what would be the right way to pin

cryptography

version to 2.0.3 as Cris suggested?