psf/requests · info · RequestsDependencyWarning

Old version of cryptography ({cryptography_version_list}) ma

Error message

Old version of cryptography ({cryptography_version_list}) may cause slowdown.

What it means

A `RequestsDependencyWarning` emitted at import time from `_check_cryptography()` in `src/requests/__init__.py:107`. When pyOpenSSL support is in play, requests checks the installed `cryptography` package version; versions older than 1.3.4 had known performance problems (notably slow random-number/OpenSSL initialization), so requests warns that TLS operations may be slow. It is advisory only — nothing fails.

Source

Thrown at src/requests/__init__.py:108

        assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)
    else:
        warnings.warn(
            "Unable to find acceptable character detection dependency "
            "(chardet or charset_normalizer).",
            RequestsDependencyWarning,
        )


def _check_cryptography(cryptography_version: str) -> None:
    # cryptography < 1.3.4
    try:
        cryptography_version_list = list(map(int, cryptography_version.split(".")))
    except ValueError:
        return

    if cryptography_version_list < [1, 3, 4]:
        warning = f"Old version of cryptography ({cryptography_version_list}) may cause slowdown."
        warnings.warn(warning, RequestsDependencyWarning)


# Check imported dependencies for compatibility.
try:
    check_compatibility(
        urllib3.__version__,
        chardet_version,
        charset_normalizer_version,
    )
except (AssertionError, ValueError):
    warnings.warn(
        f"urllib3 ({urllib3.__version__}) or chardet "
        f"({chardet_version})/charset_normalizer ({charset_normalizer_version}) "
        "doesn't match a supported version!",
        RequestsDependencyWarning,
    )

# Attempt to enable urllib3's fallback for SNI support

View on GitHub ↗ (pinned to 414f0513c3)

Solutions

1. Upgrade cryptography: `pip install --upgrade cryptography` — any modern version (well above 1.3.4) removes the warning and the slowdown.
2. If a system package is shadowing a newer pip install, remove or bypass it (use a virtualenv so the old distro package isn't imported).
3. If the environment truly cannot upgrade, the warning can be filtered with `warnings.filterwarnings('ignore', category=RequestsDependencyWarning)`, accepting slower TLS.

Example fix

# before
# requirements.txt: cryptography==1.2.3
# after
# requirements.txt: cryptography>=42.0
# then: pip install --upgrade cryptography

import cryptography
from packaging.version import Version
assert Version(cryptography.__version__) >= Version('1.3.4'), 'Upgrade cryptography: pip install -U cryptography'

import warnings
with warnings.catch_warnings():
    warnings.simplefilter('error', category=RequestsDependencyWarning)
    import requests  # surface the old-cryptography warning as an error in CI

When it happens

Trigger: `import requests` in an environment where the pyOpenSSL/urllib3-contrib path is active and `cryptography.__version__` parses to a version list < [1, 3, 4]. Unparseable versions (e.g. dev builds with suffixes causing ValueError) skip the check silently.

Common situations: Very old pinned environments (legacy Python 2/early Python 3 era system packages), ancient OS-distribution `python-cryptography` packages on long-lived servers, requirements files pinning `cryptography<1.3.4` for compatibility with other legacy libraries.

Related errors

• Unable to find acceptable character detection dependency (ch
• Files must be provided.
• Data must not be a string.
• Unsupported event specified, with event name "{event}"
• Invalid URL {url!r}: No scheme supplied. Perhaps you meant h

AI-assisted analysis of psf/requests@414f0513c3 (2026-07-31). Data as JSON: /data/errors/ffbaf4126583a501.json. Report an issue: GitHub ↗.