fix(deps): update dependency pyjwt to >=2.14.0 #670

Merged

tobru merged 1 commit from renovate/pyjwt-2.x into main

2026-09-16 19:39:04 +00:00

renovate commented

2026-09-13 03:02:59 +00:00

Member

This PR contains the following updates:

Package	Change	Age	Confidence
pyjwt	`>=2.13.0` → `>=2.14.0`

Release Notes

jpadilla/pyjwt (pyjwt)

`v2.14.0`

Compare Source

Changed


- ``JWKSetCache`` now stores the parsed ``PyJWKSet`` rather than the raw JWKS
  payload, so a cache hit no longer re-parses every key. ``JWKSetCache.put()``
  accepts either form and raises ``PyJWKSetError`` for anything else. As a
  result, ``PyJWKClient.get_jwk_set()`` returns the same ``PyJWKSet`` instance
  for as long as it stays cached, rather than a freshly built one per call in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.fetch_data()`` now raises
  ``PyJWKClientError("The JWKS endpoint did not return a JSON object")`` when
  the endpoint response is not a JSON object, instead of returning it for
  ``get_jwk_set()`` to reject. Callers reaching the JWKS through
  ``get_jwk_set()`` see the same error as before in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__

Fixed
~~~~~

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security

Harden HMAC key validation against public-key material supplied as JWK,
JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>,
GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>.
Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
redirected destinations from being treated as trusted key sources. See
GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
Limit repeated JWKS refreshes caused by unknown key IDs while preserving
normal key-rotation behavior. See
GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
Handle deeply nested and malformed JWS/JWK input without uncaught recursion
errors or whole-set parsing failures. See
GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
Enforce compact JWS encoding rules during decoding. See
GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed


- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

Fixed

Raise the documented PyJWTError subclass instead of leaking a
TypeError when the exp, nbf, or iat claim decodes to a
non-numeric, non-string value such as a list, dict, or null.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [pyjwt](https://github.com/jpadilla/pyjwt) | `>=2.13.0` → `>=2.14.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/pyjwt/2.14.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/pyjwt/2.13.0/2.14.0?slim=true) | --- ### Release Notes <details> <summary>jpadilla/pyjwt (pyjwt)</summary> ### [`v2.14.0`](https://github.com/jpadilla/pyjwt/blob/HEAD/CHANGELOG.rst#Unreleased-httpsgithubcomjpadillapyjwtcompare2140HEAD) [Compare Source](https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0) Changed ``` - ``JWKSetCache`` now stores the parsed ``PyJWKSet`` rather than the raw JWKS payload, so a cache hit no longer re-parses every key. ``JWKSetCache.put()`` accepts either form and raises ``PyJWKSetError`` for anything else. As a result, ``PyJWKClient.get_jwk_set()`` returns the same ``PyJWKSet`` instance for as long as it stays cached, rather than a freshly built one per call in `#1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__ - ``PyJWKClient.fetch_data()`` now raises ``PyJWKClientError("The JWKS endpoint did not return a JSON object")`` when the endpoint response is not a JSON object, instead of returning it for ``get_jwk_set()`` to reject. Callers reaching the JWKS through ``get_jwk_set()`` see the same error as before in `#1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__ Fixed ~~~~~ - Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value, so callers pre-populating the cache to avoid a network round-trip could not read it back in `#914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and `#1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__ - ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a ``fetch_data()`` override that filters or transforms the JWKS is no longer undone by the next cache hit in `#1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__ - Treat malformed JWK Set members as unusable keys rather than letting ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not a JSON object is skipped, a key whose components have the wrong type raises ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable JWK Set in `#1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__ `v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__ ----------------------------------------------------------------------- Security ``` - Harden HMAC key validation against public-key material supplied as JWK, JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`**, `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`**, `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`**, and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`**. - Reject automatic redirects when `PyJWKClient` fetches a JWKS, preventing redirected destinations from being treated as trusted key sources. See `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`\_\_. - Limit repeated JWKS refreshes caused by unknown key IDs while preserving normal key-rotation behavior. See `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`\_\_. - Handle deeply nested and malformed JWS/JWK input without uncaught recursion errors or whole-set parsing failures. See `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`\_\_ and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`\_\_. - Enforce compact JWS encoding rules during decoding. See `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`\_\_. - Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n <https://github.com/xclow3n>`\_\_ for reporting this behavior; fixed in commit `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`\_\_. Fixed ``` - Apply HMAC key validation consistently when keys are loaded through ``PyJWK`` and ``PyJWKClient``. See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__. - Reject empty HMAC keys when represented as JWKs. See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__. Fixed ``` - Raise the documented `PyJWTError` subclass instead of leaking a `TypeError` when the `exp`, `nbf`, or `iat` claim decodes to a non-numeric, non-string value such as a list, dict, or `null`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added the

dependencies

label

2026-09-13 03:02:59 +00:00

renovate added 1 commit

2026-09-13 03:02:59 +00:00