Mailman 3 May 2026 - Cryptography-dev

bc1qr8e6kmev99jxnk7hpyhex434t59ke5tpvmnyd3
by 172412067+mahdi99mi＠users.noreply.github.com May 10, 2026

May 10, 2026

b50a18c8f3d3ce87dea027a979df88998755fd915669ad86b7967477cb29d9e2

1 0

PyCA cryptography 48.0.0 released
by Paul Kehrer May 4, 2026

May 4, 2026

PyCA cryptography 48.0.0 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X.509, key derivation functions, and much more. We support Python 3.9+, and PyPy3 3.11. Changelog (https://cryptography.io/en/latest/changelog/#v48-0-0) * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later. * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation. * Added support for ML-KEM key encapsulation and ML-DSA signing when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels. * Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See ( https://cryptography.io/en/latest/statements/state-of-openssl/) for more information. -Paul Kehrer (reaperhulk)

1 0

[PR] fix: -headerpad_max_install_names regression in macOS 15 wheels (46.0.4)
by washingtoneg＠gmail.com May 4, 2026

May 4, 2026

Hi all, Opened a PR to permanently fix the `-headerpad_max_install_names` regression that appeared in 46.0.4: https://github.com/pyca/cryptography/pull/14777 The short version: macOS 15 CI runners use Apple's new linker (ld_prime), which reserves much less Mach-O header padding than the old ld. Homebrew's install_name_tool needs that padding to rewrite dylib paths post-install. When it's absent, `brew install`/`brew upgrade` fails with: "Updated load commands do not fit in the header of _rust.abi3.so" The fix is three lines in src/rust/build.rs — emit -Wl,-headerpad_max_install_names via cargo:rustc-link-arg when targeting macOS. This is the same class of issue discussed in #7847 (2022). At the time, @reaperhulk noted there was no objection to adding the flag permanently. The symptom went away on its own then; the macos-13 → macos-15 runner migration brought it back for good. PR: https://github.com/pyca/cryptography/pull/14777 Thanksk Elena

1 1