Repository navigation
Commit e649325
authored
chore(deps-dev): bump pyjwt from 2.13.0 to 2.15.0 (#1292)
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.13.0 to 2.15.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.15.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0
changelog</a> for complete release details.</p>
<h2>2.14.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0
changelog</a> for the complete release details and related security
advisories.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.15.0
<https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0></code>__</h2>
<p>Security</p>
<pre><code>
- Wrap recursion errors from deeply nested JWT payloads in
``DecodeError``
instead of exposing a raw ``RecursionError``.
<p>Added</p>
<pre><code>
- Support Python 3.15 by @kytta in
`[#1202](jpadilla/pyjwt#1202)
&lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__
Changed
</code></pre>
<ul>
<li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code>
rather than the raw JWKS
payload, so a cache hit no longer re-parses every key.
<code>JWKSetCache.put()</code>
accepts either form and raises <code>PyJWKSetError</code> for anything
else. As a
result, <code>PyJWKClient.get_jwk_set()</code> returns the same
<code>PyJWKSet</code> instance
for as long as it stays cached, rather than a freshly built one per call
in
<code>[#1208](jpadilla/pyjwt#1208)
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li>
<li><code>PyJWKClient.fetch_data()</code> now raises
<code>PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
object&quot;)</code> when
the endpoint response is not a JSON object, instead of returning it for
<code>get_jwk_set()</code> to reject. Callers reaching the JWKS through
<code>get_jwk_set()</code> see the same error as before in
<code>[#1208](jpadilla/pyjwt#1208)
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;</code>__</li>
</ul>
<p>Fixed</p>
<pre><code>
- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()``
instead
of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return
a JSON
object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the
cached value,
so callers pre-populating the cache to avoid a network round-trip could
not
read it back in `[#914](jpadilla/pyjwt#914)
&lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and
`[#1208](jpadilla/pyjwt#1208)
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
``fetch_data()`` override that filters or transforms the JWKS is no
longer
undone by the next cache hit in
`[#1208](jpadilla/pyjwt#1208)
&lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that
is not
&lt;/tr&gt;&lt;/table&gt;
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="jpadilla/pyjwt@1d41a6478e1562e68ff667fcd703356acf085f68"><code>1d41a64</code></a>
chore: prepare 2.15.0 release</li>
<li><a
href="jpadilla/pyjwt@9bc06658f875b9b40091539140bbbdc4639161c3"><code>9bc0665</code></a>
fix: make recursive payload tests deterministic</li>
<li><a
href="jpadilla/pyjwt@5fde08a6cf906aa7698de2d6391d88b73006b17b"><code>5fde08a</code></a>
fix: normalize recursive JWT payload errors</li>
<li><a
href="jpadilla/pyjwt@171062d2d734315272a901100aa4b109f2fc3c19"><code>171062d</code></a>
utils: mention bytes in force_bytes type error (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1173">#1173</a>)</li>
<li><a
href="jpadilla/pyjwt@c9d4d5375bf464ef363506fed9eb6e7f33217ab6"><code>c9d4d53</code></a>
docs/conf: drop duplicate 'and' from read() docstring (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1174">#1174</a>)</li>
<li><a
href="jpadilla/pyjwt@2763752196113e1473b0ed7905aa6034aedfbe53"><code>2763752</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1202">#1202</a>)</li>
<li><a
href="jpadilla/pyjwt@4adcd02722f5011c60079d3978dfc167b9a8eaa5"><code>4adcd02</code></a>
Catch http.client.HTTPException in PyJWKClient.fetch_data (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1201">#1201</a>)</li>
<li><a
href="jpadilla/pyjwt@9e501d993b4d3e7dba14bdb1722b1d993ac75097"><code>9e501d9</code></a>
fix: correct docstring typo in _validate_jti (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1179">#1179</a>)</li>
<li><a
href="jpadilla/pyjwt@4047c44d51950ffda15f40054508d3f17c43b1e2"><code>4047c44</code></a>
docs: clarify JWK certificate member handling (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1212">#1212</a>)</li>
<li><a
href="jpadilla/pyjwt@f4e2b59f543cc82d46d9d69922bba59e804216b9"><code>f4e2b59</code></a>
[pre-commit.ci] pre-commit autoupdate (<a
href="https://redirect.github.com/jpadilla/pyjwt/issues/1210">#1210</a>)</li>
<li>Additional commits viewable in <a
href="jpadilla/pyjwt@2.13.0...2.15.0">compare
view</a></li>
</ul>
</details>
<br /></code></pre>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent 37b6646 commit e649325
1 file changed
Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments