Problem with PyJWT 2.10: Subject must be a string

[amotl]

Bug description

When setting up a fresh sandbox environment, PyJWT 2.10 gets installed, released on Nov 17, i.e. three days ago. That breaks a little integration test suite we are running ¹. This is the exception being raised:

AssertionError: {'msg': 'Subject must be a string'}

When downgrading to use pyjwt<2.10, the test suite succeeds again.

You may want to accompany this by potentially adjusting dependencies or code in Apache Superset?

Superset version

3.x and 4.x

Additional context

The software test suite maintained here can be used to reproduce the problem.

• https://github.com/crate/cratedb-examples/tree/main/application/apache-superset

We added relevant details to this ticket, where we started to investigate this issue.

• Software tests start failing with Apache Superset 3.x/4.x and PyJWT 2.10 crate/cratedb-examples#741

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

Footnotes

1. ... which orchestrates CLI invocations of the superset program and HTTP calls to the Superset API, in order to validate it works well together with CrateDB. ↩

[amotl]

We just found this is most likely the root cause.

• sub must be a string now? jpadilla/pyjwt#1017

The canonical recommendation is to downgrade to PyJWT in the meanwhile.

pip install 'pyjwt<2.10'

[amotl]

That patch submitted by Dependabot also demonstrates the problem.

• Update pyjwt requirement from <2.10 to <2.11 in /application/apache-superset crate/cratedb-examples#744

[amotl]

@jkogut: Do you have any idea why only we might be affected, but Superset's test suite seems to still succeed, and nobody else seems to be tripped? Is it related to the value of the SECRET_KEY maybe?