google-auth: cryptography lower bounds fail on Python 3.14 and allow vulnerable releases

[j-flat]

Determine this is the right repository

• I determined this is the correct repository in which to report this bug.

Summary of the issue

Context
Running google-auth unit tests with nox -s unit (or installing with the Python 3.14 constraints file) and reviewing the declared cryptography lower bounds.

Expected Behavior:

• nox -s unit-3.14 should install dependencies and run tests.
• Declared cryptography lower bounds should be installable on each supported Python version and should not include releases with known high-severity CVEs.

Actual Behavior:

• On Python 3.14, pip fails with ResolutionImpossible. setup.py requires cryptography >= 41.0.5 and testing/constraints-3.14.txt pins cryptography==41.0.5, but 41.0.5 has no Python 3.14 wheels.
• On Python 3.10–3.13, the lower bound is cryptography >= 38.0.3, which still allows 41.0.5 and other releases affected by CVE-2023-49083 and CVE-2026-26007 (fixed in 41.0.6 and 46.0.5).

API client name and version

google-auth v2.57.0

Reproduction steps: code

Run unit-tests for google-auth in packages/google-auth:

cd packages/google-auth
nox -s unit-3.14

Reproduction steps: supporting files

N/A — reproduced from current main using packages/google-auth/setup.py and packages/google-auth/testing/constraints-3.14.txt.

Reproduction steps: actual results

ERROR: Cannot install None because these package versions have conflicting dependencies.

The conflict is caused by:
    google-auth 2.57.0 depends on cryptography>=41.0.5; python_version >= "3.14"
    The user requested (constraint) cryptography==41.0.5

Additionally, some packages in these conflicts have no matching distributions available for your environment:
    cryptography

Reproduction steps: expected results

nox -s unit-3.14 creates the venv, installs google-auth with a cryptography version that has Python 3.14 wheels, and runs the unit tests.

OS & version + platform

No response

Python environment

No response

Python dependencies

N/A — install fails before tests run. Relevant pins from this repo:

setup.py:
cryptography >= 38.0.3; python_version < '3.14'
cryptography >= 41.0.5; python_version >= '3.14'

testing/constraints-3.10.txt: cryptography==38.0.3
testing/constraints-3.14.txt: cryptography==41.0.5

Additional context

Proposed fix:

• Python 3.10–3.13: require cryptography >= 46.0.5 (CVE-2026-26007).
• Python 3.14+: require cryptography >= 50.0.1 (first release with 3.14 wheels).
• Update testing/constraints-3.10.txt and testing/constraints-3.14.txt to those lower bounds.

I will send a PR for this.