Cannot take security patch for pyOpenSSL library due to upper bound on pyOpenSSL version

[ZivBleich]

GHSA-5pwr-322w-8jr4 has been reported which is fixed in pyOpenSSL v26.0.0.

However the latest version of oci still requires a version <=25.3.0.

Can the maximum supported version please be bumped?

[penguinolog]

GHSA-vp96-hxj8-p424 is also require v26.0.0

[nishanpoojary]

Thank you for reporting this issue.

The OCI Python SDK dependency constraints have been updated in current releases to allow the required pyOpenSSL security patch line. Please upgrade to the latest available SDK version and re-validate in your environment.

As this specific upper-bound concern has been addressed, we are closing this issue.

[ouldriw]

@nishanpoojary This is now broken again. OCI is still reliant on cryptography < 47.0.0. There have been multiple cryptography releases since up to 49.0.0 and anything < 48.0.1 has reported CVEs present.

Please can you at least be more proactive reviewing these upper bounds if not looking to remove them completely.

[ZivBleich]

@nishanpoojary
Do you want me to open a new issue for it?
And also, thank you for solving this one.

[nishanpoojary]

@ZivBleich Thanks for checking back. No, you do not need to create a new issue.

We tracked this internally as a separate follow-up to increase the upper bound.