Cryptography dependency lock

[vpolimenov]

Hello,

I was wandering whether there is a particular reason why I can't use cryptography > 3.0.0 with this package?
https://github.com/odwyersoftware/azure-ad-verify-token/blob/master/requirements.txt#L2

I'm specifically asking because there is a known vulnerability with that library:
pyca/cryptography#5615
https://nvd.nist.gov/vuln/detail/CVE-2020-36242

Thanks in advance :)

[richardARPANET]

No reason other than semver. Feel free to check if a wider version range functions and then I can widen the supported range in this package.

[vpolimenov]

@richardARPANET thanks for the very quick answer!

If you could let me know when the new version is out it would be great :)

[richardARPANET]

@vpolimenov Will release in a few hours. Just fixing a computer issue first

[richardARPANET]

@vpolimenov 0.1.3 released

[vpolimenov]

great! thank you very much 🙏