fix(google-auth): raise minimum pyopenssl version to 23.2.0

packages/google-auth/noxfile.py

@@ -171,15 +171,28 @@ def unit(session, install_deprecated_extras):
             f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load."
         )
 
-    constraints_path = str(
-        CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
-    )
-    extras_str = "testing"
     if install_deprecated_extras:
+        extras_str = "testing,pyopenssl,enterprise_cert,rsa"
         # rsa and oauth2client were both archived and support dropped,
-        # but we still  test old code paths
+        # but we still test old code paths
         session.install("oauth2client")
-        extras_str += ",rsa"
+
+        # Use the dedicated extras constraints file if it exists
+        extras_constraints = (
+            CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt"
+        )
+        if extras_constraints.exists():
+            constraints_path = str(extras_constraints)
+        else:
+            constraints_path = str(
+                CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+            )
+    else:
+        extras_str = "testing"
+        constraints_path = str(
+            CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
+        )
+
     session.install("-e", f".[{extras_str}]", "-c", constraints_path)
     session.run(
         "pytest",

packages/google-auth/setup.py

@@ -27,23 +27,36 @@
     cryptography_base_require,
 )
 
-requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
+requests_extra_require = [
+    "requests >= 2.20.0, < 3.0.0; python_version < '3.14'",
+    "requests >= 2.25.0, < 3.0.0; python_version >= '3.14'",
+]
 
-aiohttp_extra_require = ["aiohttp >= 3.8.0, < 4.0.0", *requests_extra_require]
+aiohttp_extra_require = [
+    "aiohttp >= 3.8.0, < 4.0.0; python_version < '3.11'",
+    "aiohttp >= 3.9.0, < 4.0.0; python_version >= '3.11'",
+    *requests_extra_require,
+]
 
 pyjwt_extra_require = ["pyjwt>=2.0"]
 
 reauth_extra_require = ["pyu2f>=0.1.5"]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1738): Add bounds for pyopenssl dependency.
-enterprise_cert_extra_require = ["pyopenssl"]
+enterprise_cert_extra_require = [
+    "pyopenssl>=23.2.0",
+    "urllib3>=1.26.15",
+]
 
-pyopenssl_extra_require = ["pyopenssl>=20.0.0"]
+pyopenssl_extra_require = [
+    "pyopenssl>=23.2.0",
+    "urllib3>=1.26.15",
+]
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require = ["urllib3", "packaging"]
 
-rsa_extra_require = ["rsa>=3.1.4,<5"]
+rsa_extra_require = ["rsa>=4.0,<5"]
 
 # Unit test requirements.
 testing_extra_require = [

packages/google-auth/testing/constraints-3.11.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and regular extras on Python 3.11
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.12.txt

@@ -1 +1,9 @@
-urllib3>2.0.0
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and regular extras on Python 3.12
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.13.txt

@@ -0,0 +1,9 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and regular extras on Python 3.13
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-3.14.txt

@@ -0,0 +1,9 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and regular extras on Python 3.14
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==38.0.3
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+urllib3==2.0.0

packages/google-auth/testing/constraints-extras-3.10.txt

@@ -0,0 +1,12 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and optional extras on Python 3.10
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==41.0.5
+pyjwt==2.0
+pyopenssl==23.2.0
+pyu2f==0.1.5
+rsa==4.0
+aiohttp==3.8.0
+requests==2.25.0
+urllib3==1.26.15

packages/google-auth/testing/constraints-extras-3.14.txt

@@ -0,0 +1,12 @@
+# This constraints file is used to check that lower bounds
+# are correct in setup.py for all dependencies and optional extras on Python 3.14
+pyasn1-modules==0.2.1
+setuptools==40.3.0
+cryptography==41.0.5
+pyjwt==2.0
+pyopenssl==23.2.0
+pyu2f==0.1.5
+rsa==4.0
+aiohttp==3.9.0
+requests==2.30.0
+urllib3==2.0.0