Skip to content

Conversation

@vivodi
Copy link

@vivodi vivodi commented Nov 21, 2025

cryptography is only a transitive dependency and doesn’t need to be managed directly by us.

Under default conditions, an appropriate version will be installed automatically.

Pinning it instead unnecessarily increases dependency complexity and raises confusion as to why it’s being explicitly fixed.

@vivodi
Copy link
Author

vivodi commented Nov 21, 2025

If you @oz123 believe that using an older version of cryptography is insecure, you should pin it in the PyOpenSSL project instead (and if you consider it necessary, you’re welcome to submit a PR there).

The pytest-localftpserver project does not import cryptography directly, so pinning it here does not align with best practices in software engineering.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant