fix(deps): widen cryptography and pytz constaints

[Aaron ("AJ") Steers (aaronsteers)]

Summary

Based on community PR #1060 by Sean McGroarty (@mcgizzle) (first commit preserved for attribution).

Dependency constraint changes:

• cryptography: >=44.0.0,<47.0.0,!=45.0.0,!=45.0.1 → >=44.0.0,!=45.0.0,!=45.0.1
  • Removes upper cap that blocked >=48.0.1 (fixes HIGH-severity ASN.1 OOB read: SNYK-PYTHON-CRYPTOGRAPHY-17344551)
  • Lock resolves to 49.0.0
• pytz: 2024.2 (exact pin) → >=2024.2
  • pytz releases only ship IANA tz data updates — no API changes
  • Lock resolves to 2026.2

Cleanup:

• Removed cryptography from deptry DEP002 ignore list — it's directly imported (airbyte_cdk/sources/declarative/auth/jwt.py), so the unused-dependency exception was not needed.

Lock file: Regenerated with Poetry 2.1.4 (matching main) instead of the community PR's 2.4.1, avoiding marker format churn.

Link to Devin session: https://app.devin.ai/sessions/3b5b16c66fc4418097ed6b05d31385e7
Requested by: Aaron ("AJ") Steers (@aaronsteers)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1782491209-widen-cryptography-pytz#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1782491209-widen-cryptography-pytz

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[Copilot]

Pull request overview

This PR updates dependency constraints in the CDK’s Poetry project to allow installing patched versions of cryptography (addressing a security advisory) and to relax an exact pin on pytz, then regenerates poetry.lock accordingly.

Changes:

• Removed the <47.0.0 upper bound on cryptography while keeping exclusions for 45.0.0 and 45.0.1.
• Relaxed pytz from an exact pin (2024.2) to a lower-bounded constraint (>=2024.2).
• Regenerated poetry.lock, resulting in cryptography==49.0.0 and pytz==2026.2 in the resolved set.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pyproject.toml	Broadens cryptography constraint and relaxes pytz pin; minor update to deptry ignore comment/entry.
poetry.lock	Updates resolved versions/hashes/markers for cryptography, pytz, and related lock metadata.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

📝 Walkthrough

Walkthrough

pyproject.toml now allows newer cryptography and pytz releases, and the deptry DEP002 ignore entry for cryptography was removed.

Changes

Pyproject dependency policy

Layer / File(s)	Summary
Dependency constraints and deptry ignore pyproject.toml	cryptography now uses a lower-bound constraint with exclusions, pytz now uses a lower-bound constraint, and cryptography is removed from the DEP002 ignore list.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main dependency constraint updates for cryptography and pytz.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1782491209-widen-cryptography-pytz

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PyTest Results (Fast)

4 123 tests  ±0   4 111 ✅  - 1   7m 52s ⏱️ -44s
    1 suites ±0      12 💤 +1 
    1 files   ±0       0 ❌ ±0 

Results for commit b56212c. ± Comparison against base commit d828c57.

This pull request skips 1 test.

unit_tests.sources.declarative.test_concurrent_declarative_source ‑ test_read_with_concurrent_and_synchronous_streams

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

4 126 tests  ±0   4 114 ✅ ±0   12m 20s ⏱️ +21s
    1 suites ±0      12 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit b56212c. ± Comparison against base commit d828c57.

♻️ This comment has been updated with latest results.