chore: widen cryptography constraint and bump CDK to 7.21.1 by aaronsteers · Pull Request #1044 · airbytehq/PyAirbyte

Aaron ("AJ") Steers (aaronsteers) · 2026-06-06T03:08:42Z

Summary

Widens cryptography from >=44.0.0,<45.0.0 to >=44.0.0,<47.0.0,!=45.0.0,!=45.0.1 — the negation constraints exclude 45.0.0/45.0.1 which had load_pem_private_key() regressions (fixed in 45.0.2+). PyAirbyte imports cryptography directly in airbyte/_processors/sql/snowflake.py for key-pair auth, so we keep the explicit dependency.

Bumps airbyte-cdk lower bound from >=7.3.9 to >=7.21.1 — CDK 7.21.1 includes the same widened cryptography constraint, so the two packages no longer conflict on resolution.

Restores workflow_dispatch trigger to pypi_publish.yml (removed by #944), which broke the /prerelease slash command. Adds security hardening (persist-credentials: false, conditional cache disable) and uses SHA-pinned action references.

Unblocks boring-semantic-layer>=0.3.0 in downstream projects (specifically airbytehq/airbyte-transforms-poc) which transitively requires cryptography>=45.0.3.

Link to Devin session: https://app.devin.ai/sessions/9f900ef4021147adb369727617d08827
Requested by: Aaron ("AJ") Steers (@aaronsteers)

devin-ai-integration · 2026-06-06T03:08:44Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

github-actions · 2026-06-06T03:09:00Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This PyAirbyte Version

You can test this version of PyAirbyte using the following:

# Run PyAirbyte CLI from this branch:
uvx --from 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1780715268-remove-cryptography-upper-bound' pyairbyte --help

# Install PyAirbyte from this branch for development:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1780715268-remove-cryptography-upper-bound'

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

/fix-pr - Fixes most formatting and linting issues
/uv-lock - Updates uv.lock file
/test-pr - Runs tests with the updated PyAirbyte
/prerelease - Builds and publishes a prerelease version to PyPI

📚 Show Repo Guidance

Helpful Resources

Community Support

Questions? Join the #pyairbyte channel in our Slack workspace.

📝 Edit this welcome message.

coderabbitai · 2026-06-06T03:10:08Z

Too much diff to scan? Review this PR in Change Stack to start with the highest-impact changes.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The PR widens the cryptography dependency range with explicit exclusions, and extends the PyPI publish workflow with manual dispatch inputs plus split release-versus-dispatch execution steps, including conditional publish behavior.

Changes

Dependency Relaxation

Layer / File(s)	Summary
Cryptography dependency constraint relaxation `pyproject.toml`	Updated `cryptography` from `>=44.0.0,<45.0.0` to `>=44.0.0,<47.0.0,!=45.0.0,!=45.0.1`.

PyPI Publish Workflow

Layer / File(s)	Summary
Workflow dispatch trigger and header `.github/workflows/pypi_publish.yml`	Inserted a dispatch comment and added `workflow_dispatch` inputs: `git_ref`, `version_override`, and `publish` (default `true`).
Publish job rework (checkout, build, conditional publish) `.github/workflows/pypi_publish.yml`	Reorganized `publish_to_pypi` job so release events download assets, dispatch events checkout the requested ref, install `uv`, build with `UV_DYNAMIC_VERSIONING_BYPASS` from `version_override`, and publish runs on release or when `inputs.publish == 'true'`.

Sequence Diagram(s)

sequenceDiagram
  participant Trigger as GitHubEvent
  participant Actions as GitHubActions
  participant Runner as JobRunner
  participant PyPI as PyPI
  Trigger->>Actions: start from release or workflow_dispatch
  Actions->>Runner: on dispatch checkout selected git_ref
  Runner->>Runner: install uv and build with UV_DYNAMIC_VERSIONING_BYPASS
  Runner->>PyPI: publish when release event or inputs.publish == 'true'

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Would you like me to suggest a brief PR checklist for testing dispatch runs locally or in a staging repo before merging? wdyt?

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title mentions widening the cryptography constraint, which matches a key change in pyproject.toml, but omits the significant workflow_dispatch enhancement to the CI/CD pipeline added in .github/workflows/pypi_publish.yml.	Consider updating the title to reflect both major changes, such as: 'chore: widen cryptography constraint and enhance PyPI publish workflow' to accurately represent the full scope of changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch devin/1780715268-remove-cryptography-upper-bound

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-code-quality · 2026-06-06T03:15:59Z

Code Coverage Overview

Languages: Python

Python / code-coverage/pytest-fast

The overall coverage in the devin/1780715268-rem... branch is 67%. The coverage in the main branch is 65%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1780715268-rem... `1f10c9e`	+/-
`airbyte/_util/api_util.py`	36%	37%	+1%
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/cloud/models.py`	0%	91%	+91%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

Python / code-coverage/pytest-no-creds

The overall coverage in the devin/1780715268-rem... branch is 67%. The coverage in the main branch is 65%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1780715268-rem... `1f10c9e`	+/-
`airbyte/_util/api_util.py`	36%	37%	+1%
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/cloud/models.py`	0%	91%	+91%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

Python / code-coverage/pytest

The overall coverage in the devin/1780715268-rem... branch is 72%. The coverage in the main branch is 71%.

Show a code coverage summary of the most impacted files.

File	main `d9f652f`	devin/1780715268-rem... `1f10c9e`	+/-
`airbyte/_util/api_util.py`	72%	72%	0%
`airbyte/registry.py`	70%	72%	+2%
`airbyte/mcp/_tool_utils.py`	72%	77%	+5%
`airbyte/mcp/int...c_history_ui.py`	0%	36%	+36%
`airbyte/mcp/int...hared_models.py`	0%	81%	+81%
`airbyte/mcp/int..._registry_ui.py`	0%	92%	+92%
`airbyte/cloud/models.py`	0%	93%	+93%
`airbyte/mcp/int...nc_status_ui.py`	0%	97%	+97%
`airbyte/mcp/int...ive/__init__.py`	0%	100%	+100%
`airbyte/mcp/int...tive/_prefab.py`	0%	100%	+100%

_{Updated June 07, 2026 05:01 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-06-06T03:39:01Z

Prerelease Build Started

Building and publishing prerelease package from this PR...
Check job output.
Prerelease Build/Publish Failed

The prerelease encountered an error.
Check publish workflow output for details.

You can still install directly from this PR branch:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1780715268-remove-cryptography-upper-bound'

github-actions · 2026-06-06T04:16:32Z

Prerelease Build Started

Building and publishing prerelease package from this PR...
Check job output.
Prerelease Build/Publish Failed

The prerelease encountered an error.
Check publish workflow output for details.

You can still install directly from this PR branch:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1780715268-remove-cryptography-upper-bound'

github-actions · 2026-06-06T04:32:07Z

Prerelease Build Started

Building and publishing prerelease package from this PR...
Check job output.
Prerelease Build/Publish Failed

The prerelease encountered an error.
Check publish workflow output for details.

You can still install directly from this PR branch:
pip install 'git+https://github.com/airbytehq/PyAirbyte.git@devin/1780715268-remove-cryptography-upper-bound'

github-actions · 2026-06-06T05:28:47Z

Prerelease Build Started

Building and publishing prerelease package from this PR...
Check job output.
Prerelease Published to PyPI

Version: 0.47.0.dev104427053790217
View publish workflow

Install with:
pip install airbyte==0.47.0.dev104427053790217

Co-Authored-By: AJ Steers <aj@airbyte.io>

…aint Co-Authored-By: AJ Steers <aj@airbyte.io>

Co-Authored-By: AJ Steers <aj@airbyte.io>

Aaron ("AJ") Steers (aaronsteers) · 2026-06-06T05:40:31Z

/prerelease

Prerelease Build Started

Building and publishing prerelease package from this PR...
Check job output.
Prerelease Published to PyPI

Version: 0.47.0.dev104427054033685
View publish workflow

Install with:
pip install airbyte==0.47.0.dev104427054033685

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

Copilot

Pull request overview

This PR updates PyAirbyte’s Python dependency constraints to allow newer cryptography releases and updates the minimum required airbyte-cdk version, with the lockfile regenerated accordingly.

Changes:

Relax cryptography constraint from <45.0.0 to a wider range (<47.0.0) while excluding 45.0.0 and 45.0.1.
Raise the minimum airbyte-cdk dependency to 7.21.0.post4.dev27052511259.
Update uv.lock to reflect the new dependency constraints and resolved versions.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 5 comments.

File	Description
pyproject.toml	Updates runtime dependency constraints for `cryptography` and `airbyte-cdk`.
uv.lock	Regenerated lockfile reflecting the updated constraints and resolved `airbyte-cdk` version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration Bot assigned Aaron ("AJ") Steers (aaronsteers) Jun 6, 2026

coderabbitai Bot approved these changes Jun 6, 2026

View reviewed changes

devin-ai-integration Bot changed the title ~~chore: remove stale cryptography<45 upper bound~~ chore: widen cryptography constraint and pin CDK prerelease Jun 6, 2026

This comment was marked as resolved.

Sign in to view

airbyte-support-bot had a problem deploying to PyPi June 6, 2026 04:23 — with GitHub Actions Failure

This comment was marked as resolved.

Sign in to view

coderabbitai Bot approved these changes Jun 6, 2026

View reviewed changes

devin-ai-integration Bot and others added 4 commits June 6, 2026 05:34

chore: remove stale cryptography<45 upper bound

ae73d7b

Co-Authored-By: AJ Steers <aj@airbyte.io>

chore: exclude buggy cryptography 45.0.0 and 45.0.1 via negation

887c89b

Co-Authored-By: AJ Steers <aj@airbyte.io>

chore: pin airbyte-cdk to prerelease with widened cryptography constr…

516874f

…aint Co-Authored-By: AJ Steers <aj@airbyte.io>

chore: pin to latest CDK prerelease 7.21.0.post4.dev27052511259

933daf6

Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration Bot force-pushed the devin/1780715268-remove-cryptography-upper-bound branch from 38ebf95 to 933daf6 Compare June 6, 2026 05:35

Aaron ("AJ") Steers (aaronsteers) marked this pull request as ready for review June 6, 2026 05:43

Copilot AI review requested due to automatic review settings June 6, 2026 05:43

Copilot started reviewing on behalf of Aaron ("AJ") Steers (aaronsteers) June 6, 2026 05:44 View session

devin-ai-integration Bot reviewed Jun 6, 2026

View reviewed changes

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Comment thread pyproject.toml Outdated

Comment thread pyproject.toml Outdated

Comment thread pyproject.toml Outdated

Comment thread pyproject.toml Outdated

Comment thread pyproject.toml Outdated

docs: add inline comment explaining cryptography version exclusions

c71cf7a

Co-Authored-By: AJ Steers <aj@airbyte.io>

Aaron ("AJ") Steers (aaronsteers) commented Jun 7, 2026

View reviewed changes

Comment thread pyproject.toml Outdated

Aaron ("AJ") Steers (aaronsteers) commented Jun 7, 2026

View reviewed changes

Comment thread pyproject.toml

chore: update airbyte-cdk pin from prerelease to stable 7.21.1

1f10c9e

Co-Authored-By: AJ Steers <aj@airbyte.io>

devin-ai-integration Bot changed the title ~~chore: widen cryptography constraint and pin CDK prerelease~~ chore: widen cryptography constraint and bump CDK to 7.21.1 Jun 7, 2026

Aaron ("AJ") Steers (aaronsteers) merged commit c5d5a58 into main Jun 7, 2026
22 checks passed

Aaron ("AJ") Steers (aaronsteers) deleted the devin/1780715268-remove-cryptography-upper-bound branch June 7, 2026 05:20

Conversation

Aaron ("AJ") Steers (aaronsteers) commented Jun 6, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

devin-ai-integration Bot commented Jun 6, 2026

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Jun 6, 2026

👋 Greetings, Airbyte Team Member!

Testing This PyAirbyte Version

PR Slash Commands

Helpful Resources

Community Support

Uh oh!

coderabbitai Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

Python / code-coverage/pytest-fast

Python / code-coverage/pytest-no-creds

Python / code-coverage/pytest

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Aaron ("AJ") Steers (aaronsteers) commented Jun 6, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Aaron ("AJ") Steers (aaronsteers) commented Jun 6, 2026 •

edited by devin-ai-integration Bot

Loading

coderabbitai Bot commented Jun 6, 2026 •

edited

Loading

github-code-quality Bot commented Jun 6, 2026 •

edited

Loading

github-actions Bot commented Jun 6, 2026 •

edited

Loading

github-actions Bot commented Jun 6, 2026 •

edited

Loading

github-actions Bot commented Jun 6, 2026 •

edited

Loading

github-actions Bot commented Jun 6, 2026 •

edited

Loading

Aaron ("AJ") Steers (aaronsteers) commented Jun 6, 2026 •

edited by github-actions Bot

Loading