From 3322c76edf67424ec10585f756cdcd21647d0c22 Mon Sep 17 00:00:00 2001
From: "sahil.wikhe" <sahil.wikhe@cyberark.com>
Date: Wed, 3 Jun 2026 17:14:45 -0700
Subject: [PATCH] fix(deps): relax install_requires pins to compatible ranges

Addresses VC-53626 (SC-006 / CWE-1395): hard-pinned (==) install_requires
prevents downstream consumers from upgrading transitive deps. Replace ==
with >=current,<next-major ranges for all 6 install_requires entries.
requirements.txt retains exact pins for development reproducibility.
---
 setup.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/setup.py b/setup.py
index 2e85671..fe27ad4 100644
--- a/setup.py
+++ b/setup.py
@@ -14,8 +14,8 @@
       version='0.18.1',
       url="https://github.com/Venafi/vcert-python",
       packages=['vcert', 'vcert.parser', 'vcert.policy'],
-      install_requires=['requests==2.32.4', 'python-dateutil==2.8.2', 'six==1.17.0',
-                        'cryptography==45.0.7', 'ruamel.yaml==0.18.13', 'pynacl==1.5.0'],
+      install_requires=['requests>=2.32.4,<3', 'python-dateutil>=2.8.2,<3', 'six>=1.17.0,<2',
+                        'cryptography>=45.0.7,<46', 'ruamel.yaml>=0.18.13,<0.19', 'pynacl>=1.5.0,<2'],
       description='Python client library for CyberArk Certificate Manager, Self-Hosted and CyberArk Certificate Manager, SaaS.',
       long_description=long_description,
       long_description_content_type="text/markdown",