Update dependency pyjwt to v2 #89

mend-for-github-com · 2022-11-08T19:19:57Z

This PR contains the following updates:

Package	Update	Change
pyjwt	major	`==1.7.1` -> `==2.4.0`

By merging this PR, the issue #68 will be automatically resolved and closed:

Severity	CVSS Score	CVE
High	7.5	CVE-2022-29217

Release Notes

jpadilla/pyjwt

`v2.4.0`

Compare Source

Changed


- Skip keys with incompatible alg when loading JWKSet by @&#8203;DaGuich in `#&#8203;762 <https://github.com/jpadilla/pyjwt/pull/762>`__
- Remove support for python3.6 by @&#8203;sirosen in `#&#8203;777 <https://github.com/jpadilla/pyjwt/pull/777>`__
- Emit a deprecation warning for unsupported kwargs by @&#8203;sirosen in `#&#8203;776 <https://github.com/jpadilla/pyjwt/pull/776>`__
- Remove redundant wheel dep from pyproject.toml by @&#8203;mgorny in `#&#8203;765 <https://github.com/jpadilla/pyjwt/pull/765>`__
- Do not fail when an unusable key occurs by @&#8203;DaGuich in `#&#8203;762 <https://github.com/jpadilla/pyjwt/pull/762>`__
- Update audience typing by @&#8203;JulianMaurin in `#&#8203;782 <https://github.com/jpadilla/pyjwt/pull/782>`__
- Improve PyJWKSet error accuracy by @&#8203;JulianMaurin in `#&#8203;786 <https://github.com/jpadilla/pyjwt/pull/786>`__
- Mypy as pre-commit check + api_jws typing by @&#8203;JulianMaurin in `#&#8203;787 <https://github.com/jpadilla/pyjwt/pull/787>`__

Fixed
~~~~~

- Adjust expected exceptions in option merging tests for PyPy3 by @&#8203;mgorny in `#&#8203;763 <https://github.com/jpadilla/pyjwt/pull/763>`__
- Fixes for pyright on strict mode by @&#8203;brandon-leapyear in `#&#8203;747 <https://github.com/jpadilla/pyjwt/pull/747>`__
- docs: fix simple typo, iinstance -> isinstance by @&#8203;timgates42 in `#&#8203;774 <https://github.com/jpadilla/pyjwt/pull/774>`__
- Fix typo: priot -> prior by @&#8203;jdufresne in `#&#8203;780 <https://github.com/jpadilla/pyjwt/pull/780>`__
- Fix for headers disorder issue by @&#8203;kadabusha in `#&#8203;721 <https://github.com/jpadilla/pyjwt/pull/721>`__

Added
~~~~~

- Add to_jwk static method to ECAlgorithm by @&#8203;leonsmith in `#&#8203;732 <https://github.com/jpadilla/pyjwt/pull/732>`__
- Expose get_algorithm_by_name as new method by @&#8203;sirosen in `#&#8203;773 <https://github.com/jpadilla/pyjwt/pull/773>`__
- Add type hints to jwt/help.py and add missing types dependency by @&#8203;kkirsche in `#&#8203;784 <https://github.com/jpadilla/pyjwt/pull/784>`__
- Add cacheing functionality for JWK set by @&#8203;wuhaoyujerry in `#&#8203;781 <https://github.com/jpadilla/pyjwt/pull/781>`__

`v2.3.0`

Compare Source

Security


- [CVE-2022-29217] Prevent key confusion through non-blocklisted public key formats. https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24

Changed
~~~~~~~

- Explicit check the key for ECAlgorithm by @&#8203;estin in https://github.com/jpadilla/pyjwt/pull/713
- Raise DeprecationWarning for jwt.decode(verify=...) by @&#8203;akx in https://github.com/jpadilla/pyjwt/pull/742

Fixed
~~~~~

- Don't use implicit optionals by @&#8203;rekyungmin in https://github.com/jpadilla/pyjwt/pull/705
- documentation fix: show correct scope for decode_complete() by @&#8203;sseering in https://github.com/jpadilla/pyjwt/pull/661
- fix: Update copyright information by @&#8203;kkirsche in https://github.com/jpadilla/pyjwt/pull/729
- Don't mutate options dictionary in .decode_complete() by @&#8203;akx in https://github.com/jpadilla/pyjwt/pull/743

Added
~~~~~

- Add support for Python 3.10 by @&#8203;hugovk in https://github.com/jpadilla/pyjwt/pull/699
- api_jwk: Add PyJWKSet.__getitem__ by @&#8203;woodruffw in https://github.com/jpadilla/pyjwt/pull/725
- Update usage.rst by @&#8203;guneybilen in https://github.com/jpadilla/pyjwt/pull/727
- Docs: mention performance reasons for reusing RSAPrivateKey when encoding by @&#8203;dmahr1 in https://github.com/jpadilla/pyjwt/pull/734
- Fixed typo in usage.rst by @&#8203;israelabraham in https://github.com/jpadilla/pyjwt/pull/738
- Add detached payload support for JWS encoding and decoding by @&#8203;fviard in https://github.com/jpadilla/pyjwt/pull/723
- Replace various string interpolations with f-strings by @&#8203;akx in https://github.com/jpadilla/pyjwt/pull/744
- Update CHANGELOG.rst by @&#8203;hipertracker in https://github.com/jpadilla/pyjwt/pull/751

`v2.2.0`

Compare Source

Fixed


- Revert "Remove arbitrary kwargs." `#&#8203;701 <https://github.com/jpadilla/pyjwt/pull/701>`__

Added

Add exception chaining #702 <https://github.com/jpadilla/pyjwt/pull/702>__

`v2.1.0`

Compare Source

Changed


- Remove arbitrary kwargs. `#&#8203;657 <https://github.com/jpadilla/pyjwt/pull/657>`__
- Use timezone package as Python 3.5+ is required. `#&#8203;694 <https://github.com/jpadilla/pyjwt/pull/694>`__

Fixed
~~~~~
- Assume JWK without the "use" claim is valid for signing as per RFC7517 `#&#8203;668 <https://github.com/jpadilla/pyjwt/pull/668>`__
- Prefer `headers["alg"]` to `algorithm` in `jwt.encode()`. `#&#8203;673 <https://github.com/jpadilla/pyjwt/pull/673>`__
- Fix aud validation to support {'aud': null} case. `#&#8203;670 <https://github.com/jpadilla/pyjwt/pull/670>`__
- Make `typ` optional in JWT to be compliant with RFC7519. `#&#8203;644 <https://github.com/jpadilla/pyjwt/pull/644>`__
-  Remove upper bound on cryptography version. `#&#8203;693 <https://github.com/jpadilla/pyjwt/pull/693>`__

Added
~~~~~

- Add support for Ed448/EdDSA. `#&#8203;675 <https://github.com/jpadilla/pyjwt/pull/675>`__

`v2.0.1`

Compare Source

Changed


- Allow claims validation without making JWT signature validation mandatory. `#&#8203;608 <https://github.com/jpadilla/pyjwt/pull/608>`__

Fixed
~~~~~

- Remove padding from JWK test data. `#&#8203;628 <https://github.com/jpadilla/pyjwt/pull/628>`__
- Make `kty` mandatory in JWK to be compliant with RFC7517. `#&#8203;624 <https://github.com/jpadilla/pyjwt/pull/624>`__
- Allow JWK without `alg` to be compliant with RFC7517. `#&#8203;624 <https://github.com/jpadilla/pyjwt/pull/624>`__
- Allow to verify with private key on ECAlgorithm, as well as on Ed25519Algorithm. `#&#8203;645 <https://github.com/jpadilla/pyjwt/pull/645>`__

Added
~~~~~

- Add caching by default to PyJWKClient `#&#8203;611 <https://github.com/jpadilla/pyjwt/pull/611>`__
- Add missing exceptions.InvalidKeyError to jwt module __init__ imports `#&#8203;620 <https://github.com/jpadilla/pyjwt/pull/620>`__
- Add support for ES256K algorithm `#&#8203;629 <https://github.com/jpadilla/pyjwt/pull/629>`__
- Add `from_jwk()` to Ed25519Algorithm `#&#8203;621 <https://github.com/jpadilla/pyjwt/pull/621>`__
- Add `to_jwk()` to Ed25519Algorithm `#&#8203;643 <https://github.com/jpadilla/pyjwt/pull/643>`__
- Export `PyJWK` and `PyJWKSet` `#&#8203;652 <https://github.com/jpadilla/pyjwt/pull/652>`__

`v2.0.0`

Compare Source

Changed


- Rename CHANGELOG.md to CHANGELOG.rst and include in docs `#&#8203;597 <https://github.com/jpadilla/pyjwt/pull/597>`__

Fixed
~~~~~

- Fix `from_jwk()` for all algorithms `#&#8203;598 <https://github.com/jpadilla/pyjwt/pull/598>`__

Added
~~~~~

If you want to rebase/retry this PR, check this box

Sync with Original

Sync w/ Original

Configure WhiteSource for GitHub.com

Sync with upstream master

Sync w/ Master

Sync with Brightcove-qa

bc-jcarlson and others added 11 commits February 2, 2021 13:38

Update .gitignore to add venv dir for python virtual envs

7718d11

Merge branch 'cloud-custodian:master' into brightcove

27b2be3

Merge pull request #1 from cloud-custodian/master

845cd4e

Sync with Original

Merge pull request #2 from cloud-custodian/master

34c8c30

Sync w/ Original

Add .whitesource configuration file

b7e63f4

Merge pull request #4 from brightcove/whitesource/configure

867b463

Configure WhiteSource for GitHub.com

Merge pull request #39 from cloud-custodian/master

6405535

Sync with upstream master

Merge branch 'brightcove-qa' into master

d0c4506

Merge pull request #40 from brightcove/master

23a8423

Sync w/ Master

Merge pull request #41 from brightcove/brightcove-qa

ef20b41

Sync with Brightcove-qa

Update dependency pyjwt to v2

4e21bec

mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Nov 8, 2022

bc-jcarlson force-pushed the brightcove branch 2 times, most recently from ef20b41 to 145c11f Compare June 20, 2023 20:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency pyjwt to v2 #89

Update dependency pyjwt to v2 #89

mend-for-github-com bot commented Nov 8, 2022 •

edited

Loading

Update dependency pyjwt to v2 #89

Are you sure you want to change the base?

Update dependency pyjwt to v2 #89

Conversation

mend-for-github-com bot commented Nov 8, 2022 • edited Loading

Release Notes

v2.4.0

v2.3.0

v2.2.0

v2.1.0

v2.0.1

v2.0.0

mend-for-github-com bot commented Nov 8, 2022 •

edited

Loading

`v2.4.0`

`v2.3.0`

`v2.2.0`

`v2.1.0`

`v2.0.1`

`v2.0.0`