Closed mihaimyh closed 2 years ago
foo
which unnecessarily pins msal==1.10.0 or msal<1.11.0.Please remove these pointless and random "upper bounds". They are completely wrong, serve no purpose, and break everything everywhere once a year. They only make sense when there's a specific and known breakage - but then and only then. It is not the case here.
We had an inconclusive offline discussion with Luca on Cryptography's official deprecation policy which we derive the current <X+3.0.0
upper bound from. As it current stands, MSAL will periodically update its dependency's upper bound when the time comes.
Also, because MSAL itself strictly follows Semantic Versioning, MSAL's consumers will always be able to smoothly upgrade to a higher version of compatible MSAL, so that those rolling upper bound shouldn't be an issue.
Cryptography changed their versioning strategy, latest being cryptography 35.0.0 which breaks installation for my package since
msal
requires:https://github.com/pyca/cryptography/issues/6345