From f5105bbe4f6d440b429c5191f7bd808527512b31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gregorio=20J=20Jim=C3=A9nez=20Bodes?= <202805065+Traky12@users.noreply.github.com> Date: Wed, 30 Sep 2026 20:56:05 +0200 Subject: [PATCH] fix: bump PyJWT to 2.15.1 (24 Dependabot alerts, 10 Trivy findings) PyJWT <=2.14.0 is affected by, among others: asymmetric-PEM detection bypass (critical), BOM bypass, public JWK / DER keys accepted as HMAC secrets, empty HMAC keys accepted via PyJWK, JWKS redirect following, RecursionError DoS on nested headers and pre-verification parsing, non-canonical signature revocation bypass, is_pem_format ReDoS and JWKS fetch amplification. 2.14.0 fixes most; 2.15.0 is required for the pre-verification RecursionError (Dependabot #147/#159). 2.15.1 is the latest release. - api/requirements.txt: PyJWT 2.13.0 -> 2.15.1 - requirements/production.txt: PyJWT 2.13.0 -> 2.15.1 Usage in Cast-o is jwt.encode / jwt.decode with HS256 only (no PyJWKClient); short test secrets raise InsecureKeyLengthWarning, not an error. Co-Authored-By: Claude Opus 5.5 --- api/requirements.txt | 2 +- requirements/production.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/api/requirements.txt b/api/requirements.txt index 10586730..7cbf7a72 100644 --- a/api/requirements.txt +++ b/api/requirements.txt @@ -3,7 +3,7 @@ uvicorn==0.34.2 pydantic==2.11.1 cryptography==50.0.0 cffi>=1.15.0 # required by cryptography (environment fix) -PyJWT==2.13.0 +PyJWT==2.15.1 web3==7.15.0 reportlab==4.4.10 qrcode[pil]==8.1 diff --git a/requirements/production.txt b/requirements/production.txt index cc922922..9c3d7aa3 100644 --- a/requirements/production.txt +++ b/requirements/production.txt @@ -6,7 +6,7 @@ paho-mqtt==2.1.0 tenacity==8.5.0 redis==5.1.1 psycopg2-binary==2.9.9 -PyJWT==2.13.0 +PyJWT==2.15.1 slowapi==0.1.9 web3==7.15.0 reportlab==4.4.10