[feature] Lift version limitation for the PyJWT

[ezaiakinsc]

Currently Conan has version limitation for PyJWT like this:
PyJWT>=1.4.0, <2.0.0

Popular frameworks, like PyGithub, are gradually lifting minimal PyJWT version to the 2.0+, and it becomes problematic to use conan together with the rest of the scripting. Situation is temporary resolvable using virtuenv, but python version switching is yet another dimension for human mistakes, especially for non-experts in python.

It would be way easier if conan can be installed together with mainstream packages in a typical environment. Can PyJWT version limit be lifted to the 2.0+?

• I've read the CONTRIBUTING guide.

[memsharded]

Well, it is a major version, so probably requires a bit extra of testing to make sure nothing is broken, not just lifting the version requirements, but might require changes in code (and then the opposite might happen, users stuck with older PyJWT might have incompatibilities).

For example, they are dropping support for Python2 (which we still maintain for Conan 1.X so far), of the transitive cryptography >= 3, might be an issue.

Lets check it.

[memsharded]

Please read my comments in #8952 (review):

• I think this will break other users
• There is no perfect solution to this issue
• As this is only in the conan_server code, forcing the version in client only users will not break the client, and the issue can be workarounded with virtualenvs

So lets move it to Conan 2.0, where we will decouple the conan_server PyPI package if possible.

[memsharded]

Closed in #8952, will be in the next 2.0-alpha.6

[bjornfor]

FYI, there's a CVE for PyJWT which now affects the latest released conan.

[memsharded]

Hi @bjornfor

Latest Conan already upgraded to PyJWT>=2.4.0, <3.0.0in #11350 and released in last Conan 1.49 (and in any case, this is a requirement for conan_server, it is not used at all in the Conan client, just in case there is a concern for previous versions. And even previous versions of the server were not exposed to the vulnerability, checked usage in code).

Thanks for reporting!

[bjornfor]

@memsharded: Thanks for the info! (Sorry, I just assumed it wasn't part of a release yet based on parent message.)

[memsharded]

@memsharded: Thanks for the info! (Sorry, I just assumed it wasn't part of a release yet based on parent message.)

Yeah, probably this issue should have been updated too, but sometimes it is difficult, the activity in the repo is very high. Thanks for telling, it is always better to be sure!