From 6638ff94ee5eb761fb379df6f6a5e917998a0c02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joni=20K=C3=A4mpp=C3=A4?= Date: Wed, 2 Sep 2026 09:49:05 +0300 Subject: [PATCH 1/2] fix(google-auth): raise cryptography lower bound for Python 3.14 cryptography 41.0.5 has no Python 3.14 wheels, so unit tests cannot resolve the 3.14 constraints pin. Require 50.0.1, which is the first release with Python 3.14 support. --- packages/google-auth/setup.py | 2 +- packages/google-auth/testing/constraints-3.14.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py index cff8a7bdbda9..aeb60983c233 100644 --- a/packages/google-auth/setup.py +++ b/packages/google-auth/setup.py @@ -19,7 +19,7 @@ cryptography_base_require = [ "cryptography >= 38.0.3; python_version < '3.14'", - "cryptography >= 41.0.5; python_version >= '3.14'", + "cryptography >= 50.0.1; python_version >= '3.14'", ] DEPENDENCIES = ( diff --git a/packages/google-auth/testing/constraints-3.14.txt b/packages/google-auth/testing/constraints-3.14.txt index 64212e65e4df..2590a2cfbec2 100644 --- a/packages/google-auth/testing/constraints-3.14.txt +++ b/packages/google-auth/testing/constraints-3.14.txt @@ -6,5 +6,5 @@ # e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev", # Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 -cryptography==41.0.5 +cryptography==50.0.1 aiohttp==3.9.0 From f72b141748a034472d55a91e7300ab4799abee7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Joni=20K=C3=A4mpp=C3=A4?= Date: Wed, 2 Sep 2026 09:51:02 +0300 Subject: [PATCH 2/2] fix(google-auth): raise cryptography lower bound for Python 3.10-3.13 Require cryptography 46.0.5, which fixes CVE-2026-26007, and pin the same version in the 3.10 lower-bound constraints. --- packages/google-auth/setup.py | 2 +- packages/google-auth/testing/constraints-3.10.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py index aeb60983c233..6e3463f99233 100644 --- a/packages/google-auth/setup.py +++ b/packages/google-auth/setup.py @@ -18,7 +18,7 @@ from setuptools import find_namespace_packages, setup cryptography_base_require = [ - "cryptography >= 38.0.3; python_version < '3.14'", + "cryptography >= 46.0.5; python_version < '3.14'", "cryptography >= 50.0.1; python_version >= '3.14'", ] diff --git a/packages/google-auth/testing/constraints-3.10.txt b/packages/google-auth/testing/constraints-3.10.txt index f9467d86a690..d70a7e8723c4 100644 --- a/packages/google-auth/testing/constraints-3.10.txt +++ b/packages/google-auth/testing/constraints-3.10.txt @@ -7,7 +7,7 @@ # Then this file should have foo==1.14.0 pyasn1-modules==0.2.1 setuptools==40.3.0 -cryptography==38.0.3 +cryptography==46.0.5 aiohttp==3.8.0 requests==2.30.0 pyjwt==2.0