From 5b8dd7402f2cf0c35f0782baa84a181cfb09d7d2 Mon Sep 17 00:00:00 2001 From: Okke Formsma Date: Tue, 7 Jul 2026 12:56:19 +0200 Subject: [PATCH] Use cryptography's non-deprecated CFB location when available CFB moved from cryptography.hazmat.primitives.ciphers.modes to cryptography.hazmat.decrepit.ciphers.modes in cryptography 47, which is also exactly when the old location started emitting CryptographyDeprecationWarning on attribute access. Prefer the new location when it exists, falling back to the old one on cryptography < 47 where decrepit does not exist yet. This removes the warning both at import time and when AESCipher is actually used with cfb mode, for every supported cryptography version. Fixes #1033 --- src/saml2/cryptography/symmetric.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/saml2/cryptography/symmetric.py b/src/saml2/cryptography/symmetric.py index ea4565b8a..53eb91ed0 100644 --- a/src/saml2/cryptography/symmetric.py +++ b/src/saml2/cryptography/symmetric.py @@ -15,6 +15,14 @@ from .errors import SymmetricCryptographyError +try: + # cryptography >= 47 moved CFB here; use it to avoid CryptographyDeprecationWarning. + from cryptography.hazmat.decrepit.ciphers.modes import CFB as _CFB +except ImportError: + # older cryptography versions don't have the "decrepit" module yet. + _CFB = _ciphers.modes.CFB + + logger = logging.getLogger(__name__) @@ -105,7 +113,7 @@ class AESCipher: POSTFIX_MODE = { "cbc": _ciphers.modes.CBC, - "cfb": _ciphers.modes.CFB, + "cfb": _CFB, } AES_BLOCK_SIZE = int(_ciphers.algorithms.AES.block_size / 8)