move argon2-cffi to optional [password] dependency for Python 3.13

a temporary measure, to allow installation on free-threaded Python while CFFI is unsupported

When PEP 780 lands, we can move this to a free-threaded condition,
instead of a version one

- big downside: `pip install jupyterlab` is incomplete on Python 3.13 if you have a password set
- upside: 3.13t installation is _possible_, where it wasn't before

Author: minrk

.github/workflows/python-tests.yml

@@ -28,6 +28,8 @@ jobs:
             python-version: "3.10"
           - os: ubuntu-latest
             python-version: "3.12"
+          - os: ubuntu-latest
+            python-version: "3.13t"
     steps:
       - name: Checkout
         uses: actions/checkout@v4

jupyter_server/auth/security.py

@@ -59,7 +59,12 @@ def passwd(passphrase=None, algorithm="argon2"):
             raise ValueError(msg)
 
     if algorithm == "argon2":
-        import argon2
+        try:
+            import argon2
+        except ModuleNotFoundError:
+            raise ImportError(
+                "argon2 password hashing requires argon2-cffi package. `pip install 'jupyter-server[password]'` for support."
+            ) from None
 
         ph = argon2.PasswordHasher(
             memory_cost=10240,
@@ -105,6 +110,12 @@ def passwd_check(hashed_passphrase, passphrase):
     True
     """
     if hashed_passphrase.startswith("argon2:"):
+        try:
+            import argon2
+        except ModuleNotFoundError:
+            raise ImportError(
+                "argon2 password hashing requires argon2-cffi package. `pip install 'jupyter-server[password]'` for support."
+            ) from None
         import argon2
         import argon2.exceptions
 

pyproject.toml

@@ -24,7 +24,10 @@ classifiers = [
 requires-python = ">=3.9"
 dependencies = [
     "anyio>=3.1.0",
-    "argon2-cffi>=21.1",
+    # argon2-cffi unavailable for free-threaded Python
+    # make it optional for Python >= 3.13 until PEP 780
+    # lets us limit it to the actually affected builds
+    "argon2-cffi>=21.1; python_version < '3.13'",
     "jinja2>=3.0.3",
     "jupyter_client>=7.4.4",
     "jupyter_core>=4.12,!=5.0.*",
@@ -52,6 +55,9 @@ Source = "https://github.com/jupyter-server/jupyter_server"
 Tracker = "https://github.com/jupyter-server/jupyter_server/issues"
 
 [project.optional-dependencies]
+password = [
+    "argon2-cffi>=21.1",
+]
 test = [
     "ipykernel",
     "pytest-console-scripts",