cryptography breaking changes

50.0.0

22 breaking changes, first published July 31, 2026.

• Removed cryptography.hazmat.backends.openssl.backend.Backend.pbkdf2_hmac_supported
  Backend.pbkdf2_hmac_supported was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.hazmat.backends.openssl.backend.Backend.pkcs7_supported
  Backend.pkcs7_supported was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.hazmat.primitives.keywrap.AES
  cryptography.hazmat.primitives.keywrap.AES was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.hazmat.primitives.keywrap.bytes_eq
  cryptography.hazmat.primitives.keywrap.bytes_eq was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.hazmat.primitives.keywrap.Cipher
  cryptography.hazmat.primitives.keywrap.Cipher was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.hazmat.primitives.keywrap.ECB
  cryptography.hazmat.primitives.keywrap.ECB was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.utils.cached_property
  cryptography.utils.cached_property was removed in cryptography 50.0.0 pypi.org
• Removed cryptography.x509.extensions.serialization
  cryptography.x509.extensions.serialization was removed in cryptography 50.0.0 pypi.org
• Behavior changed
  A CRL entry InvalidityDate extension with fractional seconds or other non-DER GeneralizedTime forms is now rejected. github.com
• Behavior changed
  DER with a non-zero unused-bits count in the subjectPublicKey or EC publicKey BIT STRING is now rejected instead of silently accepted. github.com

And 12 more in this version.

49.0.0

13 breaking changes, first published June 12, 2026.

• Removed
  Intel Macs no longer get published wheels, so x86_64 macOS users must find another way to install. github.com
• Removed
  Users on 32-bit Windows should move to a 64-bit Python installation. github.com
• Removed cryptography.hazmat.primitives.asymmetric.types.CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES
  This deprecated type alias is gone; use CertificateIssuerPublicKeyTypes instead. pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.types.CERTIFICATE_PRIVATE_KEY_TYPES
  This deprecated type alias is gone; use CertificateIssuerPrivateKeyTypes instead. pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.types.CERTIFICATE_PUBLIC_KEY_TYPES
  This deprecated type alias is gone; use CertificatePublicKeyTypes instead. pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.types.PRIVATE_KEY_TYPES
  This deprecated type alias is gone; use PrivateKeyTypes instead. pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.types.PUBLIC_KEY_TYPES
  This deprecated type alias is gone; use PublicKeyTypes instead. pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.types.utils
  cryptography.hazmat.primitives.asymmetric.types.utils was removed in cryptography 49.0.0 pypi.org
• Behavior changed
  Loading such X.509 certificates now raises ValueError instead of loading with a deprecation warning. github.com
• Behavior changed cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20
  The first 4 bytes of the nonce are a little-endian block counter, and encrypting past its limit now raises ValueError instead of silently continuing. github.com

And 3 more in this version.

48.0.0

6 breaking changes, first published May 4, 2026.

• Removed
  cryptography now requires Python 3.9 or later. Users on Python 3.8 must upgrade their Python version before installing this release. github.com
• Removed cryptography.hazmat.asn1.asn1.Annotated
  cryptography.hazmat.asn1.asn1.Annotated was removed in cryptography 48.0.0 pypi.org
• Removed cryptography.hazmat.asn1.asn1.get_type_args
  cryptography.hazmat.asn1.asn1.get_type_args was removed in cryptography 48.0.0 pypi.org
• Removed cryptography.hazmat.asn1.asn1.get_type_hints
  cryptography.hazmat.asn1.asn1.get_type_hints was removed in cryptography 48.0.0 pypi.org
• Removed cryptography.hazmat.asn1.asn1.get_type_origin
  cryptography.hazmat.asn1.asn1.get_type_origin was removed in cryptography 48.0.0 pypi.org
• Behavior changed
  CRLs whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm are now rejected at load time with ValueError instead of loading and failing later during signature validation. Code that loads such CRLs must... github.com

47.0.0

148 breaking changes, first published April 24, 2026.

• Removed
  OpenSSL 1.1.x is no longer supported; OpenSSL 3.0.0 or later is required. github.com
• Removed
  LibreSSL versions older than 4.1 are no longer supported. github.com
• Removed cryptography.hazmat.bindings.openssl.binding.CryptographyDeprecationWarning
  cryptography.hazmat.bindings.openssl.binding.CryptographyDeprecationWarning was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT163K1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT163K1 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT163R2
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT163R2 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT233K1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT233K1 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT233R1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT233R1 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT283K1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT283K1 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT283R1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT283R1 was removed in cryptography 47.0.0 pypi.org
• Removed cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT409K1
  cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveOID.SECT409K1 was removed in cryptography 47.0.0 pypi.org

And 138 more in this version.

46.0.6

1 breaking change, first published March 25, 2026.

• Behavior changed
  Verification now enforces name constraints on peer names when the leaf certificate has a wildcard DNS SAN, so certificates that previously passed may now be rejected. Review certificate validation code that depends on the old behavior. github.com

46.0.4

1 breaking change, first published January 28, 2026.

• Removed
  Prebuilt win_arm64 wheels are no longer published, so installs on Windows ARM64 will need another route, such as building from source. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.