Skip to content

Bump pyjwt from 2.8.0 to 2.12.0 in /examples/blogger/web_service#1145

Merged
mbouaziz merged 1 commit into
mainfrom
dependabot/pip/examples/blogger/web_service/pyjwt-2.12.0
May 20, 2026
Merged

Bump pyjwt from 2.8.0 to 2.12.0 in /examples/blogger/web_service#1145
mbouaziz merged 1 commit into
mainfrom
dependabot/pip/examples/blogger/web_service/pyjwt-2.12.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 14, 2026

Bumps pyjwt from 2.8.0 to 2.12.0.

Release notes

Sourced from pyjwt's releases.

2.12.0

Security

What's Changed

New Contributors

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

2.11.0

What's Changed

... (truncated)

Changelog

Sourced from pyjwt's changelog.

v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>__

Fixed


- Annotate PyJWKSet.keys for pyright by @tamird in `[#1134](https://github.com/jpadilla/pyjwt/issues/1134) <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `[#1133](https://github.com/jpadilla/pyjwt/issues/1133) <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @akx in `[#1143](https://github.com/jpadilla/pyjwt/issues/1143) <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `[#1148](https://github.com/jpadilla/pyjwt/issues/1148) <https://github.com/jpadilla/pyjwt/pull/1148>`__

Added

  • Docs: Add PyJWKClient API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>__

Fixed


- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @kurtmckee in `[#1105](https://github.com/jpadilla/pyjwt/issues/1105) <https://github.com/jpadilla/pyjwt/pull/1105>`__
- Validate key against allowed types for Algorithm family in `[#964](https://github.com/jpadilla/pyjwt/issues/964) <https://github.com/jpadilla/pyjwt/pull/964>`__
- Add iterator for JWKSet in `[#1041](https://github.com/jpadilla/pyjwt/issues/1041) <https://github.com/jpadilla/pyjwt/pull/1041>`__
- Validate `iss` claim is a string during encoding and decoding by @pachewise in `[#1040](https://github.com/jpadilla/pyjwt/issues/1040) <https://github.com/jpadilla/pyjwt/pull/1040>`__
- Improve typing/logic for `options` in decode, decode_complete by @pachewise in `[#1045](https://github.com/jpadilla/pyjwt/issues/1045) <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Declare float supported type for lifespan and timeout by @nikitagashkov in `[#1068](https://github.com/jpadilla/pyjwt/issues/1068) <https://github.com/jpadilla/pyjwt/pull/1068>`__
- Fix ``SyntaxWarning``\s/``DeprecationWarning``\s caused by invalid escape sequences by @kurtmckee in `[#1103](https://github.com/jpadilla/pyjwt/issues/1103) <https://github.com/jpadilla/pyjwt/pull/1103>`__
- Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in `[#1114](https://github.com/jpadilla/pyjwt/issues/1114) <https://github.com/jpadilla/pyjwt/pull/1114>`__
- Development: Test type annotations across all supported Python versions,
  increase the strictness of the type checking, and remove the mypy pre-commit hook
  by @kurtmckee in `[#1112](https://github.com/jpadilla/pyjwt/issues/1112) <https://github.com/jpadilla/pyjwt/pull/1112>`__

Added

  • Support Python 3.14, and test against PyPy 3.10 and 3.11 by @​kurtmckee in [#1104](https://github.com/jpadilla/pyjwt/issues/1104) <https://github.com/jpadilla/pyjwt/pull/1104>__
  • Development: Migrate to build to test package building in CI by @​kurtmckee in [#1108](https://github.com/jpadilla/pyjwt/issues/1108) <https://github.com/jpadilla/pyjwt/pull/1108>__
  • Development: Improve coverage config and eliminate unused test suite code by @​kurtmckee in [#1115](https://github.com/jpadilla/pyjwt/issues/1115) <https://github.com/jpadilla/pyjwt/pull/1115>__
  • Docs: Standardize CHANGELOG links to PRs by @​kurtmckee in [#1110](https://github.com/jpadilla/pyjwt/issues/1110) <https://github.com/jpadilla/pyjwt/pull/1110>__
  • Docs: Fix Read the Docs builds by @​kurtmckee in [#1111](https://github.com/jpadilla/pyjwt/issues/1111) <https://github.com/jpadilla/pyjwt/pull/1111>__
  • Docs: Add example of using leeway with nbf by @​djw8605 in [#1034](https://github.com/jpadilla/pyjwt/issues/1034) <https://github.com/jpadilla/pyjwt/pull/1034>__
  • Docs: Refactored docs with autodoc; added PyJWS and jwt.algorithms docs by @​pachewise in [#1045](https://github.com/jpadilla/pyjwt/issues/1045) <https://github.com/jpadilla/pyjwt/pull/1045>__
  • Docs: Documentation improvements for "sub" and "jti" claims by @​cleder in [#1088](https://github.com/jpadilla/pyjwt/issues/1088) <https://github.com/jpadilla/pyjwt/pull/1088>__
  • Development: Add pyupgrade as a pre-commit hook by @​kurtmckee in [#1109](https://github.com/jpadilla/pyjwt/issues/1109) <https://github.com/jpadilla/pyjwt/pull/1109>__
  • Add minimum key length validation for HMAC and RSA keys (CWE-326). Warns by default via InsecureKeyLengthWarning when keys are below

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 14, 2026
@mbouaziz
Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot dependabot Bot changed the title build(deps): bump pyjwt from 2.8.0 to 2.12.0 in /examples/blogger/web_service Bump pyjwt from 2.8.0 to 2.12.0 in /examples/blogger/web_service May 20, 2026
@dependabot dependabot Bot force-pushed the dependabot/pip/examples/blogger/web_service/pyjwt-2.12.0 branch from 3befb08 to bd9c6ae Compare May 20, 2026 11:33
Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.8.0 to 2.12.0.

PyJWT 2.12.0 imports `Never` from `typing_extensions` unconditionally on
Python < 3.11, but doesn't declare typing_extensions as a runtime
dependency. Bumping the blogger web_service base image to
python:3.12.13-bookworm sidesteps that, since `Never` is in the stdlib
`typing` module from 3.11 onwards. psycopg2-binary 2.9.9 has cp312
wheels, so no other deps need to change.

Co-Authored-By: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@mbouaziz mbouaziz force-pushed the dependabot/pip/examples/blogger/web_service/pyjwt-2.12.0 branch from bd9c6ae to d9c22da Compare May 20, 2026 13:40
@mbouaziz mbouaziz merged commit cbe9653 into main May 20, 2026
3 checks passed
@mbouaziz mbouaziz deleted the dependabot/pip/examples/blogger/web_service/pyjwt-2.12.0 branch May 20, 2026 13:56
mbouaziz added a commit that referenced this pull request May 22, 2026
…rvice

Clears Dependabot alert #207 (GHSA-752w-5fwx-jx9f, PyJWT accepts unknown
`crit` header extensions, patched in 2.12.0). The alert was created
2026-03-14 against PyJWT==2.8.0 and never auto-closed after PRs #1144
and #1145 bumped to 2.12.0; updating to 2.13.0 (latest) re-triggers
Dependabot's scan and is itself a security release covering five
additional CVEs (JWK-as-HMAC-secret, PyJWK alg bypass, base64 DoS, etc.)
— none of which affect these apps' plain-string-secret + HS256 flow,
but worth picking up.

Bumping both web_service examples in lockstep since they were paired in
the original PyJWT 2.8.0 -> 2.12.0 bump.

Verified import + HS256 algorithm registration on Python 3.10 (system)
and 3.12 (Dockerfile base) maps to the same code path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mbouaziz added a commit that referenced this pull request May 22, 2026
…rvice

Clears Dependabot alert #207 (GHSA-752w-5fwx-jx9f, PyJWT accepts unknown
`crit` header extensions, patched in 2.12.0). The alert was created
2026-03-14 against PyJWT==2.8.0 and never auto-closed after PRs #1144
and #1145 bumped to 2.12.0; updating to 2.13.0 (latest) re-triggers
Dependabot's scan and is itself a security release covering five
additional CVEs (JWK-as-HMAC-secret, PyJWK alg bypass, base64 DoS, etc.)
— none of which affect these apps' plain-string-secret + HS256 flow,
but worth picking up.

Bumping both web_service examples in lockstep since they were paired in
the original PyJWT 2.8.0 -> 2.12.0 bump.

Verified import + HS256 algorithm registration on Python 3.10 (system)
and 3.12 (Dockerfile base) maps to the same code path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant