alexluck-sift · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026
diff --git a/python/changelog.d/855.fix.1.md b/python/changelog.d/855.fix.1.md
@@ -0,0 +1 @@
+Removed the `pyOpenSSL` dependency. `cert_via_openssl` now converts certificates with the standard library `ssl` module, so the `openssl` extra is no longer needed and is removed. The extra capped `cryptography` below 42, which kept installs on a release with known vulnerabilities.
diff --git a/python/changelog.d/855.fix.md b/python/changelog.d/855.fix.md
@@ -0,0 +1 @@
+Raised the `filelock` upper bound to `<5`, so Python 3.11+ installs resolve `filelock` 4.2.1 or later, which fixes GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, and GHSA-567q-5qvw-pf92.
diff --git a/python/lib/sift_client/_internal/grpc_transport/transport.py b/python/lib/sift_client/_internal/grpc_transport/transport.py
@@ -6,6 +6,7 @@
 
 from __future__ import annotations
 
+import ssl
 from importlib.metadata import PackageNotFoundError, version
 from typing import TYPE_CHECKING, Any, TypedDict, cast
 
@@ -46,22 +47,11 @@ def get_ssl_credentials(cert_via_openssl: bool) -> grpc.ChannelCredentials:
     if not cert_via_openssl:
         return grpc.ssl_channel_credentials()
 
-    try:
-        import ssl
-
-        from OpenSSL import crypto
-
-        ssl_context = ssl.create_default_context()
-        certs_der = ssl_context.get_ca_certs(binary_form=True)
-        certs_x509 = [crypto.load_certificate(crypto.FILETYPE_ASN1, x) for x in certs_der]
-        certs_pem = [crypto.dump_certificate(crypto.FILETYPE_PEM, x) for x in certs_x509]
-        certs_bytes = b"".join(certs_pem)
+    ssl_context = ssl.create_default_context()
+    certs_der = ssl_context.get_ca_certs(binary_form=True)
+    certs_pem = "".join(ssl.DER_cert_to_PEM_cert(x) for x in certs_der)
 
-        return grpc.ssl_channel_credentials(certs_bytes)
-    except ImportError as e:
-        raise Exception(
-            "Missing required dependencies for cert_via_openssl. Run `pip install sift-stack-py[openssl]` to install the required dependencies."
-        ) from e
+    return grpc.ssl_channel_credentials(certs_pem.encode())
 
 
 def use_sift_channel(
@@ -245,7 +235,6 @@ class SiftChannelConfig(TypedDict):
     being terminated during idle periods. A custom `sift_py.grpc.keepalive.KeepaliveConfig` may also be provided.
     - `use_ssl`: INTERNAL USE. Meant to be used for local development.
     - `cert_via_openssl`: Enable this if you want to use OpenSSL to load the certificates.
-    Run `pip install sift-stack-py[openssl]` to install the dependencies required to use this option.
     This works around this issue with grpc loading SSL certificates: https://github.com/grpc/grpc/issues/29682.
     Default is False.
     - `request_timeout`: Default deadline in seconds applied to unary RPCs that don't set their own.

diff --git a/python/lib/sift_client/_internal/rest.py b/python/lib/sift_client/_internal/rest.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import ssl
 from abc import ABC
 from typing import TypedDict
 
@@ -21,7 +22,6 @@ class SiftRestConfig(TypedDict):
     - `retry`: Urllib3 Retry configuration. If not provided, a default of 3 retries is used.
     - `use_ssl`: INTERNAL USE. Meant to be used for local development.
     - `cert_via_openssl`: Enable this if you want to use OpenSSL to load the certificates.
-    Run `pip install sift-stack-py[openssl]` to install the dependencies required to use this option.
     Default is False.
     """
 
@@ -53,16 +53,9 @@ def __init__(self, rest_conf: SiftRestConfig, *args, **kwargs):
 
     def init_poolmanager(self, *args, **kwargs):
         if self._rest_conf.get("cert_via_openssl", False):
-            try:
-                import ssl
-
-                context = ssl.create_default_context()
-                context.load_default_certs()
-                kwargs["ssl_context"] = context
-            except ImportError as e:
-                raise Exception(
-                    "Missing required dependencies for cert_via_openssl. Run `pip install sift-stack-py[openssl]` to install the required dependencies."
-                ) from e
+            context = ssl.create_default_context()
+            context.load_default_certs()
+            kwargs["ssl_context"] = context
         return super().init_poolmanager(*args, **kwargs)
 
 

diff --git a/python/lib/sift_py/grpc/transport.py b/python/lib/sift_py/grpc/transport.py
@@ -6,6 +6,7 @@
 
 from __future__ import annotations
 
+import ssl
 from importlib.metadata import PackageNotFoundError, version
 from typing import Any, Dict, List, Optional, Tuple, TypedDict, Union, cast
 from urllib.parse import ParseResult, urlparse
@@ -33,22 +34,11 @@ def get_ssl_credentials(cert_via_openssl: bool) -> grpc.ChannelCredentials:
     if not cert_via_openssl:
         return grpc.ssl_channel_credentials()
 
-    try:
-        import ssl
-
-        from OpenSSL import crypto
-
-        ssl_context = ssl.create_default_context()
-        certs_der = ssl_context.get_ca_certs(binary_form=True)
-        certs_x509 = [crypto.load_certificate(crypto.FILETYPE_ASN1, x) for x in certs_der]
-        certs_pem = [crypto.dump_certificate(crypto.FILETYPE_PEM, x) for x in certs_x509]
-        certs_bytes = b"".join(certs_pem)
+    ssl_context = ssl.create_default_context()
+    certs_der = ssl_context.get_ca_certs(binary_form=True)
+    certs_pem = "".join(ssl.DER_cert_to_PEM_cert(x) for x in certs_der)
 
-        return grpc.ssl_channel_credentials(certs_bytes)
-    except ImportError as e:
-        raise Exception(
-            "Missing required dependencies for cert_via_openssl. Run `pip install sift-stack-py[openssl]` to install the required dependencies."
-        ) from e
+    return grpc.ssl_channel_credentials(certs_pem.encode())
 
 
 def use_sift_channel(
@@ -238,7 +228,6 @@ class SiftChannelConfig(TypedDict):
     being terminated during idle periods. A custom `sift_py.grpc.keepalive.KeepaliveConfig` may also be provided.
     - `use_ssl`: INTERNAL USE. Meant to be used for local development.
     - `cert_via_openssl`: Enable this if you want to use OpenSSL to load the certificates.
-    Run `pip install sift-stack-py[openssl]` to install the dependencies required to use this option.
     This works around this issue with grpc loading SSL certificates: https://github.com/grpc/grpc/issues/29682.
     Default is False.
     """

diff --git a/python/lib/sift_py/rest.py b/python/lib/sift_py/rest.py
@@ -1,3 +1,4 @@
+import ssl
 from abc import ABC
 from typing import TypedDict
 
@@ -19,7 +20,6 @@ class SiftRestConfig(TypedDict):
     - `retry`: Urllib3 Retry configuration. If not provided, a default of 3 retries is used.
     - `use_ssl`: INTERNAL USE. Meant to be used for local development.
     - `cert_via_openssl`: Enable this if you want to use OpenSSL to load the certificates.
-    Run `pip install sift-stack-py[openssl]` to install the dependencies required to use this option.
     Default is False.
     """
 
@@ -51,16 +51,9 @@ def __init__(self, rest_conf: SiftRestConfig, *args, **kwargs):
 
     def init_poolmanager(self, *args, **kwargs):
         if self._rest_conf.get("cert_via_openssl", False):
-            try:
-                import ssl
-
-                context = ssl.create_default_context()
-                context.load_default_certs()
-                kwargs["ssl_context"] = context
-            except ImportError as e:
-                raise Exception(
-                    "Missing required dependencies for cert_via_openssl. Run `pip install sift-stack-py[openssl]` to install the required dependencies."
-                ) from e
+            context = ssl.create_default_context()
+            context.load_default_certs()
+            kwargs["ssl_context"] = context
         return super().init_poolmanager(*args, **kwargs)
 
 

diff --git a/python/pyproject.toml b/python/pyproject.toml
@@ -45,7 +45,7 @@ dependencies = [
     "types-requests~=2.25",
     "googleapis-common-protos>=1.60",
     "protoc-gen-openapiv2>=0.0.1",
-    "filelock~=3.15",
+    "filelock>=3.15,<5",
     'tomli~=2.0; python_version < "3.11"',
 ]
 
@@ -61,18 +61,15 @@ import-test-result-log = "sift_client.scripts.import_test_result_log:main"
 [project.optional-dependencies]
 # AUTO GENERATED EXTRAS — EDIT [tool.sift.extras] ONLY
 all = [
-    'cffi~=1.14',
     'h5py~=3.11',
     'mcap-ros2-support~=0.5.7',
     'mcap~=1.4',
     'npTDMS~=1.9',
     'polars~=1.8',
-    'pyOpenSSL<24.0.0',
     'pyarrow>=17.0.0',
     'pyulog~=1.2.2',
     "rosbags~=0.0 ; python_full_version >= '3.8.2'",
     'sift-stream-bindings==0.6.1',
-    'types-pyOpenSSL<24.0.0',
 ]
 build = [
     'build==1.2.1',
@@ -97,7 +94,6 @@ dev = [
 ]
 dev-all = [
     'build==1.2.1',
-    'cffi~=1.14',
     'grpcio-testing~=1.13',
     'h5py~=3.11',
     'mcap-ros2-support~=0.5.7',
@@ -107,7 +103,6 @@ dev-all = [
     'pdoc==14.5.0',
     'polars~=1.8',
     "pre-commit~=4.0 ; python_version >= '3.9'",
-    'pyOpenSSL<24.0.0',
     'pyarrow>=17.0.0',
     'pyright==1.1.386',
     'pytest-asyncio==0.23.7',
@@ -121,7 +116,6 @@ dev-all = [
     'ruff~=0.12.10',
     'sift-stream-bindings==0.6.1',
     'tomlkit~=0.13.3',
-    'types-pyOpenSSL<24.0.0',
 ]
 development = [
     'grpcio-testing~=1.13',
@@ -149,7 +143,6 @@ docs = [
 ]
 docs-build = [
     'build==1.2.1',
-    'cffi~=1.14',
     "griffe-pydantic==1.3.1 ; python_version >= '3.10'",
     'grpcio-testing~=1.13',
     'h5py~=3.11',
@@ -167,7 +160,6 @@ docs-build = [
     'pdoc==14.5.0',
     'polars~=1.8',
     "pre-commit~=4.0 ; python_version >= '3.9'",
-    'pyOpenSSL<24.0.0',
     'pyarrow>=17.0.0',
     'pyright==1.1.386',
     'pytest-asyncio==0.23.7',
@@ -181,7 +173,6 @@ docs-build = [
     'ruff~=0.12.10',
     'sift-stream-bindings==0.6.1',
     'tomlkit~=0.13.3',
-    'types-pyOpenSSL<24.0.0',
 ]
 file-imports = [
     'h5py~=3.11',
@@ -201,11 +192,6 @@ mcap = [
     'mcap-ros2-support~=0.5.7',
     'mcap~=1.4',
 ]
-openssl = [
-    'cffi~=1.14',
-    'pyOpenSSL<24.0.0',
-    'types-pyOpenSSL<24.0.0',
-]
 parquet = [
     'pyarrow>=17.0.0',
 ]
@@ -261,7 +247,6 @@ docs = [
 ]
 
 # May be required for certain library functionality
-openssl = ["pyOpenSSL<24.0.0", "types-pyOpenSSL<24.0.0", "cffi~=1.14"]
 tdms = ["npTDMS~=1.9"]
 rosbags = ["rosbags~=0.0 ; python_full_version >= '3.8.2'"]
 sift-stream = ["sift-stream-bindings==0.6.1"]
@@ -280,7 +265,7 @@ data-review = ["parquet"]
 
 # combinations
 file-imports = ["tdms", "rosbags", "hdf5", "ulog", "mcap", "parquet"]
-all = ["openssl", "sift-stream", "file-imports", "data-review"]
+all = ["sift-stream", "file-imports", "data-review"]
 
 dev-all = ["development", "all", "build"]
 docs-build = ["dev-all", "docs"] # Note python 3.9+
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Removed the `pyOpenSSL` dependency. `cert_via_openssl` now converts certificates with the standard library `ssl` module, so the `openssl` extra is no longer needed and is removed. The extra capped `cryptography` below 42, which kept installs on a release with known vulnerabilities.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Raised the `filelock` upper bound to `<5`, so Python 3.11+ installs resolve `filelock` 4.2.1 or later, which fixes GHSA-v4x8-3wr5-3wq8, GHSA-9vhv-jxww-xfm5, and GHSA-567q-5qvw-pf92.