Bump python-jose from 3.3.0 to 3.5.0 in /backend

[dependabot]

Bumps python-jose from 3.3.0 to 3.5.0.

Release notes

Sourced from python-jose's releases.

3.5.0

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

https://pypi.org/project/python-jose/3.5.0/

3.4.0

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Changelog

Sourced from python-jose's changelog.

3.5.0 -- 2025-05-28

News

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

3.4.0 -- 2025-02-14

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Commits

• 018b310 Prepare release 3.5.0 (#388)
• 393c374 Improve jwt.decode key doc (#198)
• 50d4390 utils.py: fix types in docstrings for base64url_encode/decode (#269)
• 8fd0b63 Add RTD config file to silence emailed deprecation warnings (#333)
• 6f03385 Added possibility to call jwk.construct() with a private key (#295)
• 2f0aca6 Add python_requires arg to setup.cfg (#273)
• 895777e Updated pyasn version to match latest (#338)
• 45bd124 Update jwk.py (#328)
• 1f0ae0a docs: Fix a few typos (#299)
• ceaac36 Do not use utc_now on module level (#372)
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.