2.1:
FINAL DEPRECATION Python 2.6 support is deprecated, and will be removed in the next release of cryptography.
BACKWARDS INCOMPATIBLE: Whirlpool, RIPEMD160, and UnsupportedExtension have been removed in accordance with our :doc:`/api-stability` policy.
BACKWARDS INCOMPATIBLE: :attr:`~cryptography.x509.DNSName.value`, :attr:`~cryptography.x509.RFC822Name.value`, and :attr:`~cryptography.x509.UniformResourceIdentifier.value` will now return an :term:`A-label` string when parsing a certificate containing an internationalized domain name (IDN) or if the caller passed a :term:`U-label` to the constructor. See below for additional deprecations related to this change.
Installing cryptography now requires pip 6 or newer.
Deprecated passing :term:`U-label` strings to the :class:`~cryptography.x509.DNSName`, :class:`~cryptography.x509.UniformResourceIdentifier`, and :class:`~cryptography.x509.RFC822Name` constructors. Instead, users should pass values as :term:`A-label` strings with idna encoding if necessary. This change will not affect anyone who is not processing internationalized domains.
Added support for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`. In most cases users should choose :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305` rather than using this unauthenticated form.
Added :meth:`~cryptography.x509.CertificateRevocationList.is_signature_valid` to :class:`~cryptography.x509.CertificateRevocationList`.
Support :class:`~cryptography.hazmat.primitives.hashes.BLAKE2b` and :class:`~cryptography.hazmat.primitives.hashes.BLAKE2s` with :class:`~cryptography.hazmat.primitives.hmac.HMAC`.
Added support for :class:`~cryptography.hazmat.primitives.ciphers.modes.XTS` mode for AES.
Added support for using labels with :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using OpenSSL 1.0.2 or greater.
Improved compatibility with NSS when issuing certificates from an issuer that has a subject with non-UTF8String string types.
Add support for the :class:`~cryptography.x509.DeltaCRLIndicator` extension.
Add support for the :class:`~cryptography.x509.TLSFeature` extension. This is commonly used for enabling OCSP Must-Staple in certificates.
Add support for the :class:`~cryptography.x509.FreshestCRL` extension.
f931c27680