From 539d80b72f54b119a2848b61aa70c8b0229552ff Mon Sep 17 00:00:00 2001 From: parthrohit22 Date: Wed, 30 Sep 2026 22:48:11 +0100 Subject: [PATCH] fix(deps): bump PyJWT, urllib3 and oauthlib to patched releases pip-audit and Trivy now fail on every PR to dev because advisories were published after the last lock refresh: - PyJWT 2.13.0 -> 2.15.0 (CVE-2026-102265..102274 incl. a CRITICAL auth bypass, CVE-2026-101917, CVE-2026-101918) - urllib3 2.7.0 -> 2.8.0 (CVE-2026-97687..97689) - oauthlib 3.3.1 -> 4.0.0 (CVE-2026-49265) Only the affected packages are upgraded; every other pin is unchanged. The locks were regenerated with scripts/lock_dependencies.py under CPython 3.11 on Linux and pass its --check mode. Signed-off-by: parthrohit22 --- requirements-dev.txt | 12 ++++++------ requirements.in | 2 +- requirements.txt | 12 ++++++------ 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements-dev.txt b/requirements-dev.txt index 98bda0ad..32cdba87 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -1127,8 +1127,8 @@ multidict==6.8.0 \ --hash=sha256:fa6c2880709c84457de104385b704fc28860f27e442ad13966fc4af8e714fe9c \ --hash=sha256:fc5460940f50dff00731b4132366840ba9685286ea88ea104b661899084f3fea \ --hash=sha256:fd789a294d8e098528be29b2669b83005ce569339f8cef167fc0274c3115c34c -oauthlib==3.3.1 \ - --hash=sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1 +oauthlib==4.0.0 \ + --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd packaging==26.3 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c pluggy==1.6.0 \ @@ -1314,8 +1314,8 @@ pycparser==3.0 \ --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992 pygments==2.21.0 \ --hash=sha256:2363c69b61c4a97c838da3b130dcd6468f4848992b21a82f2a63ec34377137d9 -pyjwt==2.13.0 \ - --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728 +pyjwt==2.15.0 \ + --hash=sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8 pytest==9.1.1 \ --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c pytest-cov==7.1.0 \ @@ -1479,8 +1479,8 @@ sqlalchemy==2.0.52 \ --hash=sha256:f4d4f7afc682961dc567db70e00a7b5bd81ccd3743c46199b0257f0744902dde typing-extensions==4.16.0 \ --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 -urllib3==2.7.0 \ - --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 +urllib3==2.8.0 \ + --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 websocket-client==1.9.2 \ --hash=sha256:e1a673830a9c7bfa47b1cd3d5e4178f4c9651d80a4eab02c9c23a1c3ec6250ce werkzeug==3.1.8 \ diff --git a/requirements.in b/requirements.in index f3f4bb90..1c8abe85 100644 --- a/requirements.in +++ b/requirements.in @@ -26,7 +26,7 @@ kubernetes==36.0.0 azure-mgmt-recoveryservices==4.1.0 psycopg2-binary==2.9.9 python-dotenv==1.2.2 -pyjwt==2.13.0 +pyjwt==2.15.0 requests==2.34.2 PyYAML==6.0.3 gunicorn==26.0.0 diff --git a/requirements.txt b/requirements.txt index 85c145f4..45eb9a8a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1004,8 +1004,8 @@ multidict==6.8.0 \ --hash=sha256:fa6c2880709c84457de104385b704fc28860f27e442ad13966fc4af8e714fe9c \ --hash=sha256:fc5460940f50dff00731b4132366840ba9685286ea88ea104b661899084f3fea \ --hash=sha256:fd789a294d8e098528be29b2669b83005ce569339f8cef167fc0274c3115c34c -oauthlib==3.3.1 \ - --hash=sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1 +oauthlib==4.0.0 \ + --hash=sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd packaging==26.3 \ --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c prometheus-client==0.26.0 \ @@ -1177,8 +1177,8 @@ psycopg2-binary==2.9.9 \ --hash=sha256:f9b5571d33660d5009a8b3c25dc1db560206e2d2f89d3df1cb32d72c0d117d52 pycparser==3.0 \ --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992 -pyjwt==2.13.0 \ - --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728 +pyjwt==2.15.0 \ + --hash=sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8 python-dateutil==2.9.0.post0 \ --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427 python-dotenv==1.2.2 \ @@ -1320,8 +1320,8 @@ sqlalchemy==2.0.52 \ --hash=sha256:f4d4f7afc682961dc567db70e00a7b5bd81ccd3743c46199b0257f0744902dde typing-extensions==4.16.0 \ --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 -urllib3==2.7.0 \ - --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 +urllib3==2.8.0 \ + --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 websocket-client==1.9.2 \ --hash=sha256:e1a673830a9c7bfa47b1cd3d5e4178f4c9651d80a4eab02c9c23a1c3ec6250ce werkzeug==3.1.8 \