In hindsight, probably would’ve been way better to ship a `cryptography2` package and deprecate the old package.

That way you get the benefits of using rust without the anger about the sudden breakage of a transitive dependency.

In terms of floating versioning, I honestly think it’s not reasonable to ask packages to do this, because then you get into dependency hell with unfixable dependency conflicts.