Skip to content

chore(deps): update pyjwt requirement from >=2.12.0 to >=2.12.1#39

Merged
govindkavaturi-art merged 1 commit into
mainfrom
dependabot/pip/pyjwt-gte-2.12.1
May 6, 2026
Merged

chore(deps): update pyjwt requirement from >=2.12.0 to >=2.12.1#39
govindkavaturi-art merged 1 commit into
mainfrom
dependabot/pip/pyjwt-gte-2.12.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 4, 2026

Updates the requirements on pyjwt to permit the latest version.

Release notes

Sourced from pyjwt's releases.

2.12.1

What's Changed

Full Changelog: jpadilla/pyjwt@2.12.0...2.12.1

Changelog

Sourced from pyjwt's changelog.

v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>__

Fixed


- Add missing ``typing_extensions`` dependency for Python < 3.11 in `[#1150](https://github.com/jpadilla/pyjwt/issues/1150) <https://github.com/jpadilla/pyjwt/issues/1150>`__

v2.12.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0&gt;__

Fixed

  • Annotate PyJWKSet.keys for pyright by @​tamird in [#1134](https://github.com/jpadilla/pyjwt/issues/1134) <https://github.com/jpadilla/pyjwt/pull/1134>__
  • Close HTTPError response to prevent ResourceWarning on Python 3.14 by @​veeceey in [#1133](https://github.com/jpadilla/pyjwt/issues/1133) <https://github.com/jpadilla/pyjwt/pull/1133>__
  • Do not keep algorithms dict in PyJWK instances by @​akx in [#1143](https://github.com/jpadilla/pyjwt/issues/1143) <https://github.com/jpadilla/pyjwt/pull/1143>__
  • Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @​dmbs335 in GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>__
  • Use PyJWK algorithm when encoding without explicit algorithm in [#1148](https://github.com/jpadilla/pyjwt/issues/1148) <https://github.com/jpadilla/pyjwt/pull/1148>__

Added


- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

v2.11.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0&gt;__

Fixed

  • Enforce ECDSA curve validation per RFC 7518 Section 3.4.
  • Fix build system warnings by @​kurtmckee in [#1105](https://github.com/jpadilla/pyjwt/issues/1105) <https://github.com/jpadilla/pyjwt/pull/1105>__
  • Validate key against allowed types for Algorithm family in [#964](https://github.com/jpadilla/pyjwt/issues/964) <https://github.com/jpadilla/pyjwt/pull/964>__
  • Add iterator for JWKSet in [#1041](https://github.com/jpadilla/pyjwt/issues/1041) <https://github.com/jpadilla/pyjwt/pull/1041>__
  • Validate iss claim is a string during encoding and decoding by @​pachewise in [#1040](https://github.com/jpadilla/pyjwt/issues/1040) <https://github.com/jpadilla/pyjwt/pull/1040>__
  • Improve typing/logic for options in decode, decode_complete by @​pachewise in [#1045](https://github.com/jpadilla/pyjwt/issues/1045) <https://github.com/jpadilla/pyjwt/pull/1045>__
  • Declare float supported type for lifespan and timeout by @​nikitagashkov in [#1068](https://github.com/jpadilla/pyjwt/issues/1068) <https://github.com/jpadilla/pyjwt/pull/1068>__
  • Fix SyntaxWarning\s/DeprecationWarning\s caused by invalid escape sequences by @​kurtmckee in [#1103](https://github.com/jpadilla/pyjwt/issues/1103) <https://github.com/jpadilla/pyjwt/pull/1103>__
  • Development: Build a shared wheel once to speed up test suite setup times by @​kurtmckee in [#1114](https://github.com/jpadilla/pyjwt/issues/1114) <https://github.com/jpadilla/pyjwt/pull/1114>__
  • Development: Test type annotations across all supported Python versions, increase the strictness of the type checking, and remove the mypy pre-commit hook by @​kurtmckee in [#1112](https://github.com/jpadilla/pyjwt/issues/1112) <https://github.com/jpadilla/pyjwt/pull/1112>__

Added


- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `[#1104](https://github.com/jpadilla/pyjwt/issues/1104) <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `[#1108](https://github.com/jpadilla/pyjwt/issues/1108) <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `[#1115](https://github.com/jpadilla/pyjwt/issues/1115) <https://github.com/jpadilla/pyjwt/pull/1115>`__
</tr></table> 

... (truncated)

Commits

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 4, 2026

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the security label May 4, 2026
@govindkavaturi-art govindkavaturi-art added the dependencies Dependabot or other dependency updates label May 4, 2026
@mikemolinet
Copy link
Copy Markdown
Collaborator

Re-triggering after GOVIND_GITHUB_TOKEN was added to the Dependabot secrets namespace on cueapi-core. The auto-merge job in feature-to-main.yml has been failing since 2026-05-04 because Dep-triggered runs only see the Dependabot-namespace secrets, not Actions-namespace. Now fixed; close+reopen forces the workflow to re-run with the new secret in scope. (Automated by cue-pm-pr-watcher per Mike's directive.)

@mikemolinet mikemolinet closed this May 6, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 6, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@mikemolinet mikemolinet reopened this May 6, 2026
@govindkavaturi-art govindkavaturi-art enabled auto-merge (squash) May 6, 2026 18:44
Copy link
Copy Markdown
Collaborator

@mikemolinet mikemolinet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approving Dependabot batch — CI checks (test + sdk-integration) are the binding gate; this satisfies branch-protection's review requirement so native auto-merge can complete the cycle. (Approval by cue-pm-pr-watcher under Mike's directive 2026-05-06.)

@mikemolinet
Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot dependabot Bot force-pushed the dependabot/pip/pyjwt-gte-2.12.1 branch from 4f12497 to 0003f04 Compare May 6, 2026 19:23
@mikemolinet
Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot dependabot Bot force-pushed the dependabot/pip/pyjwt-gte-2.12.1 branch from cc7531c to 0be7331 Compare May 6, 2026 21:53
Updates the requirements on [pyjwt](https://github.com/jpadilla/pyjwt) to permit the latest version.
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.12.0...2.12.1)

---
updated-dependencies:
- dependency-name: pyjwt
  dependency-version: 2.12.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/pyjwt-gte-2.12.1 branch from 0be7331 to 800a678 Compare May 6, 2026 21:57
@govindkavaturi-art govindkavaturi-art merged commit 1657a52 into main May 6, 2026
5 checks passed
@dependabot dependabot Bot deleted the dependabot/pip/pyjwt-gte-2.12.1 branch May 6, 2026 22:00
mikemolinet added a commit that referenced this pull request May 11, 2026
)

Parity port of cueapi/cueapi#798 (merged 23:39:13Z) — fixes Phase 1
body_received echoing Pydantic envelope dump instead of design-lock
flat STRING. cueapi-python SDK auto-verify (cueapi-python #39) and
caller-side sha256(sent_body) match now work as designed.

Files modified:
- app/utils/verify_echo.py — helper signature changed from
  parsed_body: Any to body_text: Optional[str]
- app/routers/messages.py — passes body.body string (spec lock)
- app/routers/cues.py — passes body_text=None (OSS FireRequest carries
  only send_at datetime; no string user-content field). Hosted's
  payload_override.message extraction is hosted-only.
- tests/test_verify_echo.py — 25 tests asserting STRING type + caller-
  side sha256(sent_body.encode()) == response.body_received_sha256
- parity-manifest: bumped last_synced + appended hotfix deviation notes

25/25 OSS tests pass locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mikemolinet added a commit that referenced this pull request May 12, 2026
) (#88)

Parity port of cueapi/cueapi#798 (merged 23:39:13Z) — fixes Phase 1
body_received echoing Pydantic envelope dump instead of design-lock
flat STRING. cueapi-python SDK auto-verify (cueapi-python #39) and
caller-side sha256(sent_body) match now work as designed.

Files modified:
- app/utils/verify_echo.py — helper signature changed from
  parsed_body: Any to body_text: Optional[str]
- app/routers/messages.py — passes body.body string (spec lock)
- app/routers/cues.py — passes body_text=None (OSS FireRequest carries
  only send_at datetime; no string user-content field). Hosted's
  payload_override.message extraction is hosted-only.
- tests/test_verify_echo.py — 25 tests asserting STRING type + caller-
  side sha256(sent_body.encode()) == response.body_received_sha256
- parity-manifest: bumped last_synced + appended hotfix deviation notes

25/25 OSS tests pass locally.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependabot or other dependency updates security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants