Adjust cryptography version bounds to be more accurate

changelog.d/20211013_190353_sirosen_fix_crypto_bound.rst

@@ -0,0 +1,4 @@
+* Adjust package metadata for `cryptography` dependency, specifying
+  `cryptography>=3.3.1` and no upper bound. This is meant to help mitigate
+  issues in which an older `cryptography` version is installed gets used in
+  spite of it being incompatible with `pyjwt[crypto]>=2.0` (:pr:`NUMBER`)

setup.py

@@ -67,7 +67,16 @@ def read_readme():
         "pyjwt[crypto]>=2.0.0,<3.0.0",
         # cryptography 3.4.0 is known-bugged, see:
         #   https://github.com/pyca/cryptography/issues/5756
-        "cryptography>=2.0,<3.7,!=3.4.0",
+        #
+        # pyjwt requires cryptography>=3.3.1,
+        # so there's no point in setting a lower bound than that
+        #
+        # as of 2021-10-13, we have removed the upper-bound, on the grounds that
+        # - we actively test on the latest versions
+        # - cryptography has a strong API stability policy that makes most releases
+        #   non-breaking for our usages
+        # - other packages /consumers can specify stricter bounds if necessary
+        "cryptography>=3.3.1,!=3.4.0",
     ],
     extras_require={"dev": DEV_REQUIREMENTS},
     keywords=["globus"],

tox.ini

@@ -13,7 +13,7 @@ extras = dev
 deps =
     mindeps: requests==2.19.1
     mindeps: pyjwt==2.0.0
-    mindeps: cryptography==2.0
+    mindeps: cryptography==3.3.1
 commands = pytest --cov=src --cov-append --cov-report= {posargs}
 depends =
     {py36,py37,py38,py39,py36-mindeps}: cov-clean