Security update for python-PyJWT
This update for python-PyJWT fixes the following issues:
Update to PyJWT 2.12.1:
- CVE-2024-53861: prevent partial matching of the Issuer field (bsc#1234038).
- CVE-2026-32597: validate the crit Header Parameter defined in RFC 7515 (bsc#1259616).
Changelog:
Update to 2.12.1:
- Add missing typing_extensions dependency for Python < 3.11 in
#1150
Update to 2.12.0:
- Annotate PyJWKSet.keys for pyright by @tamird in #1134
- Close HTTPError response to prevent ResourceWarning on
Python 3.14 by @veeceey in #1133
- Do not keep algorithms dict in PyJWK instances by @akx in
#1143
- Use PyJWK algorithm when encoding without explicit
algorithm in #1148
- Docs: Add PyJWKClient API reference and document the
two-tier caching system (JWK Set cache and signing key LRU
cache).
Update to 2.11.0:
- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @kurtmckee in #1105
- Validate key against allowed types for Algorithm family in
#964
- Add iterator for JWKSet in #1041
- Validate iss claim is a string during encoding and decoding
by @pachewise in #1040
- Improve typing/logic for options in decode, decode_complete
by @pachewise in #1045
- Declare float supported type for lifespan and timeout by
@nikitagashkov in #1068
- Fix SyntaxWarnings/DeprecationWarnings caused by invalid
escape sequences by @kurtmckee in #1103
- Development: Build a shared wheel once to speed up test
suite setup times by @kurtmckee in #1114
- Development: Test type annotations across all supported
Python versions, increase the strictness of the type
checking, and remove the mypy pre-commit hook by @kurtmckee
in #1112
- Support Python 3.14, and test against PyPy 3.10 and 3.11 by
@kurtmckee in #1104
- Development: Migrate to build to test package building in
CI by @kurtmckee in #1108
- Development: Improve coverage config and eliminate unused
test suite code by @kurtmckee in #1115
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in
#1110
- Docs: Fix Read the Docs builds by @kurtmckee in #1111
- Docs: Add example of using leeway with nbf by @djw8605 in
#1034
- Docs: Refactored docs with autodoc; added PyJWS and
jwt.algorithms docs by @pachewise in #1045
- Docs: Documentation improvements for "sub" and "jti" claims
by @cleder in #1088
- Development: Add pyupgrade as a pre-commit hook by
@kurtmckee in #1109
- Add minimum key length validation for HMAC and RSA keys
(CWE-326). Warns by default via InsecureKeyLengthWarning
when keys are below minimum recommended lengths per RFC
7518 Section 3.2 (HMAC) and NIST SP 800-131A (RSA). Pass
enforce_minimum_key_length=True in options to PyJWT or
PyJWS to raise InvalidKeyError instead.
- Refactor PyJWT to own an internal PyJWS instance instead of
calling global api_jws functions.
Update to 2.10.0:
- chore: use sequence for typing rather than list
- Add support for Python 3.13
- [pre-commit.ci] pre-commit autoupdate
- Add an RTD config file to resolve RTD build failures
- docs: Update iat exception docs
- Remove algorithm requirement for JWT API
- Create SECURITY.md
- docs fix: decode_complete scope and algorithms
- fix doctest for docs/usage.rst
- fix test_utils.py not to xfail
- Correct jwt.decode audience param doc expression
- Add PS256 encoding and decoding usage
- Add API docs for PyJWK
- Refactor project configuration files from setup.cfg to pyproject.toml PEP-518
- Add JWK support to JWT encode
- Update pre-commit hooks to lint pyproject.toml
- Add EdDSA algorithm encoding/decoding usage
- Ruff linter and formatter changes
- Validate sub and jti claims for the token
- Add ES256 usage
- Encode EC keys with a fixed bit length
- Drop support for Python 3.8
- Prepare 2.10.0 release
- Bump codecov/codecov-action from 4 to 5
