PyJWT 1.7.1.post6

ActiveState security release for the Python 2.7-compatible PyJWT 1.7.1 line.

CVE	GHSA	Level	Status
—	GHSA-pxh4-856f-4h89	High	Fixed
CVE-2026-102271	GHSA-p4g4-x82p-q773	High	Fixed
CVE-2026-102272	GHSA-r6x4-923q-g947	High	Fixed
CVE-2026-102273	GHSA-w2cx-738m-mc7w	High	Fixed

Behaviour change: an empty HMAC key is rejected. encode() with an empty secret raises InvalidKeyError. decode() with an empty or missing secret raises InvalidSignatureError, the same DecodeError it raised before. An HMAC secret that parses as DER key material, or as JSON containing an object with a kty member, raises InvalidKeyError.

Packaging: six is now declared in install_requires.

See CHANGELOG.md, #6 and #7.

sha256 pyjwt-1.7.1.post6.tar.gz: 67d55ef058fd71d7d337fc3d58d196a382b1d7bf2acbd30d66b5a9bea63fe347

PyJWT 1.7.1.post5

ActiveState security release for the Python 2.7-compatible PyJWT 1.7.1 line.

CVE	GHSA	Level	Status
CVE-2026-102268	GHSA-ffc3-869f-jxw9	Critical	Fixed
CVE-2026-48526	GHSA-xgmm-8j9v-c9wx	High	Fixed
CVE-2026-102269	GHSA-hxm8-2xgr-2p9m	Medium	Fixed
CVE-2026-102270	GHSA-jwrc-g2q2-pq5p	Medium	Fixed
CVE-2026-101917	GHSA-2gx3-rcp4-g85q	Medium	Not affected (no PyJWKClient in 1.7.1)
CVE-2026-102267	GHSA-9v7f-9g4p-ffgj	High	Not affected (no PyJWKClient in 1.7.1)

Behaviour change: token segments must now be canonical unpadded Base64URL. Tokens with = padding, characters outside the alphabet, or set unused trailing bits raise DecodeError.

Versioning: this line now uses PEP 440 post-releases (1.7.1.postN) in place of the 1.7.1+security.N label.

See CHANGELOG.md and #5.

sha256 pyjwt-1.7.1.post5.tar.gz: b8dbd4dbf07fb9a509ac37e5583737c7052fe5374c2aa2472820bb340f92b7b0

PyJWT 1.7.1.4

CS-2178 CVE-2026-32597 (complete fix): wire _validate_headers into PyJWS.decode(). Version string updated to 1.7.1+security.4.

PyJWT 1.7.1.3

CS-2178: fix Python 2.7 SyntaxError — remove non-ASCII characters from comments in api_jws.py