The latest PyPI release, orderly-evm-connector==0.2.9, declares cryptography>=42.0.8,<43.0.0. Current cryptography security advisories require progressively newer patched versions, with the highest relevant patched floor at 48.0.1.
I ran an isolated Python 3.12 compatibility lab with generated in-memory keys and an empty child environment. With Orderly 0.2.9 and cryptography 48.0.1, the following credential-free probes passed:
- Orderly REST client import
- Orderly
generate_signature Ed25519 signing and verification
- cryptography Ed25519 signing and verification
- cryptography secp256k1 ECDSA signing and verification
- eth-account signing and recovery
- PyNaCl Ed25519 signing and verification
No provider request or real credential was used. pip check still fails solely because the published Orderly requirement caps cryptography below 43.
Would the maintainers please review support for cryptography>=48.0.1,<49.0.0, run the connector test suite, and publish a resolver-safe release if compatible? A Git tag matching the PyPI release would also make the source-to-artifact provenance easier to verify.
The latest PyPI release,
orderly-evm-connector==0.2.9, declarescryptography>=42.0.8,<43.0.0. Current cryptography security advisories require progressively newer patched versions, with the highest relevant patched floor at 48.0.1.I ran an isolated Python 3.12 compatibility lab with generated in-memory keys and an empty child environment. With Orderly 0.2.9 and cryptography 48.0.1, the following credential-free probes passed:
generate_signatureEd25519 signing and verificationNo provider request or real credential was used.
pip checkstill fails solely because the published Orderly requirement caps cryptography below 43.Would the maintainers please review support for
cryptography>=48.0.1,<49.0.0, run the connector test suite, and publish a resolver-safe release if compatible? A Git tag matching the PyPI release would also make the source-to-artifact provenance easier to verify.