CVE-2023-50782 - cryptography transitive dependency

[dimon222]

I'm cracking my head for few days now.
As part of airflow guide there's upper bound dependency constraints file. For setup with providers it has limit for cryptography to tree 41.x. I want to pass bridge to get to 42.x but having serious struggles to identify what particular provider is restricting to go further as there's no explicit restriction on upper version of cryptography anywhere in airflow codebase (seems). I suspect it's a transitive dependency of transitive dependency but unable find which one.

Any clue? I've been typically using pip-tools to write calculated tree with all involved dependencies in comments but it's not viable if I gave constraints file. And removing constraints file straight fails to run because pip can't figure out puzzle on his own.

[potiuk]

You can download constraint file, change cryptography version and install what you want. If it has conflict, pip will tell you what the confllict is.

[potiuk]

BTW:

gcloud-aio-auth 4.2.3 requires cryptography<42.0.0,>=2.0.0, but you have cryptography 42.0.0 which is incompatible.

[potiuk]

created #39491