What maintenance does this project need?
Problem
The cffi~=1.17 constraint in pygribjump causes an irresolvable dependency conflict with cryptography>=46.0.7, which requires cffi>=2.0.0.
The conflict reported by pip:
The conflict is caused by:
pygribjump 0.10.4.19 depends on cffi~=1.17
cryptography 46.0.7 depends on cffi>=2.0.0
This is a production blocker: cryptography>=46.0.7 is the minimum version that fixes three active CVEs:
Impact
This forces a choice between:
- Keeping
cryptography<46.0.7 — exposure to active CVEs in a production environment
- Dropping
pygribjump entirely from the project
We wouldn’t want to choose either option.
$ pip index versions pygribjump
pygribjump (0.10.4.19)
Available versions: 0.10.4.19, 0.10.4.14, 0.10.3.11, 0.10.3.9
Versions >=0.12.0 (which appear to have relaxed the cffi constraint - see #82) are not published on PyPI — only dev/pre-release builds are visible in the index but not installable:
$ pip install 'pygribjump>=0.12.0'
ERROR: Could not find a version that satisfies the requirement pygribjump>=0.12.0
ERROR: No matching distribution found for pygribjump>=0.12.0
Request
Publish a stable release on PyPI that includes this fix — dev builds are not suitable for production deployments
Environment
pygribjump==0.10.4.19cryptography==46.0.7 (minimum secure version)cffi==1.17.1 (current, incompatible with cryptography>=46.0.7)- Python 3.12
Organisation
No response
What maintenance does this project need?
Problem
The
cffi~=1.17constraint inpygribjumpcauses an irresolvable dependency conflict withcryptography>=46.0.7, which requirescffi>=2.0.0.The conflict reported by pip:
This is a production blocker:
cryptography>=46.0.7is the minimum version that fixes three active CVEs:Hash.update()with non-contiguous buffersImpact
This forces a choice between:
cryptography<46.0.7— exposure to active CVEs in a production environmentpygribjumpentirely from the projectWe wouldn’t want to choose either option.
Versions available on PyPI
Versions
>=0.12.0(which appear to have relaxed thecfficonstraint - see #82) are not published on PyPI — only dev/pre-release builds are visible in the index but not installable:Request
Publish a stable release on PyPI that includes this fix — dev builds are not suitable for production deployments
Environment
pygribjump==0.10.4.19cryptography==46.0.7(minimum secure version)cffi==1.17.1(current, incompatible withcryptography>=46.0.7)Organisation
No response