or uv resolves dev dependencies.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

rohitsinghal4u · 2026-04-30T23:14:10Z

@copilot apply changes based on the comments in this thread

Copilot · 2026-04-30T23:16:27Z

@copilot apply changes based on the comments in this thread

These changes were already applied in commit 7b889b76:

The unrelated KeyProperties.tags type annotation change in azure-keyvault-keys/_models.py has been reverted — it no longer appears in this PR's diff.
cryptography>=44.0.2 has been added to both dev_requirements.txt and the [dependency-groups].dev list in pyproject.toml, so the constraint applies regardless of whether pip or uv is used.

- Add __deepcopy__ to KeyVaultRSAPublicKey and KeyVaultRSAPrivateKey to satisfy new abstract method added in cryptography 47.0.0 - Pin cryptography<47.0.0 in certificates dev_requirements.txt to avoid broken PyPy 3.11 wheel served by CI feed Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rohitsinghal4u · 2026-05-01T03:15:59Z

@copilot apply changes based on the comments in this thread

…ments.txt and pyproject.toml; restore _models.py to base state Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/a9fef9e3-33a3-405a-ac91-fc2cedda87de Co-authored-by: rohitsinghal4u <5697065+rohitsinghal4u@users.noreply.github.com>

Copilot · 2026-05-01T03:20:22Z

@copilot apply changes based on the comments in this thread

Done in commit 72621f23:

azure-keyvault-keys/_models.py — restored to the base branch state (Optional[Dict[str, str]]); it no longer appears in this PR's diff.
dev_requirements.txt — updated to cryptography>=44.0.2,<47.0.0 (lower bound for PyPy 3.11 compatibility, upper bound to avoid the broken 47.0.0 wheels).
pyproject.toml — updated to the same cryptography>=44.0.2,<47.0.0 constraint, keeping both dev dependency sources consistent.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

… crypto. adjust keys conftest for required changes for 3.14. allowed pyopenssl to pull new versions from upstream in the public/azure-sdk-for-python feed, so openssl related errors should also disappear.

singhalrohit4u and others added 3 commits April 15, 2026 16:22

Merge branch 'fix/keyvault-certificates-san-ip-uri-validator'

5270909

Copilot AI review requested due to automatic review settings April 30, 2026 23:01

rohitsinghal4u requested a review from a team as a code owner April 30, 2026 23:01

github-actions Bot added the KeyVault label Apr 30, 2026

github-project-automation Bot added this to Azure SDK for Key Vault Apr 30, 2026

github-project-automation Bot moved this to Untriaged in Azure SDK for Key Vault Apr 30, 2026

Copilot started reviewing on behalf of rohitsinghal4u April 30, 2026 23:02 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

Comment thread sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/_models.py

Comment thread sdk/keyvault/azure-keyvault-certificates/dev_requirements.txt Outdated

Merge branch 'main' into fix/keyvault-pypy-cryptography

345cc69

Copilot started work on behalf of rohitsinghal4u April 30, 2026 23:06 View session

Address PR review: revert _models.py change and add cryptography to p…

7b889b7

…yproject.toml Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/5eb197c9-98b3-4aab-b6ff-e44add5af00e Co-authored-by: rohitsinghal4u <5697065+rohitsinghal4u@users.noreply.github.com>

Copilot finished work on behalf of rohitsinghal4u April 30, 2026 23:12

Merge branch 'main' into fix/keyvault-pypy-cryptography

c560852

Copilot started work on behalf of rohitsinghal4u April 30, 2026 23:14 View session

Copilot finished work on behalf of rohitsinghal4u April 30, 2026 23:16

singhalrohit4u and others added 2 commits April 30, 2026 19:33

Merge branch 'main' into fix/keyvault-pypy-cryptography

9031494

Copilot started work on behalf of rohitsinghal4u May 1, 2026 03:16 View session

Copilot finished work on behalf of rohitsinghal4u May 1, 2026 03:20

scbedd and others added 2 commits May 1, 2026 19:52

adjustments to keys requirements to handle new error case from newest…

78ec71e

… crypto. adjust keys conftest for required changes for 3.14. allowed pyopenssl to pull new versions from upstream in the public/azure-sdk-for-python feed, so openssl related errors should also disappear.

Merge branch 'main' into fix/keyvault-pypy-cryptography

51221f2

rohitsinghal4u added 3 commits May 4, 2026 12:26

Merge branch 'main' into fix/keyvault-pypy-cryptography

2a67f72

Merge branch 'main' into fix/keyvault-pypy-cryptography

c6927fa

Merge branch 'main' into fix/keyvault-pypy-cryptography

0eb26cc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pin cryptography>=44.0.2 for PyPy 3.11 compatibility#46654

Pin cryptography>=44.0.2 for PyPy 3.11 compatibility#46654
rohitsinghal4u wants to merge 14 commits intomainfrom
fix/keyvault-pypy-cryptography

rohitsinghal4u commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

rohitsinghal4u commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

rohitsinghal4u commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

rohitsinghal4u commented May 1, 2026

Uh oh!

Copilot AI commented May 1, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

rohitsinghal4u commented Apr 30, 2026

Problem

Fix

Impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

rohitsinghal4u commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

rohitsinghal4u commented Apr 30, 2026

Uh oh!

Copilot AI commented Apr 30, 2026

Uh oh!

rohitsinghal4u commented May 1, 2026

Uh oh!

Copilot AI commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Apr 30, 2026 •

edited

Loading

Copilot AI commented May 1, 2026 •

edited

Loading