release: nostrwalletconnect 0.2.1 — require nostrkey>=0.3.5 (transitive cryptography CVE fix)

Author: vveerrgg

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.2.1 — 2026-07-21
+
+### Security
+
+- **Transitive `cryptography` CVE fix.** This package pulls `cryptography`
+  only through `nostrkey`, which previously capped `cryptography<45.0` and so
+  shipped the vulnerable 44.0.3 (four advisories: PYSEC-2026-35,
+  PYSEC-2026-2141, GHSA-537c-gmf6-5ccf, and a related OpenSSL fix). The
+  `nostrkey` floor is raised to `>=0.3.5`, whose lifted ceiling resolves
+  `cryptography` 49.0.0. Verified against the local nostrkey 0.3.5 build:
+  full test suite and `pip-audit` green on `cryptography` 49. No source
+  changes.
+
 ## 0.2.0 — 2026-07-17
 
 NIP-47 compliance and response-verification fixes. Minor bump because error

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nostrwalletconnect"
-version = "0.2.0"
+version = "0.2.1"
 description = "Nostr Wallet Connect (NIP-47) SDK for OpenClaw AI entities — pay invoices, check balance, create invoices"
 readme = "README.md"
 license = "MIT"
@@ -25,7 +25,7 @@ classifiers = [
     "Topic :: Software Development :: Libraries :: Python Modules",
 ]
 dependencies = [
-    "nostrkey>=0.3.4",
+    "nostrkey>=0.3.5",
 ]
 
 [project.optional-dependencies]

src/nostrwalletconnect/__init__.py

@@ -4,7 +4,7 @@
 from nostrwalletconnect.connection import NWCConnection
 from nostrwalletconnect.types import NWCError
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 __all__ = [
     "NWCClient",
     "NWCConnection",