New cffi>=2.0 pin makes cryptography incompatible with other libraries

[gibsondan]

Just flagging that this change #13448 makes new versions of cryptography incompatible with other packages that pin cffi<2.0 (the specific example that I'm aware of currently is snowflake-connector-python).

Is there a world in which both versions are allowed?

[reaperhulk]

(Pasting this comment here as well since a separate issue is good for this discussion)

Does 46.0.0 work for you? The version bound was only py314 there.

More broadly, I’m not aware of a good answer to this situation, only tradeoffs to choose between. There is no way to express free threaded only dependencies and pip additionally has a constraint where it does not consider pre-release to match >=3.14. Once 3.14 is out we could consider shifting the pin back up to 3.14 but technically that’s still incorrect since we only need it on 3.14t.

Separately, cffi 2.0 is not a semantic versioned library though so compatibility should not be an issue and libraries bounding <2 are under a misapprehension. That said, I imagine you aren’t setting that bound, it’s some other dep.

[gibsondan]

46.0.0 does work, yes - for now there are workarounds, the concern is around having to choose between using snowflake (and whatever other dependencies have strict pins on cffi) and having up to date cryptography fixes going forward.

(I also filed an issue in the snowflake-connector-python repo, since i'm not sure if they have a good reason for their pin)

[alex]

Has an issue/PR been send to snowflake?

As @reaperhulk said, we're kind of between a rock and a hard place here. Would like to find the best solution, but it's probably going to be a compromise either way. The more we can help other libraries raise their bounds, I think the more flexibility we'll have.

(Maybe another way to say this is: no matter what, other libraries that want to be 3.14t compatible will need to raise their bounds.)

[alex]

Messages crossed paths :-) Can you share a link to the snowflake issue?

[gibsondan]

Here's the snowflake issue: snowflakedb/snowflake-connector-python#2541

[alex]

Given that snowflake is the only project we've heard about haaving this issue, and this issue is really on their end (they have a pin for no reason), I'm going to close this from our end.

If there are other projects with upper bounds where this is causing issues, please let us know and we can discuss if it warrants some other action.