Update pyjwt to 1.5.3 #4672
Update pyjwt to 1.5.3 #4672
Conversation
|
I鈥檝e taken a quick peek at the failing builds here, and it looks like all the failures are a result of the change that tokens claiming to be issued in the future (the Assuming we still want to reject these tokens (which seems sensible), we鈥檙e going to need to add an extra check or two into the code before we can merge this. |
Remove two tests that JWT's whose `iat` value claims that they were issued in the future fail validation. These two tests fail on newer versions of PyJWT: #4672 This is because PyJWT no longer raises an exception for future `iat` times: jpadilla/pyjwt#190 PyJWT removed this validation because: - Clock skew can cause one party to generate `iat` times a few seconds or minutes ahead of another's current time - The JWT spec (RFC 7519) doesn't say that a JWT with a future `iat` should be considered invalid, these JWTs are valid - Other JWT libraries don't do this check
Remove two tests that JWT's whose `iat` value claims that they were issued in the future fail validation. These two tests fail on newer versions of PyJWT: #4672 This is because PyJWT no longer raises an exception for future `iat` times: jpadilla/pyjwt#190 PyJWT removed this validation because: - Clock skew can cause one party to generate `iat` times a few seconds or minutes ahead of another's current time - The JWT spec (RFC 7519) doesn't say that a JWT with a future `iat` should be considered invalid, these JWTs are valid - Other JWT libraries don't do this check
|
I think we should go along with what PyJWT decided (they changed their code to no longer reject future |
robertknight
force-pushed
the
pyup-update-pyjwt-1.4.1-to-1.5.3
branch
from
8c1aee4
to
4cc12df
Compare
|
Rebased. |
Codecov Report
@@ Coverage Diff @@
## master #4672 +/- ##
=======================================
Coverage 96.54% 96.54%
=======================================
Files 367 367
Lines 20517 20517
Branches 1165 1165
=======================================
Hits 19809 19809
Misses 601 601
Partials 107 107Continue to review full report at Codecov.
|
There's a new version of pyjwt available.
You are currently using 1.4.1. I have updated it to 1.5.3
These links might come in handy: PyPI | Changelog | Repo
Changelog
Got merge conflicts? Close this PR and delete the branch. I'll create a new PR for you.
Happy merging! 馃