Security: outdated minimum versions for PyOpenSSL and pyasn1 allow vulnerable installations #27
Description
Summary
The current install_requires in setup.py allows installation of vulnerable versions of two dependencies:
| CVE | Library | Current constraint | Fixed version |
|---|---|---|---|
| CVE-2026-30922 | pyasn1 | >=0.1.1 | >=0.6.3 |
| CVE-2026-27459 | PyOpenSSL | (no minimum) | >=26.0.0 |
Any project depending on ndg_httpsclient can end up with insecure transitive dependencies since the version floors are too low.
Proposed fix
A fix has been submitted in #26 — bumping the minimum versions in install_requires.
@philipkershaw could you please take a look? Thanks!