[FIX] auth_saml: require compatible urllib3

[oussjarrousse]

PR OCA#916 currently fails in the OCA Python 3.10 CI environment before addon tests run.

Installing current pysaml2 upgrades cryptography and pyOpenSSL, while Odoo 19 keeps urllib3==1.26.5 on Python 3.10. This results in:

ModuleNotFoundError:
No module named 'cryptography.hazmat.backends.openssl.x509'

This change declares urllib3>=2.0.7 as a runtime dependency of auth_saml so the urllib3 pyOpenSSL integration uses APIs compatible with the modern cryptography stack required by current pysaml2.

The generated root requirements.txt is updated accordingly.

No application code or tests are changed.

Validation

The issue was reproduced using the same OCA CI workflow and containers used by OCA/server-auth 19.0.

Before this fix, CI failed before addon tests ran with:

ModuleNotFoundError:
No module named 'cryptography.hazmat.backends.openssl.x509'

The cause was the dependency combination:

• pysaml2==7.5.5
• pyOpenSSL==26.4.0
• cryptography==50.0.1
• urllib3==1.26.5

The first commit adds urllib3>=2.0.7, which resolves the runtime incompatibility.

After that, all addon tests passed, but OCA checklog still failed on a known upstream PySAML2 CryptographyDeprecationWarning:

IdentityPython/pysaml2#1033

The second commit adds a narrowly scoped checklog-odoo.cfg ignore rule for that specific third-party warning.

The complete fix was tested in the OCA CI workflow using:

• ghcr.io/oca/oca-ci/py3.10-odoo19.0:latest
• ghcr.io/oca/oca-ci/py3.10-ocb19.0:latest

Final result:

• Detect unreleased dependencies: PASS
• test with Odoo: PASS
• test with OCB: PASS

[oussjarrousse]

I investigated the current merge failure and submitted a fix here:

#5

The failure was caused by current pysaml2 upgrading the cryptography/pyOpenSSL stack while Odoo 19/Python 3.10 still had urllib3 1.26.5.

The fix:

• requires urllib3>=2.0.7 for auth_saml
• narrowly ignores the known upstream PySAML2 CFB deprecation warning in checklog-odoo.cfg

I reproduced the OCA CI environment on my fork and the final branch passes:

• Detect unreleased dependencies
• test with Odoo
• test with OCB

---

Have a nice weekend!