Repository navigation
fix: bump PyJWT to 2.15.1 (24 Dependabot alerts, 10 Trivy findings) - #43
Merged
Merged
Conversation
PyJWT <=2.14.0 is affected by, among others: asymmetric-PEM detection bypass (critical), BOM bypass, public JWK / DER keys accepted as HMAC secrets, empty HMAC keys accepted via PyJWK, JWKS redirect following, RecursionError DoS on nested headers and pre-verification parsing, non-canonical signature revocation bypass, is_pem_format ReDoS and JWKS fetch amplification. 2.14.0 fixes most; 2.15.0 is required for the pre-verification RecursionError (Dependabot #147/#159). 2.15.1 is the latest release. - api/requirements.txt: PyJWT 2.13.0 -> 2.15.1 - requirements/production.txt: PyJWT 2.13.0 -> 2.15.1 Usage in Cast-o is jwt.encode / jwt.decode with HS256 only (no PyJWKClient); short test secrets raise InsecureKeyLengthWarning, not an error. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
🚦 48h Operativity: NO-GO
|
Contributor
🤖 Análisis Automático IAClaude — Revisión de códigoMistral — Documentación generada
|
Contributor
🔒 Docker Security AuditStatus: success Resumen Rápido
Acciones si hay problemas
|
Contributor
Contributor
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Qué y por qué
Cierra las 24 alertas de Dependabot abiertas (#136–#159; 2 críticas, 10 altas, 12 medias) y los 10 hallazgos de Trivy en code scanning (#104–#113). Todos corresponden a PyJWT 2.13.0.
api/requirements.txt:PyJWT==2.13.0→PyJWT==2.15.1requirements/production.txt:PyJWT==2.13.0→PyJWT==2.15.12.14.0 corrige la mayoría. 2.15.0 es necesaria para el RecursionError en el parseo previo a la verificación (#147/#159). 2.15.1 es la última versión publicada.
Evidencia
jwt.encode/jwt.decodecon HS256 (api/middleware/security.py,api/routers/auth.py,api/security/rbac.py); no se usaPyJWKClient.encode/decodeHS256 funcionan. Las claves cortas (comotest-secreten los tests) solo generanInsecureKeyLengthWarning, y pytest no convierte los avisos en errores.Riesgos e impacto
Bajo: subida menor dentro de 2.x, sin cambios de API en el uso actual.
Reversibilidad
git revertdel commit.🤖 Generated with Claude Code