fix(google-auth): raise minimum pyopenssl version to 23.2.0

packages/google-auth/noxfile.py

@@ -174,12 +174,28 @@ def unit(session, install_deprecated_extras):
     constraints_path = str(
         CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
     )
-    extras_str = "testing"
     if install_deprecated_extras:
+        extras_str = "testing,pyopenssl,enterprise_cert,rsa"
         # rsa and oauth2client were both archived and support dropped,
-        # but we still  test old code paths
+        # but we still test old code paths
         session.install("oauth2client")
-        extras_str += ",rsa"
+
+        # Use the dedicated extras constraints file if it exists
+        extras_constraints = (
+            CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt"
+        )
+        if extras_constraints.exists():
+            constraints_path = str(extras_constraints)
+        else:
+            constraints_path = str(
+                CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+            )
+    else:
+        extras_str = "testing"
+        constraints_path = str(
+            CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+        )
+
     session.install("-e", f".[{extras_str}]", "-c", constraints_path)
     session.run(
         "pytest",

packages/google-auth/setup.py

@@ -19,31 +19,43 @@
 from setuptools import setup
 
 cryptography_base_require = [
-    "cryptography >= 38.0.3",
+    "cryptography >= 38.0.3; python_version < '3.14'",
+    "cryptography >= 41.0.5; python_version >= '3.14'",
 ]
 
 DEPENDENCIES = (
     "pyasn1-modules>=0.2.1",
     cryptography_base_require,
 )
 
-requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
+requests_extra_require = [
+    "requests >= 2.20.0, < 3.0.0; python_version < '3.11'",
+    "requests >= 2.30.0, < 3.0.0; python_version >= '3.11'",
+]
 
-aiohttp_extra_require = ["aiohttp >= 3.8.0, < 4.0.0", *requests_extra_require]
+aiohttp_extra_require = [
+    "aiohttp >= 3.8.0, < 4.0.0; python_version < '3.11'",
+    "aiohttp >= 3.9.0, < 4.0.0; python_version >= '3.11'",
+    *requests_extra_require,
+]
 
 pyjwt_extra_require = ["pyjwt>=2.0"]
 
 reauth_extra_require = ["pyu2f>=0.1.5"]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1738): Add bounds for pyopenssl dependency.
-enterprise_cert_extra_require = ["pyopenssl"]
+enterprise_cert_extra_require = [
+    "pyopenssl>=23.2.0",
+]
 
-pyopenssl_extra_require = ["pyopenssl>=20.0.0"]
+pyopenssl_extra_require = [
+    "pyopenssl>=23.2.0",
+]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require = ["urllib3", "packaging"]
 
-rsa_extra_require = ["rsa>=3.1.4,<5"]
+rsa_extra_require = ["rsa>=4.0,<5"]
 
 # Unit test requirements.
 testing_extra_require = [

packages/google-auth/testing/constraints-3.10.txt

@@ -1,10 +1,5 @@
-# This constraints file is used to check that lower bounds
-# are correct in setup.py
-# List *all* library dependencies and extras in this file.
-# Pin the version to the lower bound.
-#
-# e.g., if setup.py has "foo >= 1.14.0, < 2.0.0dev",
-# Then this file should have foo==1.14.0
+# Lower-bound constraints for Python 3.10 core dependencies.
+# Used during CI unit tests to verify minimum supported package versions.
 pyasn1-modules==0.2.1
 setuptools==40.3.0
 cryptography==38.0.3

packages/google-auth/testing/constraints-3.11.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.11 core dependencies.
+# Pins requests==2.30.0 and aiohttp==3.9.0 to maintain compatibility with urllib3 v2.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.12.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.12 core dependencies.
+# Pins requests==2.30.0 and aiohttp==3.9.0 to maintain compatibility with urllib3 v2.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.13.txt

@@ -0,0 +1,9 @@
+# Lower-bound constraints for Python 3.13 core dependencies.
+# Pins requests==2.30.0 and aiohttp==3.9.0 to maintain compatibility with urllib3 v2.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.14.txt

@@ -0,0 +1,9 @@
+# Lower-bound constraints for Python 3.14 core dependencies.
+# Pins cryptography==41.0.5 for CPython 3.14 C-extension compatibility, alongside requests==2.30.0 and aiohttp==3.9.0.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==41.0.5
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-extras-3.10.txt

@@ -0,0 +1,13 @@
+# Lower-bound constraints for Python 3.10 extended/optional extras (pyopenssl, rsa, enterprise_cert).
+# Used during boundary Nox unit sessions (install_deprecated_extras=True) to test legacy/extra paths on 3.10.
+# Note: cryptography==41.0.5 is required here because pyopenssl>=23.2.0 depends on cryptography>=41.0.5.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==41.0.5
+pyjwt==2.0
+pyopenssl==23.2.0
+pyu2f==0.1.5
+rsa==4.0
+aiohttp==3.8.0
+requests==2.30.0
+urllib3==1.26.15

packages/google-auth/testing/constraints-extras-3.14.txt

@@ -0,0 +1,12 @@
+# Lower-bound constraints for Python 3.14 extended/optional extras (pyopenssl, rsa, enterprise_cert).
+# Used during boundary Nox unit sessions (install_deprecated_extras=True) to test legacy/extra paths on 3.14.
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==41.0.5
+pyjwt==2.0
+pyopenssl==23.2.0
+pyu2f==0.1.5
+rsa==4.0
+aiohttp==3.9.0
+requests==2.30.0
+urllib3==2.0.0