We use Nautobot at work as our source of truth. While I was working at Network To Code, the company behind it, I briefly proposed whether we shouldn’t do away with poetry’s default upper version bounding. I did not come to this opinion myself, but rather read a brilliant blog post by Henry Schreiner at the time. This convinced me that upper version bounds in Python dependencies were in fact a bad idea, because they constantly cause dependency issues. This is most evident in libraries that frequently bump their major version, such as cryptography, which does so about once per month. So, unless you want to have security issues, you wind up having to bump your cryptography version very often if you use poetry’s ^7, which is equivalent to pip’s >=7,<8.

Now, to my concrete issue. Because of breaking changes we aren’t yet able to jump to Nautobot 3.2, and are stuck on the unmaintained version 3.1. Concretely, this also means being stuck with this constraint for cryptography: >=48.0.1,<49. And with that constraints comes being one patch before this thing:

SECURITY ISSUE: :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to @X1AOxiang for reporting the issue. CVE-2026-69247

Now while I am decently sure that this CVE does not apply to our Nautobot deployment, I also didn’t feel like finding out. At this point I thought that I either had to fork Nautobot or deal with it, but we had also recently migrated off of poetry onto uv. And as it turns out, uv solves exactly this problem by means of allowing dependency overrides, essentially allowing you to say: I know better.

So for all of you folks regularly fighting Python dependency resolution because a package you use is putting upper version bounds where you suspect no breaking changes actually happened, I have two suggestions:

  • Migrate to uv and love this feature
  • Send this blog post to the library maintainers, and read it yourself

Seriously, its a good read, and the author cites the following barrage of expertise in hist post:

Thanks to Python steering council member Brett Cannon, Python core developer Paul Ganssle, fellow PyPA members Bernát Gábor, Pradyun Gedam and @layday, fellow RSE Troy Comi, and fellow IRIS-HEP member Alex Held for their comments on early drafts.