presidio-anonymizer pins cryptography>=48.0.1,<49.0.0, which excludes
all cryptography versions >= 49.0.0. Two disclosed vulnerabilities in
cryptography are fixed only at or after that boundary:
Because the pin's upper bound is exclusive of 49.0.0, pip cannot resolve
presidio-anonymizer alongside a patched cryptography version at all —
consumers must choose between presidio-anonymizer and a fixed
cryptography, they can't have both.
presidio-anonymizer pins
cryptography>=48.0.1,<49.0.0, which excludesall cryptography versions >= 49.0.0. Two disclosed vulnerabilities in
cryptography are fixed only at or after that boundary:
exponential path-building on duplicate self-signed intermediates) —
fixed in cryptography 49.0.0 (Add a signature validation budget during path construction pyca/cryptography#14960)
EnvelopedData decryption) — fixed in cryptography 50.0.0
(Don't leak how PKCS#7 encryptedKey decryption failed pyca/cryptography#15369)
Because the pin's upper bound is exclusive of 49.0.0, pip cannot resolve
presidio-anonymizer alongside a patched cryptography version at all —
consumers must choose between presidio-anonymizer and a fixed
cryptography, they can't have both.