Allow cryptography 46.x version and move it to dev dependencies.

[danielhav]

• Updates the dependency "cryptography" to be able to use the most recent stable version (which is currently 46.0.4).
• Move the cryptography dependency into the dev group as its only used in a test (test/auth/test_web_token_authenticator.py)

Description

This is also part of the latest "uv-version-updates" dependabot PR but I don't know what your plans are with those.

We wouldn't be able to use the client-python without this version bump so I kindly ask you to update it for the next (or one of the next) beta releases.

Related Issue

#97

Motivation and Context

We wouldn't be able to use the client-python without this version bump so I kindly ask you to update it for the next (or one of the next) beta releases.

How Has This Been Tested?

Check out the project, modify pyproject.toml accordingly and run uv run pytest.

Documentation:

I don't think doc updates are needed here?

Checklist:

• I have updated the documentation accordingly.
• I have assigned the correct milestone or created one if non-existent.
• I have correctly labeled this pull request.
• [ X ] I have linked the corresponding issue in this description.
• I have requested a review from at least 2 reviewers
• I have checked the base branch of this pull request
• [ X ] I have checked my code for any possible security vulnerabilities

[Lauszus]

Would be great to get this merged. It's blocking me from updating other dependencies in my project.

[d0rianb]

Any update on this ?

[mridang]

I'm checking this now.

[Copilot]

Pull request overview

This PR adjusts dependency management for the Python SDK by relocating cryptography from runtime dependencies to the dev dependency group, with the stated intent of supporting newer cryptography versions and reflecting that it’s only used in tests.

Changes:

• Remove cryptography from [project].dependencies.
• Add cryptography to [dependency-groups].dev with the same version range (>=44.0.1,<47.0.0).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description/title mention a version bump to allow 46.x, but the cryptography specifier here remains >=44.0.1,<47.0.0 (just moved groups). If the goal is to relax constraints for downstreams, moving it to dev may actually remove the constraint entirely for consumers; please confirm the intended behavior and adjust the constraint location/range accordingly.

[Copilot]

Moving cryptography out of [project].dependencies means the published package no longer constrains the runtime cryptography version for consumers. Since authlib depends on cryptography without a version specifier (see uv.lock), installers may resolve to a newer major cryptography than the SDK has been validated against, which can break JWT signing used by WebTokenAuthenticator. Consider keeping an explicit runtime constraint in [project].dependencies, or introducing an optional extra (e.g. jwt) that includes cryptography with a bounded range, rather than relying on the transitive dependency.