cryptography

Frameworks & LibrariesApache-2.0 OR BSD-3-Clause

cryptography release notes.

Latest 50.0.1 · by cryptographyWebsitePyPI · cryptographyRSS

Release activity

Release activity — 14 releases across 14 days in the last year. Each cell is one day; darker means more releases that day. Older weeks are hidden at this screen width.
JunJulAugSep
SundayNo releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026No releases on Aug 16, 2026No releases on Aug 23, 2026No releases on Aug 30, 2026No releases on Sep 6, 2026No releases on Sep 13, 2026
MondayNo releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026No releases on Aug 17, 2026No releases on Aug 24, 2026No releases on Aug 31, 2026No releases on Sep 7, 2026No releases on Sep 14, 2026
TuesdayNo releases on Jun 2, 20261 release on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026No releases on Aug 18, 20261 release on Aug 25, 2026No releases on Sep 1, 2026No releases on Sep 8, 2026
WednesdayNo releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026No releases on Aug 12, 2026No releases on Aug 19, 2026No releases on Aug 26, 2026No releases on Sep 2, 2026No releases on Sep 9, 2026
ThursdayNo releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026No releases on Aug 13, 2026No releases on Aug 20, 2026No releases on Aug 27, 2026No releases on Sep 3, 2026No releases on Sep 10, 2026
FridayNo releases on Jun 5, 20261 release on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 20261 release on Jul 31, 2026No releases on Aug 7, 2026No releases on Aug 14, 2026No releases on Aug 21, 2026No releases on Aug 28, 2026No releases on Sep 4, 2026No releases on Sep 11, 2026
SaturdayNo releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026No releases on Aug 15, 2026No releases on Aug 22, 2026No releases on Aug 29, 2026No releases on Sep 5, 2026No releases on Sep 12, 2026

14 releases in the last year

Changelog

What changed from 49 to 50

50.0.1

Latest
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
View originalPermalink
How 50.0.1 went

50.0.0

Added 4
  • Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash
  • Added the Cobblestone (streaming symmetric encryption) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages
  • Added support for using Name as a field type in the ASN.1 module
  • Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs
Changed 5
  • X.509 verification APIs are now considered stable and are subject to the API stability policy
  • XOFHash is now supported when building against AWS-LC
  • HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC
  • Diffie-Hellman key exchange is now supported when building against AWS-LC
  • The builtin HashAlgorithm classes and the classes in padding can now be compared with ==
Fixed 5
  • Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT
  • Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits
  • Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form
  • load_der_ocsp_request() and load_der_ocsp_response() now reject a request or response whose version field is not v1, the only version defined by RFC 6960
  • load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits
Deprecated 1
  • Diffie-Hellman key exchange over finite fields (FFDH) is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs
Security 1
  • pkcs7_decrypt_der() and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages, by substituting a random key on failure as described in RFC 3218

From cryptography

  • SECURITY ISSUE: pkcs7_decrypt_der()and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to @X1AOxiang for reporting the issue. CVE-2026-69247
  • Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
  • Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash.
  • The X.509 verification APIs are now considered stable and are subject to our API stability policy.
  • Added the Cobblestone (streaming symmetric encryption) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages.
  • Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them.
  • Added support for using Name as a field type in the ASN.1 module.
  • Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it.
  • Parsing a CRL entry’s InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field.
  • load_der_ocsp_request() and load_der_ocsp_response() now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs.
  • XOFHash is now supported when building against AWS-LC.
  • HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC.
  • Diffie-Hellman (Diffie-Hellman key exchange) is now supported when building against AWS-LC.
  • load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits, matching the minimum already enforced when loading DH private keys and when constructing DHParameterNumbers.
  • Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs.
  • The builtin HashAlgorithmclasses and the classes in padding can now be compared with ==.
  • CertificateBuilder now supports creating unsigned certificates (RFC 9925) with the create_unsigned method.
  • The X.509 verification APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87 (RFC 9881) public keys and signatures by default.
View originalPermalink
How 50.0.0 went

49.0.0

Added 7
  • Added support for signing and verifying X.509 certificates, certificate signing requests, and certificate revocation lists with ML-DSA signing keys
  • Added support for loading certificates that contain ML-DSA public keys
  • Added enc_length() method to KEM to allow callers to split the encapsulated key from the ciphertext returned by encrypt()
  • Added support for using Certificate, CertificateSigningRequest, and CertificateRevocationList as field types in ASN.1 structures
  • Added value_set() class decorator to register an enum.Enum subclass as an ASN.1 value set
  • Added from_bytes() method for parsing a Name from DER bytes as the inverse of public_bytes()
  • Added rsa_padding keyword-only parameter to CertificateBuilder.public_key() to encode RSA subject public keys with the id-RSASSA-PSS OID
Changed 3
  • ChaCha20 now treats the first 4 bytes of the nonce as a 32-bit little-endian block counter as defined in RFC 7539 and tracks the number of bytes processed
  • Loading an X.509 certificate whose ECDSA or DSA signature AlgorithmIdentifier contains encoded NULL parameters now raises ValueError instead of loading with a deprecation warning
  • require_present(), may_be_present(), and require_not_present() now accept any extension type instead of only a fixed set
Fixed 2
  • ChaCha20 now raises ValueError when attempting to encrypt or decrypt more data than the counter allows before it would overflow, rather than silently diverging from RFC 7539
  • Fixed cross-compilation of the CFFI bindings when PYO3_CROSS_LIB_DIR is set by deriving the Python include directory from PYO3_CROSS_LIB_DIR instead of querying the host interpreter
Removed 3
  • Support for x86_64 macOS has been removed; only arm64 wheels are published for macOS
  • Support for 32-bit Windows has been removed
  • Removed deprecated type aliases PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES, CERTIFICATE_PRIVATE_KEY_TYPES, CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and CERTIFICATE_PUBLIC_KEY_TYPES

From cryptography

  • BACKWARDS INCOMPATIBLE: Support for x86_64 macOS has been removed. We now only publish arm64 wheels for macOS.
  • BACKWARDS INCOMPATIBLE: Support for 32-bit Windows has been removed. Users should move to a 64-bit Python installation.
  • BACKWARDS INCOMPATIBLE: Removed the deprecated PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES, CERTIFICATE_PRIVATE_KEY_TYPES, CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use PublicKeyTypes, PrivateKeyTypes, CertificateIssuerPrivateKeyTypes, CertificateIssuerPublicKeyTypes, and CertificatePublicKeyTypesinstead. These were deprecated in version 40.0.
  • BACKWARDS INCOMPATIBLE: ChaCha20now treats the first 4 bytes of the nonce as a 32-bit little-endian block counter (as defined in RFC 7539) and tracks the number of bytes processed. Attempting to encrypt or decrypt more data than the counter allows before it would overflow now raises a ValueError rather than silently diverging from RFC 7539. Setting the counter portion of the nonce to zero allows encrypting up to 256 GiB with a given nonce.
  • BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose ECDSA or DSA signature AlgorithmIdentifier contains encoded NULL parameters now raises a ValueError. Such certificates are invalid, but older versions of Java emitted them; previously they loaded with a deprecation warning.
  • Fixed cross-compilation of the CFFI bindings when PYO3_CROSS_LIB_DIRis set. The build now derives the Python include directory from PYO3_CROSS_LIB_DIR instead of querying the host interpreter, which previously caused the build to fail during cross-compilations for embedded systems, on hosts which have same-version Python development headers installed as the target Python.
  • Added support for signing and verifying X.509 certificates, certificate signing requests, and certificate revocation lists with ML-DSA signing keys, as well as loading certificates that contain ML-DSA public keys.
  • Added enc_length() to KEM so callers can split the encapsulated key from the ciphertext returned by encrypt().
  • require_present(), may_be_present(), and require_not_present()now accept any extension type. Previously only a fixed set of extension types was supported, which made it impossible to account for otherwise unrecognized critical extensions during path validation.
  • Added support for using Certificate, CertificateSigningRequest, and CertificateRevocationList as field types in ASN.1 structures.
  • Added value_set(), a class decorator that registers an enum.Enum subclass as an ASN.1 value set: members are encoded as their underlying value, and decoding fails if the decoded value does not match one of the declared members.
  • Added from_bytes() for parsing a Name from DER bytes, the inverse of public_bytes().
  • Added the rsa_padding keyword-only parameter to public_key(). Passing the PSS class (not an instance) encodes an RSA subject public key in the certificate’s subjectPublicKeyInfo with the id-RSASSA-PSS OID and no parameters.
  • Added external mu (message representative) support to ML-DSA signing via the sign_mu and verify_mu methods, which sign and verify a precomputed 64-byte mu as defined in FIPS 204.
View originalPermalink
How 49.0.0 went

48.0.1

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
View originalPermalink
How 48.0.1 went

48.0.0

Added 1
  • Support for ML-KEM key encapsulation and ML-DSA signing when using OpenSSL 3.5.0 or later
Changed 1
  • Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError instead of being parsed successfully
Removed 1
  • Support for Python 3.8 has been removed; cryptography now requires Python 3.9 or later

From cryptography

  • BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

  • BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

  • Added support for ML-KEM key encapsulation and ML-DSA signing when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

View originalPermalink
How 48.0.0 went

47.0.0

Added 3
  • Added extract() method to HKDF
  • Added support for loading elliptic curve keys that contain explicit encodings of the curves secp256r1, secp384r1, and secp521r1
  • Added support for Argon2d and Argon2i when using OpenSSL 3.2.0+
Changed 4
  • Loading keys with unsupported algorithms or keys with unsupported explicit curve encodings now raises UnsupportedAlgorithm instead of ValueError
  • When parsing elliptic curve private keys, keys that incorrectly encode a private key of the wrong length are now rejected
  • Updated the minimum supported Rust version (MSRV) to 1.83.0
  • public_bytes and private_bytes methods on keys now raise TypeError instead of ValueError if an invalid encoding is provided
Removed 3
  • Support for binary elliptic curves (SECT* classes) has been removed
  • Support for OpenSSL 1.1.x has been removed; OpenSSL 3.0.0 or later is now required
  • Dropped support for LibreSSL < 4.1
Deprecated 6
  • Support for Python 3.8 is deprecated and will be removed in the next cryptography release
  • Passing 64-bit (8-byte) and 128-bit (16-byte) keys to TripleDES is deprecated; only 192-bit (24-byte) keys will be accepted in a future release
  • Support for x86_64 macOS is deprecated and will be removed in the next release
  • Support for 32-bit Windows is deprecated and will be removed in the next release
  • CFB, OFB, and CFB8 have been moved into Decrepit cryptography and are deprecated in the modes module
  • Camellia has been moved into Decrepit cryptography and is deprecated in the cipher module

From cryptography

  • Support for Python 3.8 is deprecated and will be removed in the next cryptography release.

  • BACKWARDS INCOMPATIBLE: Support for binary elliptic curves (SECT* classes) has been removed. These curves are rarely used and have additional security considerations that make them undesirable.

  • BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been removed. OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC continue to be supported.

  • BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 4.1.

  • BACKWARDS INCOMPATIBLE: Loading keys with unsupported algorithms or keys with unsupported explicit curve encodings now raises UnsupportedAlgorithm instead of ValueError. This change affects load_pem_private_key(), load_der_private_key(), load_pem_public_key(), load_der_public_key(), and public_key() when called on certificates with unsupported public key algorithms.

  • BACKWARDS INCOMPATIBLE: When parsing elliptic curve private keys, we now reject keys that incorrectly encode a private key of the wrong length because such keys are impossible to process in a constant-time manner. We do not believe keys with this problem are in wide use, however we may revert this change based on the feedback we receive.

  • Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to TripleDES. In a future release, only 192-bit (24-byte) keys will be accepted. Users should expand shorter keys themselves (e.g., for single DES: key + key + key, for two-key: key + key[:8]).

  • Updated the minimum supported Rust version (MSRV) to 1.83.0, from 1.74.0.

  • Support for x86_64 macOS (including publishing wheels) is deprecated and will be removed in the next release. We will switch to publishing an arm64 only wheel for macOS.

  • Support for 32-bit Windows (including publishing wheels) is deprecated and will be removed in the next release. Users should move to a 64-bit Python installation.

  • public_bytes and private_bytes methods on keys now raise TypeError (instead of ValueError) if an invalid encoding is provided for the given format.

  • Moved CFB, OFB, and CFB8 into Decrepit cryptography and deprecated them in the modes module. They will be removed from the modes module in 49.0.0.

  • Moved Camelliainto Decrepit cryptography and deprecated it in the cipher module. It will be removed from the cipher module in 49.0.0.

  • Added extract()to HKDF. The previous private implementation will be removed in 49.0.0.

  • Added support for loading elliptic curve keys that contain explicit encodings of the curves secp256r1, secp384r1, and secp521r1.

  • Added support for Argon2dand Argon2iwhen using OpenSSL 3.2.0+.

  • Added derive_into methods to HKDF, HKDFExpand, ConcatKDFHash, ConcatKDFHMAC, Argon2id, PBKDF2HMAC, KBKDFHMAC, KBKDFCMAC, Scrypt, and X963KDF to allow deriving keys directly into pre-allocated buffers.

  • Added encrypt_into and decrypt_into methods to AESCCM, AESGCM, AESGCMSIV, AESOCB3, AESSIV, and ChaCha20Poly1305 to allow encrypting directly into a pre-allocated buffer.

  • Added support for PKCS1v15 signing without DigestInfo using NoDigestInfo.

  • Added hash(), a one-shot method for computing hashes.

  • Added HPKE (Hybrid Public Key Encryption) support implementing RFC 9180 for hybrid authenticated encryption.

  • Added new ML-KEM key encapsulation module with support for ML-KEM key encapsulation with AWS-LC and BoringSSL.

    • Note: Post-quantum algorithm support requires AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most users will not have access to these APIs yet. See The State of OpenSSL for pyca/cryptography for more information on OpenSSL support.

  • Added new ML-DSA signing module with support for ML-DSA signing and verification with AWS-LC and BoringSSL.

    • Note: Post-quantum algorithm support requires AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most users will not have access to these APIs yet. See The State of OpenSSL for pyca/cryptography for more information on OpenSSL support.

  • Added new ASN.1 module with support for declaratively defining custom ASN.1 types and encoding/decoding them.

  • Fixed compilation when using LibreSSL 4.3.0 and OpenSSL 4.0.0.

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.0.

View originalPermalink
How 47.0.0 went

46.0.7

Changed 1
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6
Security 1
  • Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers, which could lead to buffer overflow (CVE-2026-39892)

From cryptography

  • SECURITY ISSUE: Fixed an issue where non-contiguous buffers could be passed to APIs that accept Python buffers, which could lead to buffer overflow. CVE-2026-39892
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
View originalPermalink
How 46.0.7 went

46.0.6

Security 1
  • Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN

From cryptography

  • SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073
View originalPermalink
How 46.0.6 went

46.0.5

Deprecated 1
  • Support for SECT* binary elliptic curves is deprecated and will be removed in the next release
Security 1
  • Add security checks to prevent private key leakage when using binary elliptic curves with malicious public keys (CVE-2026-26007)

From cryptography

  • An attacker could create a malicious public key that reveals portions of your private key when using certain uncommon elliptic curves (binary curves). This version now includes additional security checks to prevent this attack. This issue only affects binary elliptic curves, which are rarely used in real-world applications. Credit to XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting the issue. CVE-2026-26007
  • Support for SECT* binary elliptic curves is deprecated and will be removed in the next release.
View originalPermalink
How 46.0.5 went

46.0.4

Changed 1
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5
Removed 1
  • Dropped support for win_arm64 wheels

From cryptography

View originalPermalink
How 46.0.4 went

46.0.3

  • Fixed compilation when using LibreSSL 4.2.0.
View originalPermalink
How 46.0.3 went

46.0.2

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.
View originalPermalink
How 46.0.2 went

46.0.1

Fixed 2
  • Fixed an issue where users installing via pip on Python 3.14 development versions would not properly install a dependency
  • Fixed an issue building the free-threaded macOS 3.14 wheels

From cryptography

  • Fixed an issue where users installing via pip on Python 3.14 development versions would not properly install a dependency.
  • Fixed an issue building the free-threaded macOS 3.14 wheels.
View originalPermalink
How 46.0.1 went

46.0.0

Added 3
  • Build and publish ppc64le manylinux wheels to PyPI
  • Build and publish win_arm64 (Windows on Arm) wheels to PyPI
  • Support for free-threaded Python 3.14
Changed 1
  • Windows, macOS, and Linux wheels are now compiled with OpenSSL 3.5.3
Fixed 1
  • In X.509, PSS signatures with SHA-3 hashes are now encoded with the official NIST SHA3 OID
Removed 3
  • Support for Python 3.7 has been removed
  • Removed the deprecated get_attribute_for_oid method on CertificateSigningRequest
  • Removed the deprecated CAST5, SEED, IDEA, and Blowfish classes from the cipher module
Deprecated 3
  • Support for OpenSSL < 3.0 is deprecated and will be removed in the next release
  • Support for x86_64 macOS is deprecated and will be removed in two releases
  • Support for 32-bit Windows is deprecated and will be removed in two releases

From cryptography

  • BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.
  • Support for OpenSSL < 3.0 is deprecated and will be removed in the next release.
  • Support for x86_64 macOS (including publishing wheels) is deprecated and will be removed in two releases. We will switch to publishing an arm64 only wheel for macOS.
  • Support for 32-bit Windows (including publishing wheels) is deprecated and will be removed in two releases. Users should move to a 64-bit Python installation.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.3.
  • We now build ppc64le manylinux wheels and publish them to PyPI.
  • We now build win_arm64 (Windows on Arm) wheels and publish them to PyPI.
  • Added support for free-threaded Python 3.14.
  • Removed the deprecated get_attribute_for_oid method on CertificateSigningRequest. Users should use get_attribute_for_oid() instead.
  • Removed the deprecated CAST5, SEED, IDEA, and Blowfishclasses from the cipher module. These are still available in Decrepit cryptography.
  • In X.509, when performing a PSS signature with a SHA-3 hash, it is now encoded with the official NIST SHA3 OID.
View originalPermalink
How 46.0.0 went

45.0.7

  • Added a function to support an upcoming pyOpenSSL release.
View originalPermalink
How 45.0.7 went

45.0.6

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.2.
View originalPermalink
How 45.0.6 went

More in Frameworks & Libraries

View all
React

The library for web and native user interfaces.

Meta
Vue

The progressive JavaScript framework for building user interfaces.

Vue.js
Vue 2

The Vue 2 line, in long-term maintenance since its end of life in December 2023.

Vue.js
bootstrap

The most popular HTML, CSS, and JavaScript framework for developing responsive, mobile first projects on the web.

twbs
react-native

react-native release notes.

Meta
D3

Bring data to life with SVG, Canvas and HTML.

Observable

Discussion