Outdated cryptography<47.0.0,>=3.2.1 version dependency in oci==2.179.0 (released on Jun 16 2026)

[Eimert]

In the latest release of the oci package (2.179.0 as of writing, released Jun 16, 2026) the cryptography package requirement is outdated. The latest cryptography package meeting this requirement is v46.0.7, released Apr 8, 2026.

cryptography v46.0.7 has a high vulnerability: GHSA-537c-gmf6-5ccf.

cryptography==49.0.0
oci==2.179.0
pyOpenSSL=26.3.0
(..)

pip install gives:

# ERROR: pip's dependency resolver does not currently take into account all the packages that are installed. This behaviour is the source of the following dependency conflicts.
#oci 2.179.0 requires cryptography<47.0.0,>=3.2.1, but you have cryptography 48.0.1 which is incompatible.
#pyopenssl 26.3.0 requires cryptography<50,>=49.0.0, but you have cryptography 48.0.1 which is incompatible.

The request is to upgrade the cryptography dependency.

Previous similar issue: #841 .

Tagging @harshkumar-dev who updated the version in the requirements last.