Update dependency pyjwt to v2.14.0

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
pyjwt	==2.13.0 → ==2.14.0

---

Release Notes

jpadilla/pyjwt (pyjwt)

v2.14.0

Compare Source

Changed

- ``JWKSetCache`` now stores the parsed ``PyJWKSet`` rather than the raw JWKS
  payload, so a cache hit no longer re-parses every key. ``JWKSetCache.put()``
  accepts either form and raises ``PyJWKSetError`` for anything else. As a
  result, ``PyJWKClient.get_jwk_set()`` returns the same ``PyJWKSet`` instance
  for as long as it stays cached, rather than a freshly built one per call in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.fetch_data()`` now raises
  ``PyJWKClientError("The JWKS endpoint did not return a JSON object")`` when
  the endpoint response is not a JSON object, instead of returning it for
  ``get_jwk_set()`` to reject. Callers reaching the JWKS through
  ``get_jwk_set()`` see the same error as before in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__

Fixed
~~~~~

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security

• Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
  GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>,
  GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
  and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>.
• Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
• Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
• Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
  and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
• Enforce compact JWS encoding rules during decoding. See
  GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
• Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
  37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

Fixed

• Raise the documented PyJWTError subclass instead of leaking a
  TypeError when the exp, nbf, or iat claim decodes to a
  non-numeric, non-string value such as a list, dict, or null.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This dependency-only update pins PyJWT to 2.14.0, bringing multiple security fixes and improvements to JWK/JWKS caching and parsing while tightening JWS and claim validation. Review dependency installation and the project’s relevant JWT/JWKS integration tests for compatibility, especially around changed exception behavior and stricter input rejection.

File-Level Changes

Change	Details	Files
Upgrade the pinned PyJWT dependency to receive security hardening and behavioral fixes in JWK/JWKS handling and token decoding.	Change the pinned version from 2.13.0 to 2.14.0. Review compatibility with HMAC key validation, JWKS redirects and refresh behavior, malformed-key handling, compact JWS validation, and claim-type error handling.	backend/requirements-pinned.txt

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.42%. Comparing base (b35aa46) to head (f6013f7).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1133   +/-   ##
=======================================
  Coverage   87.42%   87.42%           
=======================================
  Files          63       63           
  Lines        3737     3737           
  Branches      697      697           
=======================================
  Hits         3267     3267           
  Misses        262      262           
  Partials      208      208           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 22b3a86...f6013f7. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.