Skip to content

PyJWT 1.7.1.post6

Latest
Latest

Choose a tag to compare

View all tags
@icanhasmath icanhasmath released this 23 Oct 19:09
· 273 commits to master since this release
1.7.1.post6
5c6f4b9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActiveState security release for the Python 2.7-compatible PyJWT 1.7.1 line.

CVE GHSA Level Status
— GHSA-pxh4-856f-4h89 High Fixed
CVE-2026-102271 GHSA-p4g4-x82p-q773 High Fixed
CVE-2026-102272 GHSA-r6x4-923q-g947 High Fixed
CVE-2026-102273 GHSA-w2cx-738m-mc7w High Fixed

Behaviour change: an empty HMAC key is rejected. encode() with an empty secret raises InvalidKeyError. decode() with an empty or missing secret raises InvalidSignatureError, the same DecodeError it raised before. An HMAC secret that parses as DER key material, or as JSON containing an object with a kty member, raises InvalidKeyError.

Packaging: six is now declared in install_requires.

See CHANGELOG.md, #6 and #7.

sha256 pyjwt-1.7.1.post6.tar.gz: 67d55ef058fd71d7d337fc3d58d196a382b1d7bf2acbd30d66b5a9bea63fe347

Assets 3
Loading