Summary

• Replaced hard-pinned == version constraints in setup.py's install_requires with compatible-range constraints (>=min,<next-major).
• This resolves SC-006/CWE-1395: downstream consumers can now upgrade transitive deps without conflicting with vcert-python's pinned versions.
• requirements.txt (dev/test pins) left unchanged — exact pins in dev requirements files are acceptable practice.

Findings addressed

Before:

install_requires=['requests==2.32.4', 'python-dateutil==2.8.2', 'six==1.17.0',
                  'cryptography==45.0.7', 'ruamel.yaml==0.18.13', 'pynacl==1.5.0'],

After:

install_requires=['requests>=2.32.4,<3', 'python-dateutil>=2.8.2,<3', 'six>=1.17.0,<2',
                  'cryptography>=45.0.7,<47', 'ruamel.yaml>=0.18.13,<0.19', 'pynacl>=1.5.0,<2'],

Skipped findings

None.

Local verification

• python -c "import ast; ast.parse(open('setup.py').read())" → syntax OK
• Unit tests show pre-existing failures due to six not installed in the test runner environment (unrelated to this change).