fix: upgrade boto3 and pin cryptography/pyopenssl for Python 3.14 compatibility

[AssemBahnasy]

Problem

On Python 3.14, importing s3_backup_settings crashes at startup with:

AttributeError: module 'lib' has no attribute 'GEN_EMAIL'

The failure chain is:

boto3~=1.34.143 → botocore.httpsession → urllib3.contrib.pyopenssl → OpenSSL.crypto → crash

The GEN_EMAIL constant was removed in cryptography 42.x. The old pinned boto3 version pulls in an older botocore that unconditionally imports urllib3.contrib.pyopenssl, which in turn loads pyopenssl — and any installed pyopenssl built against the old cryptography ABI fails to initialise.

This makes the entire site unable to boot on Python 3.14, since Frappe loads doctype controllers during the session boot sequence.

Changes

• boto3~=1.34.143 → boto3>=1.35.0 — botocore 1.35+ targets urllib3 2.x, which removed the pyopenssl contrib module entirely, cutting the import chain at its root.
• Added cryptography>=42.0.0 — ensures the cryptography library is new enough that pyopenssl can initialise correctly even if it ends up installed as a transitive dependency.
• Added pyopenssl>=24.0.0 — the first release series compatible with cryptography 42.x.

Testing

Verified by deploying to a Frappe Cloud site running Python 3.14 — site boots and the S3 Backup Settings doctype loads without error.

[greptile-apps]

Confidence Score: 4/5

The cryptography pin is too tight and will cause resolver conflicts in environments with other packages requiring cryptography 43+.

The cryptography~=42.0.0 constraint limits resolution to 42.0.x only. Frappe sites often have multiple apps with overlapping dependencies, and any package in that graph requiring cryptography>=43 will make pip fail outright.

pyproject.toml

_{Reviews (2): Last reviewed commit: "fix: use compatible-release pins (~=) fo..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR updates Python dependencies to prevent startup crashes on Python 3.14 caused by an import chain involving older botocore/urllib3.contrib.pyopenssl and incompatible pyopenssl/cryptography combinations.

Changes:

• Upgrades boto3 to >=1.35.0 to pick up botocore behavior compatible with urllib3 2.x (removing the legacy pyopenssl contrib import path).
• Adds explicit minimum versions for cryptography and pyopenssl to avoid incompatibilities with cryptography 42.x.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.