Skip to content

Upgrading ecdsa 0.18 to 0.19

Breaking0.18.0 → 0.19.2Security1Platform3Deprecated1New3Changed1Fixed4Other9

Full comparisonBack to ecdsa
BreakingUpgrade verdict

3 platform requirement changes and a security fix.

In plain terms
  • Python 3.5 is no longer officially supported, though Python 2.6 and 2.7 still are.
  • The package is now officially tested and supported on Python 3.12 and 3.13.
  • The package is now officially supported on Python 3.11 and 3.12.
  • A malformed DER input could slip past parsing checks and cause high level functions like SigningKey.from_der() to raise unexpected exceptions.
Must act 5 items need code or config changes

Python requirement changed in 0.19.1: >=2.6, !=3.0.*, !=3.1.*, !=3.2.* → !=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,>=2.6.

What you must change

Security1
Fixes CVE-2026-33936, a DER parsing issue where truncated buffers were not detected in remove_octet_string(), remove_constructed(), and remove_implitic().
remove_octet_string()remove_constructed()remove_implitic()SigningKey.from_der()Medium · CVSS 5.3
0.19.2GitHub ReleaseSummarizedView source
Platform3
Drops official support for Python 3.5; support for Python 2.6 and 2.7 is unchanged.
0.19.1GitHub ReleaseSummarizedView source
Adds official support for Python 3.12 and 3.13 by adding them to CI.
0.19.1GitHub ReleaseSummarizedView source
Adds official support for Python 3.11 and 3.12.
0.19.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated1
Deprecates int_to_string, string_to_int, and digest_integer from ecdsa.ecdsa, to be removed in a future release.
int_to_stringstring_to_intdigest_integerecdsa.ecdsa
0.19.0GitHub ReleaseSummarizedView source