Skip to content

v0.4.1

Choose a tag to compare

View all tags
@chris-dare chris-dare released this 20 Jun 11:34
v0.4.1
7695f1f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Replaces the deprecated authlib.jose JWT backend with PyJWT and patches a pydantic-settings vulnerability.

What changed

  • JWT validation migrated to PyJWT — authlib.jose is deprecated upstream and would break at authlib 2.0. The new implementation uses PyJWKSet + jwt.decode with explicit kid-based key lookup. All security properties are preserved: asymmetric-only algorithm allowlist, alg: none rejection, full exp/iss/aud/sub enforcement, generic error messages. Key rotation resilience is also restored for providers that reuse a kid across rotations.
  • pydantic-settings bumped to 2.14.2 — fixes GHSA-4xgf-cpjx-pc3j (symlink traversal in NestedSecretsSettingsSource).
  • authlib removed from the published dependency list; pyjwt>=2.8.0 added. cryptography>=42.0 (already declared) provides RSA/EC key support.

Full Changelog: v0.4.0...v0.4.1

Assets 2
Loading