Update all non-major dependencies by renovate[bot] · Pull Request #1110 · pixee/codemodder-python

renovate · 2025-12-05T21:11:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
flask-wtf (changelog)	`~=1.2.0` → `~=1.3.0`	project.optional-dependencies	minor
jsonschema (changelog)	`~=4.25.0` → `~=4.26.0`	project.optional-dependencies	minor
libcst (changelog)	`>=1.8,<1.9` → `>=1.9,<1.10`	project.dependencies	minor
lxml (source, changelog)	`>=6.0.0,<6.1.0` → `>=6.1.3,<6.2.0`	project.optional-dependencies	minor
pyjwt	`~=2.10.0` → `~=2.15.1`	project.optional-dependencies	minor
pylint (changelog)	`>=4,<4.1` → `>=4,<4.2`	project.dependencies	minor
pytest-mock (changelog)	`>=3.15,<3.16` → `>=3.16,<3.17`	project.optional-dependencies	minor
python	`3.14` → `3.15`	uses-with	minor
python-json-logger	`~=4.0.0` → `~=4.2.0`	project.dependencies	minor
requests (changelog)	`~=2.32.1` → `~=2.34.2`	project.optional-dependencies	minor
semgrep (changelog)	`>=1.144,<1.145` → `>=1.180,<1.181`	project.optional-dependencies	minor
tomlkit	`~=0.13.0` → `~=0.15.1`	project.dependencies	minor
types-defusedxml (changelog)	`==0.7.0.20250822` → `==0.7.0.20260504`	project.optional-dependencies	patch
types-wtforms (changelog)	`==3.2.1.20250809` → `==3.2.1.20260518`	project.optional-dependencies	patch

Release Notes

python-jsonschema/jsonschema (jsonschema)

`v4.26.0`

Compare Source

=======

Decrease import time by delaying importing of urllib.request (#1416).

Instagram/LibCST (libcst)

`v1.9.0`

Compare Source

Added

Add support for Python 3.15 by @AlexWaygood and @thatch in #1454 and #1456
Add CodemodCommand helpers for adding and removing imports by @frvnkliu in #1432

Fixed

Recognize Python 3.14 parser configurations by @bowiechen in #1452
Allow a trailing comma after **rest in class patterns by @itamaro in #1438

Updated

Document the new CodemodCommand import helpers by @frvnkliu in #1437
Fix the tokenize function's docstring grammar by @galenseilis in #1434
Remove the retired macOS 13 runner from CI by @drinkmorewaterr in #1433

New Contributors

@AlexWaygood made their first contribution in #1454
@bowiechen made their first contribution in #1452
@galenseilis made their first contribution in #1434

Full Changelog: Instagram/LibCST@v1.8.6...v1.9.0

lxml/lxml (lxml)

`v6.1.3`

Compare Source

==================

Bugs fixed

LP#2165901: External parameter entity parsing was allowed by default
(with resolve_entities="internal").
Issue found by Tomer Fichman.

`v6.1.2`

Compare Source

==================

GH#526: Some build files were missing in the sdist.
Patch by Nicola Soranzo.
Some minor corrections for error handling cases.

Other changes

Built with Cython 3.2.9.

`v6.1.1`

Compare Source

==================

Bugs fixed

The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
GHSA-4jhm-jv67-739f
The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.
The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

`v6.1.0`

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
in lxml.html.defs. This allows lxml_html_clean to pass them through.
Patch by oomsveta.
The default chunk size for reading from file-likes in iterparse() is now configurable
with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for
iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
when using these parsers without setting this option explicitly.
The default was now changed to 'internal' only (as for the normal XML and HTML parsers
since lxml 5.0).
Issue found by Sihao Qiu as CVE-2026-41066.

jpadilla/pyjwt (pyjwt)

`v2.15.1`

Compare Source

`v2.15.0`

Compare Source

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`#&#8203;1209 <https://github.com/jpadilla/pyjwt/issues/1209>`__).

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__
-----------------------------------------------------------------------

Security

Wrap recursion errors from deeply nested JWT payloads in DecodeError
instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `#&#8203;1202 <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
#1208 <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
#1208 <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Wrap ``http.client.HTTPException`` (e.g. ``IncompleteRead`` from a
  truncated response) in ``PyJWKClient.fetch_data`` as
  ``PyJWKClientConnectionError``, matching the other network failure
  modes the method already documents.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security

Harden HMAC key validation against public-key material supplied as JWK,
JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>,
GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>.
Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
redirected destinations from being treated as trusted key sources. See
GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
Limit repeated JWKS refreshes caused by unknown key IDs while preserving
normal key-rotation behavior. See
GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
Handle deeply nested and malformed JWS/JWK input without uncaught recursion
errors or whole-set parsing failures. See
GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
Enforce compact JWS encoding rules during decoding. See
GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed


- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__
-----------------------------------------------------------------------

Security

Reject JWK JSON documents passed as raw HMAC secrets in
HMACAlgorithm.prepare_key to close an algorithm-confusion gap that
the existing PEM/SSH guard did not cover. Reported by @aradona91 in
GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>__.
Bind the JWT header alg to PyJWK.algorithm_name during
verification so the caller's algorithms=[...] allow-list cannot be
bypassed when decoding with a PyJWK / PyJWKClient key. Reported
by @sushi-gif in GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>__.
Reject non-http(s) URI schemes in PyJWKClient so attacker-
influenced URIs cannot read local files or reach unintended schemes via
urllib's default file:// / ftp:// / data: handlers. Reported
by @KEIJOT in GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>__.
Preserve the cached JWK Set on fetch errors in PyJWKClient.fetch_data.
The previous finally-block put(None) pattern cleared the cache
on any transient outage, turning one bad JWKS request into application-
wide auth failure. Reported by @eddieran in GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>__.
Skip the unconditional base64 decode of the compact-form payload segment
when b64=false is set in the protected header, and require that
segment to be empty (RFC 7515 Appendix F detached form). Closes an
unauthenticated DoS amplifier. Reported by @thesmartshadow in
GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>__.

Fixed


- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``"b64"`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups by @kurtmckee in #1152 <https://github.com/jpadilla/pyjwt/pull/1152>__

`v2.14.0`

Compare Source

See the 2.14.0 changelog for the complete release details and related security advisories.

`v2.13.0`

Compare Source

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @aradona91.
GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @sushi-gif.
GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @thesmartshadow.
GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @KEIJOT.
GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @eddieran.

Fixed

Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @SnailSploit and @spartan8806 for the reports.
Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @WLUB for the report.
RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups, by @kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

`v2.12.1`

Compare Source

Changed


- Migrate the ``dev``, ``docs``, and ``tests`` package extras to dependency groups by @kurtmckee in `#&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>`__

`v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>`__
------------------------------------------------------------------------

Fixed
~~~~~

- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Annotate PyJWKSet.keys for pyright by @tamird in `#&#8203;1134 <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `#&#8203;1133 <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @akx in `#&#8203;1143 <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `#&#8203;1148 <https://github.com/jpadilla/pyjwt/pull/1148>`__

Added
~~~~~

- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @kurtmckee in `#&#8203;1105 <https://github.com/jpadilla/pyjwt/pull/1105>`__
- Validate key against allowed types for Algorithm family in `#&#8203;964 <https://github.com/jpadilla/pyjwt/pull/964>`__
- Add iterator for JWKSet in `#&#8203;1041 <https://github.com/jpadilla/pyjwt/pull/1041>`__
- Validate `iss` claim is a string during encoding and decoding by @pachewise in `#&#8203;1040 <https://github.com/jpadilla/pyjwt/pull/1040>`__
- Improve typing/logic for `options` in decode, decode_complete by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Declare float supported type for lifespan and timeout by @nikitagashkov in `#&#8203;1068 <https://github.com/jpadilla/pyjwt/pull/1068>`__
- Fix ``SyntaxWarning``\s/``DeprecationWarning``\s caused by invalid escape sequences by @kurtmckee in `#&#8203;1103 <https://github.com/jpadilla/pyjwt/pull/1103>`__
- Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in `#&#8203;1114 <https://github.com/jpadilla/pyjwt/pull/1114>`__
- Development: Test type annotations across all supported Python versions,
  increase the strictness of the type checking, and remove the mypy pre-commit hook
  by @kurtmckee in `#&#8203;1112 <https://github.com/jpadilla/pyjwt/pull/1112>`__

Added
~~~~~

- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Prevent partial matching of `iss` claim by @fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__
-----------------------------------------------------------------------

Changed

Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in #975 <https://github.com/jpadilla/pyjwt/pull/975>__
Use Sequence for parameter types rather than List where applicable by @imnotjames in #970 <https://github.com/jpadilla/pyjwt/pull/970>__
Add JWK support to JWT encode by @luhn in #979 <https://github.com/jpadilla/pyjwt/pull/979>__
Encoding and decoding payloads using the none algorithm by @jpadilla in #c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>__

Before:

.. code-block:: pycon

import jwt
jwt.encode({"payload": "abc"}, key=None, algorithm=None)

After:

.. code-block:: pycon

import jwt
jwt.encode({"payload": "abc"}, key=None, algorithm="none")
Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in #1005 <https://github.com/jpadilla/pyjwt/pull/1005>__
Refactor project configuration files from setup.cfg to pyproject.toml by @cleder in #995 <https://github.com/jpadilla/pyjwt/pull/995>__
Ruff linter and formatter changes by @gagandeepp in #1001 <https://github.com/jpadilla/pyjwt/pull/1001>__
Drop support for Python 3.8 (EOL) by @kkirsche in #1007 <https://github.com/jpadilla/pyjwt/pull/1007>__

Fixed


- Encode EC keys with a fixed bit length by @etianen in `#&#8203;990 <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @kurtmckee in `#&#8203;977 <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @pachewise in `#&#8203;974 <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @RbnRncn in `#&#8203;982 <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @pachewise in `#&#8203;986 <https://github.com/jpadilla/pyjwt/pull/986>`__
- Fix ``test_utils.py`` not to xfail by @pachewise in `#&#8203;987 <https://github.com/jpadilla/pyjwt/pull/987>`__
- Docs: Correct `jwt.decode` audience param doc expression by @peter279k in `#&#8203;994 <https://github.com/jpadilla/pyjwt/pull/994>`__

Added

Add support for python 3.13 by @hugovk in #972 <https://github.com/jpadilla/pyjwt/pull/972>__
Create SECURITY.md by @auvipy and @jpadilla in #973 <https://github.com/jpadilla/pyjwt/pull/973>__
Docs: Add PS256 encoding and decoding usage by @peter279k in #992 <https://github.com/jpadilla/pyjwt/pull/992>__
Docs: Add API docs for PyJWK by @luhn in #980 <https://github.com/jpadilla/pyjwt/pull/980>__
Docs: Add EdDSA algorithm encoding/decoding usage by @peter279k in #993 <https://github.com/jpadilla/pyjwt/pull/993>__
Include checkers and linters for pyproject.toml in pre-commit by @cleder in #1002 <https://github.com/jpadilla/pyjwt/pull/1002>__
Docs: Add ES256 decoding usage by @Gautam-Hegde in #1003 <https://github.com/jpadilla/pyjwt/pull/1003>__

`v2.12.0`

Compare Source

Security

Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1132
chore(docs): fix docs build by @tamird in #1137
Annotate PyJWKSet.keys for pyright by @tamird in #1134
fix: close HTTPError to prevent ResourceWarning on Python 3.14 by @veeceey in #1133
chore: remove superfluous constants by @tamird in #1136
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1135
chore(tests): enable mypy by @tamird in #1138
Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #1142
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1141
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1145
fix: do not store reference to algorithms dict on PyJWK by @akx in #1143
Use PyJWK algorithm when encoding without explicit algorithm by @jpadilla in #1148

New Contributors

@tamird made their first contribution in #1137
@veeceey made their first contribution in #1133

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

`v2.11.0`

Compare Source

Fixed


Added

pylint-dev/pylint (pylint)

`v4.1.3`

Compare Source

What's new in Pylint 4.1.3?

Release date: 2026-10-11

False Positives Fixed

Fixed a false positive for attribute-defined-outside-init when an
attribute is assigned inside the setter of an old-style, non-decorator
property(fget, fset) call. The decorator form (@property /
@x.setter) was already exempted by the fix for #409; the classic
call form was not.

Closes #3325
Fix a false positive for used-before-assignment when a name bound by an earlier
target of the same assignment is used by a later target, as in a = b[a] = 0.

Closes #5955
Fix a no-member false positive in a comprehension inside a branch that
cannot run, such as if sys.platform == "win32": on Linux. Like the rest of
the branch, the comprehension is no longer checked for missing members.

Closes #7240
Fix a false positive for used-before-assignment when a name bound by a tuple
or list target of a with item is used by a later item of the same with statement.

Closes #7545
Fix false positives such as not-callable, not-an-iterable,
unpacking-non-sequence and no-member on the result of a function whose
body is only ..., like @overload and .pyi stubs. Such calls were
inferred as returning None. This affected sqlalchemy.func,
pydantic.Field, and the torch functions wrapped by _add_docstr,
such as torch.linalg.qr.

Closes #8138
Closes #9218
Closes #9354
Closes #10087
Fix a false positive for protected-access when a subclass of a subscripted
generic base, such as class Child(Parent[T]), accesses a protected member
through that base, such as Parent._foo(self).

Closes #8600
Avoid emitting unreachable for a yield immediately after raise or
sys.exit() that marks a function as a generator, matching the existing
handling of return.

Closes #8909
Fix a false positive for super-init-not-called in .pyi stub files, where
every __init__ body is ... and cannot call the parent's __init__.

Closes #9096
Fix a false positive for possibly-used-before-assignment when a lambda
uses its parameters, including from a nested lambda, and that name is assigned
later in the module.

Closes #9126
Fix a false positive for useless-parent-delegation when a keyword-only
parameter is passed to the parent under the same keyword but with a different value.

Closes #9226
Fix a false positive for unused-argument in .pyi stub files, where
function bodies are ... and cannot use their arguments.

Closes #9417
Fix a false positive for used-before-assignment when a name assigned with an
assignment expression in the condition of a comprehension is used in its element,
for example [y for x in data if (y := f(x))].

Closes #9460
Fixed false positive arguments-differ and signature-differs for
typing.overload stubs. Overload stubs in a subclass are no longer compared
to the overridden method, and an overridden method with overloads is compared
through its implementation instead of its first stub.

Closes #10186
Closes #5264
Stop emitting redefined-variable-type when the bare _ variable is
reused to discard values of different types.

Closes #10374
Allow the __main__ module name in the camelCase, PascalCase and
UPPER_CASE naming styles without reporting invalid-name.

Closes #10442
Fixed a false positive for unexpected-keyword-arg when a decorator that
returns its argument unchanged is stacked above a decorator accepting **kwargs.

Closes #10831
Fix invalid-name false positives for module-level all-caps aliases that
preserve the name of an external callable.

Closes #11012
redefined-builtin no longer warns for method parameters that retain a
built-in name from an overridden method.

Closes #11438
Fixed a false positive for useless-suppression of line-too-long when a # inside a string literal comes before the # pylint: disable=line-too-long comment.

Closes #11440
Fix a false positive for unnecessary-ellipsis when an ellipsis is the
sole body statement of a Protocol method defined inside a conditional block
such as if TYPE_CHECKING:.

Closes #11459
Fix a false positive for unnecessary-negation when negating a comparison
between instances of a set or frozenset subclass.

Refs #11513

Other Bug Fixes

Fix pyreverse hanging or crashing with a RecursionError when
--all-associated (-S) follows an attribute whose inferred class is rebuilt by
astroid on every inference, such as a numpy array.

Closes #3602
Fix a crash in pyreverse when a diagram includes a class created by
namedtuple, or an argparse.Namespace.

Closes #10767
The "difference" column of the "Messages by category" and "Duplication" reports
(--reports=y) now shows the change since the previous run instead of repeating
the previous count.

Closes #11520
Fixed nested-min-max suggesting a non-equivalent rewrite when an inner
min/max call had multiple arguments.

Refs #11593
Using several output formats that all write to stdout (for example --output-format=colorized,no-header)
now raises an error instead of printing every message more than once.

Closes #11597
Fixed an IndexError crash in the typecheck checker when an Enum class defines an __init__ method without arguments.

Closes #11608
Fix a crash in the duplicate-code checker when min-similarity-lines is set to 0.
The checker is now disabled in that case, as documented.

Closes #11625

`v4.1.2`

Compare Source

What's new in Pylint 4.1.2?

Release date: 2026-10-03

False Positives Fixed

Fixed a false positive unbalanced-tuple-unpacking when unpacking a tuple
concatenation whose elements have several possible values.

Fixed by upgrading astroid to 4.3.3.

Closes #2621

Other Bug Fixes

Fixed a crash when calling __bases__ on a class.

Fixed by upgrading astroid to 4.3.3.

Closes #11491
Fix a crash (astroid-error) when the class of a called attribute cannot
be fully inferred, for example when the attribute is used as a with
statement target or inside a comprehension.

Closes #11492
Fix a crash when a name bound by a type statement (a TypeVar) is used in a with statement.

Closes #11510
Fixed a crash (TypeError) in the variables checker when checking a class
whose metaclass name binding has no line number, for example a class defined
with metaclass=__annotations__.

Closes #11511
Fix a crash in the using-final-decorator-in-unsupported-version check
when import final is used.

Closes #11521
Fix a crash when a plugin passes confidence=None to add_message, as
pylint-pytest does, for a message that is disabled. confidence=None is
accepted again and means UNDEFINED, like in pylint 4.0. Passing it
explicitly to add_message, add_ignored_message or Message now emits a
DeprecationWarning: it will raise an error in pylint 5.0.

Closes #11530

`v4.1.1`

Compare Source

What's new in Pylint 4.1.1?

Release date: 2026-09-29

Other Changes

Pylint 4.1.0 could not be uploaded to PyPI, because it required an unreleased
version of dill on Python 3.15, and PyPI refuses such a dependency. 4.1.1 is
the first 4.1 release available on PyPI, see the 4.1.0 changes below.

Refs #11495

pytest-dev/pytest-mock (pytest-mock)

`v3.16.0`

Compare Source

2026-09-27

#604 <https://github.com/pytest-dev/pytest-mock/pull/604>_: Fixed duplicate_iterators=True for async functions spied with mocker.spy.
#611 <https://github.com/pytest-dev/pytest-mock/pull/611>_: Fixed async mock assertion introspection to use awaited arguments instead of the latest call's arguments.
#606 <https://github.com/pytest-dev/pytest-mock/pull/606>_: mocker.resetall(return_value=True, side_effect=True) now also applies to non-callable mocks, such as those returned by mocker.create_autospec(SomeClass, instance=True). Previously both arguments were silently ignored for them.
#547 <https://github.com/pytest-dev/pytest-mock/issues/547>_: Added SpyType for annotating mocker.spy results.
Dropped support for EOL Python 3.9.
#147 <https://github.com/pytest-dev/pytest-mock/issues/147>_: Removed handling of RuntimeError: stop called on unstarted patcher, which can no longer occur in the supported Python versions.
Added support for Python 3.15.

actions/python-versions (python)

`v3.15.0`: 3.15.0

Compare Source

Python 3.15.0

nhairs/python-json-logger (python-json-logger)

`v4.2.0`: 4.2.0

Compare Source

Changed

Logging a dict no longer modifies it. exc_info and stack_info were previously added to the caller's dict. #66
Move development dependencies from project.optional-dependencies.dev to [dependency-groups].dev (PEP 735). #46

Fixed

$ style formats now support unbraced $name fields, not just ${name}. #18

Thanks @gaoflow, @prateek-dagar, @Sanjays2402

`v4.1.0`: 4.1.0

Compare Source

Added

Add support for Python 3.14, PyPy 3.11

Removed

Remove support for Python 3.8, 3.9 (includes PyPy versions).

psf/requests (requests)

`v2.34.2`

Compare Source

Moved headers input type back to Mapping to avoid invariance issues
with MutableMapping and inferred dict types. Users calling
Request.headers.update() may need to narrow typing in their code. (#7441)

`v2.34.1`

Compare Source

Bugfixes

Widened json input type from dict and list to Mapping
and Sequence. (#7436)
Changed headers input type to MutableMapping and removed None from
Request.headers typing to improve handling for users. (#7431)
Response.reason moved from str | None to str to improve handling
for users. (#7437)
Fixed a bug where some bodies with custom __getattr__ implementations
weren't being properly detected as Iterables. (#7433)

`v2.34.0`

Compare Source

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for
helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify
security considerations. (#7310)
Requests added support for Python 3.15 based on beta1. Downstream projects
should be able to start testing prior to its release in October. (#7422)
Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing
accidental looping when traversing the history list. (#7328)
Requests no longer performs greedy matching on no_proxy domains. The
proxy_bypass implementation has been updated with CPython's fix from
bpo-39057. (#7427)
Requests no longer incorrectly strips duplicate leading slashes in
URI paths. This should address user issues with specific presigned
URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

`v2.33.1`

Compare Source

Bugfixes

Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
f

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-05-10T21:08:09Z