SNOW-3244317: Tight upper bound on pyopenssl in dependency constraints prevents CVE fix

[sparkiegeek-slam]

snowflake-connector-python/setup.cfg

Line 51 in 14624ed

pyOpenSSL>=24.0.0,<26.0.0

By forcing an upper bound on pyopenssl <26.0.0, users of this project cannot easily address GHSA-vp96-hxj8-p424

Work arounds are either to ignore the vulnerability in scanning tools (e.g. uv-secure, pip-audit, ...) or force the dependency install and break the constraint in this project.

Note there are backwards incompatible changes in https://www.pyopenssl.org/en/latest/changelog.html#id1, notably dropping Python 3.7 which already aligns with the connector supported versions.

[ifm-pgarner]

upper bounds on dependencies for a library is bad practice IMHO, leave it open unless there is a known incompatibility

users can always pin things for themselves if there's a problem in future

but if you already bounded it then users can't upgrade

[sfc-gh-sghosh]

Hello @sparkiegeek-slam,

Thanks for raising the concern, we will review and work on eliminating the restriction.

[maksimu]

Would good if this is resolved ASAP as we need to submit our SBOM for review which will mark that CVE and we will have to fork this repo or just wait...