That definitely needs to go into staging, cryptography is at the core of many python packages. In fact I wonder if we should wait for the next python-unstable run, depending how much breakage we can expect.

That definitely needs to go into staging, cryptography is at the core of many python packages. In fact I wonder if we should wait for the next python-unstable run, depending how much breakage we can expect.

Cool. Are there some guidelines somewhere around going through staging?

https://github.com/NixOS/nixpkgs/blob/master/doc/contributing/submitting-changes.chapter.md#staging-branch-submitting-changes-staging-branch

In fact I wonder if we should wait for the next python-unstable run, depending how much breakage we can expect.

IIRC Cryptography updates usually caused (very) few breakages in the past so it should probably be fine. The changelog also LGTM: https://cryptography.io/en/latest/changelog/#v35-0-0. However, we could still wait for the next python-unstable run if that would help.

@cpcloud would you mind doing some additional testing (I'm usually trying out a few simple examples and use nixpkgs-review to test (most) Python rebuilds)?

What do we usually test? home-assistant?

Cherry-picked, this builds happily on macos 10.15, python 3.8 & 3.9

With the exception of python-miio everything required in home-assistant still build successful. I think this can be safely merged without causing to much havoc.

This update broke python3Packages.fido2 and by extension home-assistant and a few other packages. I think we might need to revert it.

Reverted in #141037 due to breakages in fido2, mitmproxy and a whole lot of downstream packages. We're too close before a release for these kinds of breaking changes.

@mweinelt thanks for reverting it and sorry about the inconveniences. In that case it seems best to delay the update until most downstream packages adapt to the new versioning scheme (which should be the case after the next release) or someone properly tests it using nixpkgs-review (which I usually do - especially if the version changes in a way that might cause problems).