search

odwyersoftware / azure-ad-verify-token

Verify JWT issued by Azure Active Directory B2C in Python 🐍
Other
22 stars 6 forks source link

Cryptography dependency lock #2

Closed vpolimenov closed 3 years ago

vpolimenov commented 3 years ago

Hello,

I was wandering whether there is a particular reason why I can't use cryptography > 3.0.0 with this package? https://github.com/odwyersoftware/azure-ad-verify-token/blob/master/requirements.txt#L2

I'm specifically asking because there is a known vulnerability with that library: https://github.com/pyca/cryptography/issues/5615 https://nvd.nist.gov/vuln/detail/CVE-2020-36242

Thanks in advance :)

richardARPANET commented 3 years ago

No reason other than semver. Feel free to check if a wider version range functions and then I can widen the supported range in this package.

vpolimenov commented 3 years ago

@richardARPANET thanks for the very quick answer!

If you could let me know when the new version is out it would be great :)

richardARPANET commented 3 years ago

@vpolimenov Will release in a few hours. Just fixing a computer issue first

richardARPANET commented 3 years ago

@vpolimenov 0.1.3 released

vpolimenov commented 3 years ago

great! thank you very much :pray: