incompatible with Python 3.13 due to pgpy dependency using deprecated imghdr module

[SmileyChris]

The cybersource-rest-client-python package fails to initialize on Python 3.13 due to a transitive dependency issue with the pgpy package.
See also: SecurityInnovation/PGPy#462

Environment

• Package version: 0.0.70 (latest)
• Python version: 3.13.x
• Operating System: All platforms

Root Cause

1. Python 3.13 removed the deprecated imghdr module (https://peps.python.org/pep-0594/)
2. The pgpy package (v0.6.0) imports imghdr in its constants.py file
3. cybersource-rest-client-python depends on pgpy (defined in setup.py)
4. BatchUploadWithMTLSApi is imported in the top-level CyberSource/__init__.py
5. This triggers the import chain: CyberSource → BatchUploadWithMTLSApi → PgpEncryption → pgpy → imghdr ❌

Error Traceback

  import CyberSource

  File "/site-packages/CyberSource/__init__.py", line 1559, in <module>
      from .api.o_auth_api import OAuthApi
  File "/site-packages/CyberSource/api/__init__.py", line 5, in <module>
      from .batch_upload_with_mtls_api import BatchUploadWithMTLSApi
  File "/site-packages/CyberSource/api/batch_upload_with_mtls_api.py", line 6, in <module>
      from CyberSource.utilities.pgpBatchUpload.pgp_encryption import PgpEncryption
  File "/site-packages/CyberSource/utilities/pgpBatchUpload/pgp_encryption.py", line 4, in <module>
      import pgpy
  File "/site-packages/pgpy/__init__.py", line 4, in <module>
      from .pgp import PGPKey
  File "/site-packages/pgpy/pgp.py", line 25, in <module>
      from .constants import CompressionAlgorithm
  File "/site-packages/pgpy/constants.py", line 5, in <module>
      import imghdr
  ModuleNotFoundError: No module named 'imghdr'

Impact

• Blocks Python 3.13 adoption for all users of this package
• Affects all users, even those not using batch upload functionality, because the import happens at package initialization

[SmileyChris]

Proposed Solution

Use Python version environment markers to install pgpy for Python <3.13 and PGPy13 for Python >=3.13.

Changes required:

  # setup.py
  install_requires=[
      ...
  -   "pgpy",
  +   'pgpy; python_version < "3.13"',
  +   'PGPy13>=0.6.1rc1; python_version >= "3.13"',
      ...
  ]

Benefits:

• Works seamlessly across all Python versions
• No code changes needed (both packages provide the same pgpy module)
• Backward compatible with older Python versions
• Future-proof for Python 3.13+

Note: Both pgpy and PGPy13 provide the same module name (pgpy), so no code changes are required. PGPy13 is a Python 3.13-compatible fork that removes the imghdr dependency.

[SmileyChris]

Other options

Replace pgpy with PGPy13 for all versions

Replace the pgpy dependency with https://pypi.org/project/PGPy13/ for all Python versions.

Changes required:

  # setup.py
  install_requires=[
      ...
  -   "pgpy",
  +   "PGPy13>=0.6.1rc1",
      ...
  ]

Benefits:

• Simpler than environment markers
• Drop-in replacement (same API, same module name)
• Works on all Python versions

Drawbacks:

• Requires all users to switch to PGPy13 (though it's fully compatible)

Lazy import BatchUploadWithMTLSApi

Move the BatchUploadWithMTLSApi import out of CyberSource/__init__.py to avoid eager loading.

Changes required:

  # CyberSource/__init__.py
  - from .api.batch_upload_with_mtls_api import BatchUploadWithMTLSApi
  + # Lazy import to avoid pgpy dependency at package initialization
  + def get_batch_upload_api():
  +     from .api.batch_upload_with_mtls_api import BatchUploadWithMTLSApi
  +     return BatchUploadWithMTLSApi

Benefits:

• Only users of batch uploads need the pgpy dependency
• Smaller blast radius
• Could make pgpy an optional dependency

Drawbacks:

• Breaking change for users who import BatchUploadWithMTLSApi directly from top-level

Make pgpy an optional dependency

Convert pgpy to an optional/extra dependency for batch upload functionality.

Changes required:

  # setup.py
  install_requires=[
      # core dependencies
      ...
  -   "pgpy",
  ],
  extras_require={
  +   "batch-upload": ['pgpy; python_version < "3.13"', 'PGPy13>=0.6.1rc1; python_version >= "3.13"'],
  }

Users would install with: pip install cybersource-rest-client-python[batch-upload]

Benefits:

• Most users don't need batch upload functionality
• Reduces required dependencies

Drawbacks:

• Requires code changes to handle missing pgpy gracefully
• Breaking change for batch upload users

Workaround (Current)

Users can work around this issue with a post-install step:

  pip uninstall -y pgpy
  pip install --no-deps PGPy13

Or in a Dockerfile:

  RUN uv pip uninstall pgpy && uv pip install --no-deps PGPy13