google-auth 2.55.2__tar.gz → 2.56.0__tar.gz

{google_auth-2.55.2/google_auth.egg-info → google_auth-2.56.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-auth
-Version: 2.55.2
+Version: 2.56.0
 Summary: Google Authentication Library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 Author: Google Cloud Platform
@@ -24,22 +24,27 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.10
 License-File: LICENSE
 Requires-Dist: pyasn1-modules>=0.2.1
-Requires-Dist: cryptography>=38.0.3
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14"
 Provides-Extra: cryptography
-Requires-Dist: cryptography>=38.0.3; extra == "cryptography"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "cryptography"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "cryptography"
 Provides-Extra: pyopenssl
-Requires-Dist: cryptography>=38.0.3; extra == "pyopenssl"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "pyopenssl"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "pyopenssl"
 Provides-Extra: aiohttp
-Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "aiohttp"
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "aiohttp"
+Requires-Dist: aiohttp<4.0.0,>=3.8.0; python_version < "3.14" and extra == "aiohttp"
+Requires-Dist: aiohttp<4.0.0,>=3.9.0; python_version >= "3.14" and extra == "aiohttp"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "aiohttp"
 Provides-Extra: enterprise-cert
-Requires-Dist: cryptography>=38.0.3; extra == "enterprise-cert"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "enterprise-cert"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "enterprise-cert"
 Provides-Extra: pyjwt
 Requires-Dist: pyjwt>=2.0; extra == "pyjwt"
 Provides-Extra: reauth
 Requires-Dist: pyu2f>=0.1.5; extra == "reauth"
 Provides-Extra: requests
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "requests"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "requests"
 Provides-Extra: testing
 Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "testing"
 Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "testing"
@@ -51,17 +56,18 @@ Requires-Dist: pytest-cov; extra == "testing"
 Requires-Dist: pytest-localserver; extra == "testing"
 Requires-Dist: pyu2f>=0.1.5; extra == "testing"
 Requires-Dist: responses; extra == "testing"
-Requires-Dist: urllib3; extra == "testing"
-Requires-Dist: packaging; extra == "testing"
-Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "testing"
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "testing"
+Requires-Dist: urllib3<3.0.0,>=1.26.15; extra == "testing"
+Requires-Dist: packaging>=20.0; extra == "testing"
+Requires-Dist: aiohttp<4.0.0,>=3.8.0; python_version < "3.14" and extra == "testing"
+Requires-Dist: aiohttp<4.0.0,>=3.9.0; python_version >= "3.14" and extra == "testing"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "testing"
 Requires-Dist: aioresponses; extra == "testing"
 Requires-Dist: pytest-asyncio; extra == "testing"
 Provides-Extra: urllib3
-Requires-Dist: urllib3; extra == "urllib3"
-Requires-Dist: packaging; extra == "urllib3"
+Requires-Dist: urllib3<3.0.0,>=1.26.15; extra == "urllib3"
+Requires-Dist: packaging>=20.0; extra == "urllib3"
 Provides-Extra: rsa
-Requires-Dist: rsa<5,>=3.1.4; extra == "rsa"
+Requires-Dist: rsa<5,>=4.0.0; extra == "rsa"
 Provides-Extra: grpc
 Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "grpc"
 Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "grpc"

{google_auth-2.55.2 → google_auth-2.56.0}/google/auth/aio/transport/mtls.py

@@ -55,11 +55,7 @@ def make_client_cert_ssl_context(
         ):
             context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
             if cert_path:
-                password = (
-                    passphrase_val.decode("utf-8")
-                    if isinstance(passphrase_val, bytes)
-                    else passphrase_val
-                )
+                password = passphrase_val
                 context.load_cert_chain(
                     certfile=cert_path,
                     keyfile=key_path,

{google_auth-2.55.2 → google_auth-2.56.0}/google/auth/environment_vars.py

@@ -133,3 +133,6 @@ GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES = (
     "GOOGLE_API_PREVENT_AGENT_TOKEN_SHARING_FOR_GCP_SERVICES"
 )
 """Environment variable to prevent agent token sharing for GCP services."""
+
+GOOGLE_API_USE_MTLS_ENDPOINT = "GOOGLE_API_USE_MTLS_ENDPOINT"
+"""Environment variable controlling whether to use mTLS endpoint or not."""

google_auth-2.56.0/google/auth/transport/mtls.py

@@ -0,0 +1,306 @@
+# Copyright 2020 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Utilites for mutual TLS."""
+
+import enum
+import logging
+from os import getenv
+import ssl
+from typing import Optional
+
+from google.auth import environment_vars
+from google.auth import exceptions
+from google.auth.transport import _mtls_helper
+
+
+_LOGGER = logging.getLogger(__name__)
+
+
+class UseMtlsEndpointMode(enum.Enum):
+    ALWAYS = "always"
+    NEVER = "never"
+    AUTO = "auto"
+
+
+def has_default_client_cert_source(include_context_aware=True):
+    """Check if default client SSL credentials exists on the device.
+
+    Args:
+       include_context_aware (bool): include_context_aware indicates if context_aware
+       path location will be checked or should it be skipped.
+
+    Returns:
+        bool: indicating if the default client cert source exists.
+    """
+    if (
+        include_context_aware
+        and _mtls_helper._check_config_path(_mtls_helper.CONTEXT_AWARE_METADATA_PATH)
+        is not None
+    ):
+        return True
+    if (
+        _mtls_helper._check_config_path(
+            _mtls_helper.CERTIFICATE_CONFIGURATION_DEFAULT_PATH
+        )
+        is not None
+    ):
+        return True
+    cert_config_path = getenv("GOOGLE_API_CERTIFICATE_CONFIG")
+    if (
+        cert_config_path
+        and _mtls_helper._check_config_path(cert_config_path) is not None
+    ):
+        return True
+    return False
+
+
+def default_client_cert_source():
+    """Get a callback which returns the default client SSL credentials.
+
+    Returns:
+        Callable[[], [bytes, bytes]]: A callback which returns the default
+            client certificate bytes and private key bytes, both in PEM format.
+
+    Raises:
+        google.auth.exceptions.MutualTLSChannelError: If the default
+            client SSL credentials don't exist or are malformed.
+    """
+    if not has_default_client_cert_source(include_context_aware=True):
+        raise exceptions.MutualTLSChannelError(
+            "Default client cert source doesn't exist"
+        )
+
+    def callback():
+        try:
+            _, cert_bytes, key_bytes = _mtls_helper.get_client_cert_and_key()
+        except (OSError, RuntimeError, ValueError) as caught_exc:
+            new_exc = exceptions.MutualTLSChannelError(caught_exc)
+            raise new_exc from caught_exc
+
+        return cert_bytes, key_bytes
+
+    return callback
+
+
+def default_client_encrypted_cert_source(cert_path, key_path):
+    """Get a callback which returns the default encrpyted client SSL credentials.
+
+    Args:
+        cert_path (str): The cert file path. The default client certificate will
+            be written to this file when the returned callback is called.
+        key_path (str): The key file path. The default encrypted client key will
+            be written to this file when the returned callback is called.
+
+    Returns:
+        Callable[[], [str, str, bytes]]: A callback which generates the default
+            client certificate, encrpyted private key and passphrase. It writes
+            the certificate and private key into the cert_path and key_path, and
+            returns the cert_path, key_path and passphrase bytes.
+
+    Raises:
+        google.auth.exceptions.MutualTLSChannelError: If any problem
+            occurs when loading or saving the client certificate and key.
+    """
+    if not has_default_client_cert_source(include_context_aware=True):
+        raise exceptions.MutualTLSChannelError(
+            "Default client encrypted cert source doesn't exist"
+        )
+
+    def callback():
+        try:
+            (
+                _,
+                cert_bytes,
+                key_bytes,
+                passphrase_bytes,
+            ) = _mtls_helper.get_client_ssl_credentials(generate_encrypted_key=True)
+            with open(cert_path, "wb") as cert_file:
+                cert_file.write(cert_bytes)
+            with open(key_path, "wb") as key_file:
+                key_file.write(key_bytes)
+        except (exceptions.ClientCertError, OSError) as caught_exc:
+            new_exc = exceptions.MutualTLSChannelError(caught_exc)
+            raise new_exc from caught_exc
+
+        return cert_path, key_path, passphrase_bytes
+
+    return callback
+
+
+def should_use_client_cert():
+    """Returns boolean for whether the client certificate should be used for mTLS.
+
+    This is a wrapper around _mtls_helper.check_use_client_cert().
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is set to true or false, a corresponding
+    bool value will be returned
+    If GOOGLE_API_USE_CLIENT_CERTIFICATE is unset, the value will be inferred by
+    reading a file pointed at by GOOGLE_API_CERTIFICATE_CONFIG, and verifying it
+    contains a "workload" section. If so, the function will return True,
+    otherwise False.
+
+    Returns:
+       bool: indicating whether the client certificate should be used for mTLS.
+    """
+    return _mtls_helper.check_use_client_cert()
+
+
+def _load_client_cert_into_context(
+    ctx: ssl.SSLContext,
+    cert_bytes: bytes,
+    key_bytes: bytes,
+    passphrase: Optional[bytes] = None,
+) -> None:
+    """Load a client certificate and key into an SSL context.
+
+    Args:
+        ctx (ssl.SSLContext): The SSL context to load the certificate and key into.
+        cert_bytes (bytes): The client certificate bytes in PEM format.
+        key_bytes (bytes): The client private key bytes in PEM format.
+        passphrase (Optional[bytes]): The passphrase for the client private key.
+
+    Raises:
+        google.auth.exceptions.MutualTLSChannelError: If the SSL context is invalid,
+            or if loading the certificate and key fails.
+    """
+    if not isinstance(ctx, ssl.SSLContext):
+        raise exceptions.MutualTLSChannelError(
+            "Failed to load client certificate and key for mTLS. The provided context "
+            "object is invalid or does not support loading certificate chains."
+        )
+
+    try:
+        with _mtls_helper.secure_cert_key_paths(
+            cert_bytes, key_bytes, passphrase=passphrase
+        ) as (
+            cert_path,
+            key_path,
+            passphrase_val,
+        ):
+            if cert_path is None or key_path is None:
+                raise exceptions.MutualTLSChannelError(
+                    "Failed to generate temporary file paths for the client certificate and key."
+                )
+            ctx.load_cert_chain(
+                certfile=cert_path, keyfile=key_path, password=passphrase_val
+            )
+    except (
+        ssl.SSLError,
+        OSError,
+        ValueError,
+        RuntimeError,
+        TypeError,
+    ) as caught_exc:
+        new_exc = exceptions.MutualTLSChannelError(caught_exc)
+        raise new_exc from caught_exc
+
+
+def load_default_client_cert(ctx: ssl.SSLContext) -> bool:
+    """Load the default client certificate and key into an SSL context if configured.
+
+    If client certificates are enabled and a default client certificate source is
+    found, the certificate and key are loaded into the SSL context.
+
+    Args:
+        ctx (ssl.SSLContext): The SSL context to load the default client certificate
+            and key into.
+
+    Returns:
+        bool: True if client certificates are enabled and the default client
+            certificate was successfully loaded. False if client certificates
+            are disabled or if no default certificate source is configured.
+
+    Raises:
+        google.auth.exceptions.MutualTLSChannelError: If the default client certificate
+            or key is malformed.
+    """
+    if not should_use_client_cert() or not has_default_client_cert_source():
+        return False
+    try:
+        (
+            has_cert,
+            cert_bytes,
+            key_bytes,
+            passphrase,
+        ) = _mtls_helper.get_client_ssl_credentials()
+    except (
+        exceptions.ClientCertError,
+        OSError,
+        RuntimeError,
+        ValueError,
+    ) as caught_exc:
+        new_exc = exceptions.MutualTLSChannelError(caught_exc)
+        raise new_exc from caught_exc
+    else:
+        if not has_cert:
+            return False
+        _load_client_cert_into_context(ctx, cert_bytes, key_bytes, passphrase)
+        return True
+
+
+def get_default_ssl_context() -> Optional[ssl.SSLContext]:
+    """Get a default SSL context loaded with the default client certificate.
+
+    Returns:
+        ssl.SSLContext: An SSL context loaded with the default client
+            certificate, or None if client certificates are not configured
+            or available.
+
+    Raises:
+        google.auth.exceptions.MutualTLSChannelError: If the default client certificate
+            or key is malformed.
+    """
+    if not should_use_client_cert() or not has_default_client_cert_source():
+        return None
+
+    ctx = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+    return ctx if load_default_client_cert(ctx) else None
+
+
+def should_use_mtls_endpoint(
+    client_cert_available: Optional[bool] = None,
+) -> bool:
+    """Determine whether to use an mTLS endpoint.
+
+    This relies on the GOOGLE_API_USE_MTLS_ENDPOINT environment variable. If set to
+    "always", returns True. If set to "never", returns False. If set to "auto"
+    or unset, returns whether a client certificate is available.
+
+    Args:
+        client_cert_available (Optional[bool]): indicating if a client certificate
+            is available. If None, this is determined by checking if client
+            certificates are enabled using :func:`should_use_client_cert`.
+
+    Returns:
+        bool: indicating if an mTLS endpoint should be used.
+    """
+    if client_cert_available is None:
+        client_cert_available = should_use_client_cert()
+
+    use_mtls_endpoint = getenv(environment_vars.GOOGLE_API_USE_MTLS_ENDPOINT)
+    use_mtls_endpoint = (use_mtls_endpoint or "auto").strip().lower()
+    try:
+        mode = UseMtlsEndpointMode(use_mtls_endpoint)
+    except ValueError:
+        raise exceptions.MutualTLSChannelError(
+            f"Unsupported {environment_vars.GOOGLE_API_USE_MTLS_ENDPOINT} value "
+            f"'{use_mtls_endpoint}'. Accepted values: never, auto, always."
+        )
+
+    if mode == UseMtlsEndpointMode.ALWAYS:
+        return True
+    if mode == UseMtlsEndpointMode.NEVER:
+        return False
+    if mode == UseMtlsEndpointMode.AUTO:
+        return client_cert_available

{google_auth-2.55.2 → google_auth-2.56.0}/google/auth/transport/requests.py

@@ -224,11 +224,7 @@ class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
                 key_path,
                 passphrase,
             ):
-                password = (
-                    passphrase.decode("utf-8")
-                    if isinstance(passphrase, bytes)
-                    else passphrase
-                )
+                password = passphrase
                 ctx_poolmanager.load_cert_chain(
                     certfile=cert_path,
                     keyfile=key_path,

{google_auth-2.55.2 → google_auth-2.56.0}/google/auth/transport/urllib3.py

@@ -188,11 +188,7 @@ def _make_mutual_tls_http(cert, key):
             key_path,
             passphrase,
         ):
-            password = (
-                passphrase.decode("utf-8")
-                if isinstance(passphrase, bytes)
-                else passphrase
-            )
+            password = passphrase
             ctx.load_cert_chain(
                 certfile=cert_path,
                 keyfile=key_path,

{google_auth-2.55.2 → google_auth-2.56.0}/google/auth/version.py

@@ -12,4 +12,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-__version__ = "2.55.2"
+__version__ = "2.56.0"

{google_auth-2.55.2 → google_auth-2.56.0/google_auth.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-auth
-Version: 2.55.2
+Version: 2.56.0
 Summary: Google Authentication Library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth
 Author: Google Cloud Platform
@@ -24,22 +24,27 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.10
 License-File: LICENSE
 Requires-Dist: pyasn1-modules>=0.2.1
-Requires-Dist: cryptography>=38.0.3
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14"
 Provides-Extra: cryptography
-Requires-Dist: cryptography>=38.0.3; extra == "cryptography"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "cryptography"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "cryptography"
 Provides-Extra: pyopenssl
-Requires-Dist: cryptography>=38.0.3; extra == "pyopenssl"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "pyopenssl"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "pyopenssl"
 Provides-Extra: aiohttp
-Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "aiohttp"
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "aiohttp"
+Requires-Dist: aiohttp<4.0.0,>=3.8.0; python_version < "3.14" and extra == "aiohttp"
+Requires-Dist: aiohttp<4.0.0,>=3.9.0; python_version >= "3.14" and extra == "aiohttp"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "aiohttp"
 Provides-Extra: enterprise-cert
-Requires-Dist: cryptography>=38.0.3; extra == "enterprise-cert"
+Requires-Dist: cryptography>=38.0.3; python_version < "3.14" and extra == "enterprise-cert"
+Requires-Dist: cryptography>=41.0.5; python_version >= "3.14" and extra == "enterprise-cert"
 Provides-Extra: pyjwt
 Requires-Dist: pyjwt>=2.0; extra == "pyjwt"
 Provides-Extra: reauth
 Requires-Dist: pyu2f>=0.1.5; extra == "reauth"
 Provides-Extra: requests
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "requests"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "requests"
 Provides-Extra: testing
 Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "testing"
 Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "testing"
@@ -51,17 +56,18 @@ Requires-Dist: pytest-cov; extra == "testing"
 Requires-Dist: pytest-localserver; extra == "testing"
 Requires-Dist: pyu2f>=0.1.5; extra == "testing"
 Requires-Dist: responses; extra == "testing"
-Requires-Dist: urllib3; extra == "testing"
-Requires-Dist: packaging; extra == "testing"
-Requires-Dist: aiohttp<4.0.0,>=3.8.0; extra == "testing"
-Requires-Dist: requests<3.0.0,>=2.20.0; extra == "testing"
+Requires-Dist: urllib3<3.0.0,>=1.26.15; extra == "testing"
+Requires-Dist: packaging>=20.0; extra == "testing"
+Requires-Dist: aiohttp<4.0.0,>=3.8.0; python_version < "3.14" and extra == "testing"
+Requires-Dist: aiohttp<4.0.0,>=3.9.0; python_version >= "3.14" and extra == "testing"
+Requires-Dist: requests<3.0.0,>=2.30.0; extra == "testing"
 Requires-Dist: aioresponses; extra == "testing"
 Requires-Dist: pytest-asyncio; extra == "testing"
 Provides-Extra: urllib3
-Requires-Dist: urllib3; extra == "urllib3"
-Requires-Dist: packaging; extra == "urllib3"
+Requires-Dist: urllib3<3.0.0,>=1.26.15; extra == "urllib3"
+Requires-Dist: packaging>=20.0; extra == "urllib3"
 Provides-Extra: rsa
-Requires-Dist: rsa<5,>=3.1.4; extra == "rsa"
+Requires-Dist: rsa<5,>=4.0.0; extra == "rsa"
 Provides-Extra: grpc
 Requires-Dist: grpcio<2.0.0,>=1.59.0; python_version < "3.14" and extra == "grpc"
 Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14" and extra == "grpc"

{google_auth-2.55.2 → google_auth-2.56.0}/google_auth.egg-info/SOURCES.txt

@@ -181,6 +181,7 @@ tests/oauth2/test_webauthn_handler.py
 tests/oauth2/test_webauthn_handler_factory.py
 tests/oauth2/test_webauthn_types.py
 tests/transport/__init__.py
+tests/transport/aioresponses_compat.py
 tests/transport/compliance.py
 tests/transport/test__custom_tls_signer.py
 tests/transport/test__http_client.py

google_auth-2.56.0/google_auth.egg-info/requires.txt

@@ -0,0 +1,87 @@
+pyasn1-modules>=0.2.1
+
+[:python_version < "3.14"]
+cryptography>=38.0.3
+
+[:python_version >= "3.14"]
+cryptography>=41.0.5
+
+[aiohttp]
+requests<3.0.0,>=2.30.0
+
+[aiohttp:python_version < "3.14"]
+aiohttp<4.0.0,>=3.8.0
+
+[aiohttp:python_version >= "3.14"]
+aiohttp<4.0.0,>=3.9.0
+
+[cryptography]
+
+[cryptography:python_version < "3.14"]
+cryptography>=38.0.3
+
+[cryptography:python_version >= "3.14"]
+cryptography>=41.0.5
+
+[enterprise_cert]
+
+[enterprise_cert:python_version < "3.14"]
+cryptography>=38.0.3
+
+[enterprise_cert:python_version >= "3.14"]
+cryptography>=41.0.5
+
+[grpc]
+
+[grpc:python_version < "3.14"]
+grpcio<2.0.0,>=1.59.0
+
+[grpc:python_version >= "3.14"]
+grpcio<2.0.0,>=1.75.1
+
+[pyjwt]
+pyjwt>=2.0
+
+[pyopenssl]
+
+[pyopenssl:python_version < "3.14"]
+cryptography>=38.0.3
+
+[pyopenssl:python_version >= "3.14"]
+cryptography>=41.0.5
+
+[reauth]
+pyu2f>=0.1.5
+
+[requests]
+requests<3.0.0,>=2.30.0
+
+[rsa]
+rsa<5,>=4.0.0
+
+[testing]
+flask
+freezegun
+pyjwt>=2.0
+pytest
+pytest-cov
+pytest-localserver
+pyu2f>=0.1.5
+responses
+urllib3<3.0.0,>=1.26.15
+packaging>=20.0
+requests<3.0.0,>=2.30.0
+aioresponses
+pytest-asyncio
+
+[testing:python_version < "3.14"]
+grpcio<2.0.0,>=1.59.0
+aiohttp<4.0.0,>=3.8.0
+
+[testing:python_version >= "3.14"]
+grpcio<2.0.0,>=1.75.1
+aiohttp<4.0.0,>=3.9.0
+
+[urllib3]
+urllib3<3.0.0,>=1.26.15
+packaging>=20.0

{google_auth-2.55.2 → google_auth-2.56.0}/setup.py

@@ -19,7 +19,8 @@ from setuptools import find_namespace_packages
 from setuptools import setup
 
 cryptography_base_require = [
-    "cryptography >= 38.0.3",
+    "cryptography >= 38.0.3; python_version < '3.14'",
+    "cryptography >= 41.0.5; python_version >= '3.14'",
 ]
 
 DEPENDENCIES = (
@@ -27,9 +28,13 @@ DEPENDENCIES = (
     *cryptography_base_require,
 )
 
-requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
+requests_extra_require = ["requests >= 2.30.0, < 3.0.0"]
 
-aiohttp_extra_require = ["aiohttp >= 3.8.0, < 4.0.0", *requests_extra_require]
+aiohttp_extra_require = [
+    "aiohttp >= 3.8.0, < 4.0.0; python_version < '3.14'",
+    "aiohttp >= 3.9.0, < 4.0.0; python_version >= '3.14'",
+    *requests_extra_require,
+]
 
 pyjwt_extra_require = ["pyjwt>=2.0"]
 
@@ -37,10 +42,12 @@ reauth_extra_require = ["pyu2f>=0.1.5"]
 
 enterprise_cert_extra_require = cryptography_base_require
 
-# TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
-urllib3_extra_require = ["urllib3", "packaging"]
+urllib3_extra_require = [
+    "urllib3 >= 1.26.15, < 3.0.0",
+    "packaging >= 20.0",
+]
 
-rsa_extra_require = ["rsa>=3.1.4,<5"]
+rsa_extra_require = ["rsa>=4.0.0,<5"]
 
 grpc_extra_require = [
     "grpcio >= 1.59.0, < 2.0.0; python_version < '3.14'",

google_auth-2.56.0/tests/transport/aio/conftest.py

@@ -0,0 +1,17 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from tests.transport.aioresponses_compat import patch_aioresponses
+
+patch_aioresponses()