feat!: update supported versions to match security updates #1118
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CoderJoshDK
force-pushed
the
dep-bounds
branch
from
3443740 to
fda264b
Compare
This does mean that python 2.7 support is dropped. As well as python 3.7 and bellow. However, they were dropped before this. These changes fully reflect that in the setup.py file
CoderJoshDK
force-pushed
the
dep-bounds
branch
from
fda264b to
d77ecc3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Important
Officially drops support for python <3.7 (was already not supported by this package)
Related
Related #1105
Makes #1112 easier to implement
Summary
This PR updates the bounds of dependencies, in order to match recent security updates.
This does mean that python 2.7 support is officially dropped. As well as python 3.7 and below.
However, they were dropped before this. This PR just reflects that in the setup.py file.
Cryptography bounds
With #1114, you are now bound by the requirements of that package. Cryptography dropped support for python 2 in v3.4: https://cryptography.io/en/latest/changelog/#v3-4
Python 3.7 is about to be dropped from Cryptography in the next release. But that doesn't matter because of
Werkzeug(mind you, all of these old versions are way past their EOL)I lowered the bound to
44.0.1. This is the last known good version without known security vulnerabilities.Werkzeug
The last version that doesn't contain security vulnerabilities is
3.0.6. This version does support python 3.8. And as such, if you want to capture security updates, python 3.8 is the lowest version you can support.In theory, you could support python 3.7 if you don't want to capture the Werkzeug security updates.
Checklist
If you have questions, please file a support ticket.
What this PR is not
While this PR does make the docs reflect that <3.7 is not supported, this is not an upgrade to python 3. That can be done in a different PR. One that removes special imports for python 2.7. I don't want to waste my time doing that if you decide to revert things so you can support 2.7.