fix: #1108 - Replace ecdsa with cryptography

[dacevedo12]

Fixes #1108

Fixes

A short description of what this PR does.

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket.

[tiwarishubham635]

Thanks for raising this PR. I can review this.

[Copilot]

Pull Request Overview

This PR replaces the ecdsa library with the cryptography library for handling ECDSA signature verification in the SendGrid Python SDK. This change affects the event webhook functionality that validates incoming webhook signatures from SendGrid.

Key changes:

• Replaces ecdsa dependency with cryptography in package requirements
• Updates imports and signature verification logic in the EventWebhook class
• Updates documentation references across README and CONTRIBUTING files

Reviewed Changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
setup.py	Replaces ecdsa dependency with cryptography>=45.0.6
sendgrid/helpers/eventwebhook/init.py	Updates signature verification implementation to use cryptography library
README.rst	Updates dependency documentation reference
README.md	Updates dependency documentation reference
CONTRIBUTING.md	Updates development dependency reference

[tiwarishubham635]

I see the verify signature test is passing. So it seems to be fine. Can you please do the above mentioned changes so that we can merge it? Thanks!

[dacevedo12]

@tiwarishubham635 Fixed

[dacevedo12]

Hey @tiwarishubham635 , is there anything pending to merge this? One would expect security fixes to be a high priority for Twilio...

[dacevedo12]

@tiwarishubham635 @twilio-product-security Hi, is there anything I can do to help speed up merging this security fix?

Kind regards,

[yonatan-shorani]

Hi, any update on this PR?
This change fixes a high-severity security vulnerability, and resolving it is important for us.

Thanks!

[maksym-skorupskyi]

This PR successfully addresses the security vulnerabilities in the ecdsa dependency by migrating to the industry-standard cryptography library. The implementation is clean and maintains backward compatibility.

Minor Suggestion:

Version Constraint: Consider if cryptography>=45.0.6 is too restrictive - you might want to allow a broader range like >=45.0.6,<46 to avoid forcing users to upgrade to very recent versions.

[RichardTea]

This is a breaking change as it adds a new client requirement for a Rust toolchain that never existed before.

Please can such things be put behind a Major version change, this broke our build as we now have to explicitly mark this "patch" version as incompatible.