Repository navigation
fix(deps): bump PyJWT, urllib3 and oauthlib to patched releases - #365
Merged
Merged
Conversation
pip-audit and Trivy now fail on every PR to dev because advisories were published after the last lock refresh: - PyJWT 2.13.0 -> 2.15.0 (CVE-2026-102265..102274 incl. a CRITICAL auth bypass, CVE-2026-101917, CVE-2026-101918) - urllib3 2.7.0 -> 2.8.0 (CVE-2026-97687..97689) - oauthlib 3.3.1 -> 4.0.0 (CVE-2026-49265) Only the affected packages are upgraded; every other pin is unchanged. The locks were regenerated with scripts/lock_dependencies.py under CPython 3.11 on Linux and pass its --check mode. Signed-off-by: parthrohit22 <parthrohit60@gmail.com>
TFT444
approved these changes
Sep 30, 2026
TFT444
left a comment
TFT444
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed diff line by line. All three lock files updated consistently, hashes are correct, upgrade is surgical (no other pins changed).
PyJWT 2.15.0 fixes a CRITICAL auth bypass (CVE-2026-102268) in the OIDC bearer-token path OpenShield uses. urllib3 and oauthlib fixes are clean. oauthlib 4.0.0 is a major bump but nothing in the repo imports it directly and the full suite passes.
DCO present. Supersedes Dependabot PR #366 (same files) — close that one after merge.
Approving.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Bumps three runtime dependencies to releases that fix newly published advisories. SCA (pip-audit) and Container Scan (Trivy) fail on every PR to
devtoday, so nothing can merge.devpassed CI on Sep 29, so the advisories are new.PyJWT is the dependency behind the OIDC bearer-token verification (#294), so that one is worth shipping on its own merits.
Type of change
How
--upgrade-package), not a blanket--upgrade, so every other pin and hash is unchanged. The diff is 12 lines in each lock.requirements.inpins PyJWT directly, so that line changes too. urllib3 and oauthlib are transitive.scripts/lock_dependencies.pytooling under CPython 3.11 on Linux (the supported target), andlock_dependencies.py --checkreports they match their inputs.Testing
pip-auditonrequirements.txtandrequirements-dev.txt: no known vulnerabilities--require-hashes --only-binary=:all:on CPython 3.11:pip checkis clean, versions are 2.15.0 / 2.8.0 / 4.0.0pytest tests/with PostgreSQL: 1480 passed, 3 skippedoauthlib is a major-version bump. Nothing in the repo imports it directly; it arrives through
requests-oauthlib. The full suite andpip checkpass with it.Related issue
Unblocks CI for the open PRs (for example #364).
Checklist
Signed-off-bytrailer