Update cryptography version upper bound

[mkleehammer]

The requirements for cryptography are cryptography >= 2.1.4, < 4 but that library's versioning was changed changed. They are now upgrading the major version more often so the current version is 35.

I think they've made an unfortunate decision abandoning semver, but it is something we'll have to live with.

I'm using two requirements files, one for production and one for development, both generated by pip-tools. It's important for dev to use the exact versions from the production compilation. Unfortunatly compilation is choosing cryptography 35, but signxml is only in the development file. It cannot currently use v35.

[kislyuk]

Thanks for noticing this. I agree the decision to abandon semver is problematic. Patch release coming up.

[kislyuk]

Released in v2.9.0

[mkleehammer]

This is great. Thanks.