Cryptography Pin

[skeezus]

Is there any reason to have this pin installing all new Cryptography releases:

jwcrypto/setup.py

Line 27 in dedf67b

'cryptography >= 2.3',

They had a significant major version release recently which broke my application. Looks like they bunged up the version tag as well :) https://pypi.org/project/cryptography/#history

Something like 'cryptography ~= 2.3' would seem to work better...

[simo5]

Yes we prefer to use the latest cryptography so we do not have to monitor all security release and hard bump what you should use.
We try to set as minimum the bare minimum required, and we raise it whenever we start using a feature that requires a newer version of cryptography,

So a pin to a specific version of cryptography is not something we'll consider.

[braden-up]

Hmm yea patch level increases would grab security updates.