Update dependency PyJWT to v2.13.0 by mend-for-github-com[bot] · Pull Request #34 · Vonage-Community/tutorial-sms-flask-python-sdk

mend-for-github-com · 2026-03-26T07:07:06Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
PyJWT	minor	`==2.6.0` → `==2.13.0`

By merging this PR, the issue #31 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2026-32597
High	7.4	CVE-2026-48526
Medium	4.2	CVE-2026-48522
Low	3.7	CVE-2026-48524

Release Notes

jpadilla/pyjwt (PyJWT)

`v2.13.0`

Compare Source

`v2.12.1`

Compare Source

Security


- Reject JWK JSON documents passed as raw HMAC secrets in
  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @aradona91 in
  `GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>`__.
- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during
  verification so the caller's ``algorithms=[...]`` allow-list cannot be
  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported
  by @sushi-gif in `GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>`__.
- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported
  by @KEIJOT in `GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>`__.
- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.
  The previous ``finally``-block ``put(None)`` pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>`__.
- Skip the unconditional base64 decode of the compact-form payload segment
  when ``b64=false`` is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @thesmartshadow in
  `GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>`__.

Fixed
~~~~~

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``"b64"`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed
~~~~~~~

- Migrate the ``dev``, ``docs``, and ``tests`` package extras to dependency groups by @kurtmckee in `#&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>`__

`v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>`__
------------------------------------------------------------------------

Fixed
~~~~~

- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Annotate PyJWKSet.keys for pyright by @tamird in `#&#8203;1134 <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `#&#8203;1133 <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @akx in `#&#8203;1143 <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `#&#8203;1148 <https://github.com/jpadilla/pyjwt/pull/1148>`__

Added
~~~~~

- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @kurtmckee in `#&#8203;1105 <https://github.com/jpadilla/pyjwt/pull/1105>`__
- Validate key against allowed types for Algorithm family in `#&#8203;964 <https://github.com/jpadilla/pyjwt/pull/964>`__
- Add iterator for JWKSet in `#&#8203;1041 <https://github.com/jpadilla/pyjwt/pull/1041>`__
- Validate `iss` claim is a string during encoding and decoding by @pachewise in `#&#8203;1040 <https://github.com/jpadilla/pyjwt/pull/1040>`__
- Improve typing/logic for `options` in decode, decode_complete by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Declare float supported type for lifespan and timeout by @nikitagashkov in `#&#8203;1068 <https://github.com/jpadilla/pyjwt/pull/1068>`__
- Fix ``SyntaxWarning``\s/``DeprecationWarning``\s caused by invalid escape sequences by @kurtmckee in `#&#8203;1103 <https://github.com/jpadilla/pyjwt/pull/1103>`__
- Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in `#&#8203;1114 <https://github.com/jpadilla/pyjwt/pull/1114>`__
- Development: Test type annotations across all supported Python versions,
  increase the strictness of the type checking, and remove the mypy pre-commit hook
  by @kurtmckee in `#&#8203;1112 <https://github.com/jpadilla/pyjwt/pull/1112>`__

Added
~~~~~

- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Prevent partial matching of `iss` claim by @fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in `#&#8203;975 <https://github.com/jpadilla/pyjwt/pull/975>`__
- Use ``Sequence`` for parameter types rather than ``List`` where applicable by @imnotjames in `#&#8203;970 <https://github.com/jpadilla/pyjwt/pull/970>`__
- Add JWK support to JWT encode by @luhn in `#&#8203;979 <https://github.com/jpadilla/pyjwt/pull/979>`__
- Encoding and decoding payloads using the `none` algorithm by @jpadilla in `#c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>`__

  Before:

  .. code-block:: pycon

   >>> import jwt
   >>> jwt.encode({"payload": "abc"}, key=None, algorithm=None)

  After:

  .. code-block:: pycon

   >>> import jwt
   >>> jwt.encode({"payload": "abc"}, key=None, algorithm="none")

- Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in `#&#8203;1005 <https://github.com/jpadilla/pyjwt/pull/1005>`__
- Refactor project configuration files from ``setup.cfg`` to ``pyproject.toml`` by @cleder in `#&#8203;995 <https://github.com/jpadilla/pyjwt/pull/995>`__
- Ruff linter and formatter changes by @gagandeepp in `#&#8203;1001 <https://github.com/jpadilla/pyjwt/pull/1001>`__
- Drop support for Python 3.8 (EOL) by @kkirsche in `#&#8203;1007 <https://github.com/jpadilla/pyjwt/pull/1007>`__

Fixed
~~~~~

- Encode EC keys with a fixed bit length by @etianen in `#&#8203;990 <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @kurtmckee in `#&#8203;977 <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @pachewise in `#&#8203;974 <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @RbnRncn in `#&#8203;982 <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @pachewise in `#&#8203;986 <https://github.com/jpadilla/pyjwt/pull/986>`__
- Fix ``test_utils.py`` not to xfail by @pachewise in `#&#8203;987 <https://github.com/jpadilla/pyjwt/pull/987>`__
- Docs: Correct `jwt.decode` audience param doc expression by @peter279k in `#&#8203;994 <https://github.com/jpadilla/pyjwt/pull/994>`__

Added
~~~~~

- Add support for python 3.13 by @hugovk in `#&#8203;972 <https://github.com/jpadilla/pyjwt/pull/972>`__
- Create SECURITY.md by @auvipy and @jpadilla in `#&#8203;973 <https://github.com/jpadilla/pyjwt/pull/973>`__
- Docs: Add PS256 encoding and decoding usage by @peter279k in `#&#8203;992 <https://github.com/jpadilla/pyjwt/pull/992>`__
- Docs: Add API docs for PyJWK by @luhn in `#&#8203;980 <https://github.com/jpadilla/pyjwt/pull/980>`__
- Docs: Add EdDSA algorithm encoding/decoding usage by @peter279k in `#&#8203;993 <https://github.com/jpadilla/pyjwt/pull/993>`__
- Include checkers and linters for ``pyproject.toml`` in ``pre-commit`` by @cleder in `#&#8203;1002 <https://github.com/jpadilla/pyjwt/pull/1002>`__
- Docs: Add ES256 decoding usage by @Gautam-Hegde in `#&#8203;1003 <https://github.com/jpadilla/pyjwt/pull/1003>`__

`v2.9.0 <https://github.com/jpadilla/pyjwt/compare/2.8.0...2.9.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- Drop support for Python 3.7 (EOL) by @hugovk in `#&#8203;910 <https://github.com/jpadilla/pyjwt/pull/910>`__
- Allow JWT issuer claim validation to accept a list of strings too by @mattpollak in `#&#8203;913 <https://github.com/jpadilla/pyjwt/pull/913>`__

Fixed
~~~~~

- Fix unnecessary string concatenation by @sirosen in `#&#8203;904 <https://github.com/jpadilla/pyjwt/pull/904>`__
- Fix docs for ``jwt.decode_complete`` to include ``strict_aud`` option by @woodruffw in `#&#8203;923 <https://github.com/jpadilla/pyjwt/pull/923>`__
- Fix docs step by @jpadilla in `#&#8203;950 <https://github.com/jpadilla/pyjwt/pull/950>`__
- Fix: Remove an unused variable from example code block by @kenkoooo in `#&#8203;958 <https://github.com/jpadilla/pyjwt/pull/958>`__

Added
~~~~~

- Add support for Python 3.12 by @hugovk in `#&#8203;910 <https://github.com/jpadilla/pyjwt/pull/910>`__
- Improve performance of ``is_ssh_key`` + add unit test by @bdraco in `#&#8203;940 <https://github.com/jpadilla/pyjwt/pull/940>`__
- Allow ``jwt.decode()`` to accept a PyJWK object by @luhn in `#&#8203;886 <https://github.com/jpadilla/pyjwt/pull/886>`__
- Make ``algorithm_name`` attribute available on PyJWK by @luhn in `#&#8203;886 <https://github.com/jpadilla/pyjwt/pull/886>`__
- Raise ``InvalidKeyError`` on invalid PEM keys to be compatible with cryptography 42.x.x by @CollinEMac in `#&#8203;952 <https://github.com/jpadilla/pyjwt/pull/952>`__
- Raise an exception when required cryptography dependency is missing by @tobloef in `<https://github.com/jpadilla/pyjwt/pull/963>`__

`v2.8.0 <https://github.com/jpadilla/pyjwt/compare/2.7.0...2.8.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- Update python version test matrix by @auvipy in `#&#8203;895 <https://github.com/jpadilla/pyjwt/pull/895>`__

Fixed
~~~~~

Added
~~~~~

- Add ``strict_aud`` as an option to ``jwt.decode`` by @woodruffw in `#&#8203;902 <https://github.com/jpadilla/pyjwt/pull/902>`__
- Export PyJWKClientConnectionError class by @daviddavis in `#&#8203;887 <https://github.com/jpadilla/pyjwt/pull/887>`__
- Allows passing of ssl.SSLContext to PyJWKClient by @juur in `#&#8203;891 <https://github.com/jpadilla/pyjwt/pull/891>`__

`v2.7.0 <https://github.com/jpadilla/pyjwt/compare/2.6.0...2.7.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- Changed the error message when the token audience doesn't match the expected audience by @irdkwmnsb `#&#8203;809 <https://github.com/jpadilla/pyjwt/pull/809>`__
- Improve error messages when cryptography isn't installed by @Viicos in `#&#8203;846 <https://github.com/jpadilla/pyjwt/pull/846>`__
- Make `Algorithm` an abstract base class by @Viicos in `#&#8203;845 <https://github.com/jpadilla/pyjwt/pull/845>`__
- ignore invalid keys in a jwks by @timw6n in `#&#8203;863 <https://github.com/jpadilla/pyjwt/pull/863>`__

Fixed
~~~~~

- Add classifier for Python 3.11 by @eseifert in `#&#8203;818 <https://github.com/jpadilla/pyjwt/pull/818>`__
- Fix ``_validate_iat`` validation by @Viicos in `#&#8203;847 <https://github.com/jpadilla/pyjwt/pull/847>`__
- fix: use datetime.datetime.timestamp function to have a milliseconds by @daillouf `#&#8203;821 <https://github.com/jpadilla/pyjwt/pull/821>`__
- docs: correct mistake in the changelog about verify param by @gbillig in `#&#8203;866 <https://github.com/jpadilla/pyjwt/pull/866>`__

Added
~~~~~

- Add ``compute_hash_digest`` as a method of ``Algorithm`` objects, which uses
  the underlying hash algorithm to compute a digest. If there is no appropriate
  hash algorithm, a ``NotImplementedError`` will be raised in `#&#8203;775 <https://github.com/jpadilla/pyjwt/pull/775>`__
- Add optional ``headers`` argument to ``PyJWKClient``. If provided, the headers
  will be included in requests that the client uses when fetching the JWK set by @thundercat1 in `#&#8203;823 <https://github.com/jpadilla/pyjwt/pull/823>`__
- Add PyJWT._{de,en}code_payload hooks by @akx in `#&#8203;829 <https://github.com/jpadilla/pyjwt/pull/829>`__
- Add `sort_headers` parameter to `api_jwt.encode` by @evroon in `#&#8203;832 <https://github.com/jpadilla/pyjwt/pull/832>`__
- Make mypy configuration stricter and improve typing by @akx in `#&#8203;830 <https://github.com/jpadilla/pyjwt/pull/830>`__
- Add more types by @Viicos in `#&#8203;843 <https://github.com/jpadilla/pyjwt/pull/843>`__
- Add a timeout for PyJWKClient requests by @daviddavis in `#&#8203;875 <https://github.com/jpadilla/pyjwt/pull/875>`__
- Add client connection error exception by @daviddavis in `#&#8203;876 <https://github.com/jpadilla/pyjwt/pull/876>`__
- Add complete types to take all allowed keys into account by @Viicos in `#&#8203;873 <https://github.com/jpadilla/pyjwt/pull/873>`__
- Add `as_dict` option to `Algorithm.to_jwk` by @fluxth in `#&#8203;881 <https://github.com/jpadilla/pyjwt/pull/881>`__

`v2.6.0 <https://github.com/jpadilla/pyjwt/compare/2.5.0...2.6.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- bump up cryptography >= 3.4.0 by @jpadilla in `#&#8203;807 <https://github.com/jpadilla/pyjwt/pull/807>`__
- Remove `types-cryptography` from `crypto` extra by @lautat in `#&#8203;805 <https://github.com/jpadilla/pyjwt/pull/805>`__

Fixed
~~~~~

- Invalidate token on the exact second the token expires `#&#8203;797 <https://github.com/jpadilla/pyjwt/pull/797>`__
- fix: version 2.5.0 heading typo by @c0state in `#&#8203;803 <https://github.com/jpadilla/pyjwt/pull/803>`__

Added
~~~~~
- Adding validation for `issued_at` when `iat > (now + leeway)` as `ImmatureSignatureError` by @sriharan16 in `#&#8203;794 <https://github.com/jpadilla/pyjwt/pull/794>`__

`v2.5.0 <https://github.com/jpadilla/pyjwt/compare/2.4.0...2.5.0>`__
-----------------------------------------------------------------------

Changed
~~~~~~~

- Skip keys with incompatible alg when loading JWKSet by @DaGuich in `#&#8203;762 <https://github.com/jpadilla/pyjwt/pull/762>`__
- Remove support for python3.6 by @sirosen in `#&#8203;777 <https://github.com/jpadilla/pyjwt/pull/777>`__
- Emit a deprecation warning for unsupported kwargs by @sirosen in `#&#8203;776 <https://github.com/jpadilla/pyjwt/pull/776>`__
- Remove redundant wheel dep from pyproject.toml by @mgorny in `#&#8203;765 <https://github.com/jpadilla/pyjwt/pull/765>`__
- Do not fail when an unusable key occurs by @DaGuich in `#&#8203;762 <https://github.com/jpadilla/pyjwt/pull/762>`__
- Update audience typing by @JulianMaurin in `#&#8203;782 <https://github.com/jpadilla/pyjwt/pull/782>`__
- Improve PyJWKSet error accuracy by @JulianMaurin in `#&#8203;786 <https://github.com/jpadilla/pyjwt/pull/786>`__
- Mypy as pre-commit check + api_jws typing by @JulianMaurin in `#&#8203;787 <https://github.com/jpadilla/pyjwt/pull/787>`__

Fixed
~~~~~

- Adjust expected exceptions in option merging tests for PyPy3 by @mgorny in `#&#8203;763 <https://github.com/jpadilla/pyjwt/pull/763>`__
- Fixes for pyright on strict mode by @brandon-leapyear in `#&#8203;747 <https://github.com/jpadilla/pyjwt/pull/747>`__
- docs: fix simple typo, iinstance -> isinstance by @timgates42 in `#&#8203;774 <https://github.com/jpadilla/pyjwt/pull/774>`__
- Fix typo: priot -> prior by @jdufresne in `#&#8203;780 <https://github.com/jpadilla/pyjwt/pull/780>`__
- Fix for headers disorder issue by @kadabusha in `#&#8203;721 <https://github.com/jpadilla/pyjwt/pull/721>`__

Added
~~~~~

- Add to_jwk static method to ECAlgorithm by @leonsmith in `#&#8203;732 <https://github.com/jpadilla/pyjwt/pull/732>`__
- Expose get_algorithm_by_name as new method by @sirosen in `#&#8203;773 <https://github.com/jpadilla/pyjwt/pull/773>`__
- Add type hints to jwt/help.py and add missing types dependency by @kkirsche in `#&#8203;784 <https://github.com/jpadilla/pyjwt/pull/784>`__
- Add cacheing functionality for JWK set by @wuhaoyujerry in `#&#8203;781 <https://github.com/jpadilla/pyjwt/pull/781>`__

`v2.4.0 <https://github.com/jpadilla/pyjwt/compare/2.3.0...2.4.0>`__
-----------------------------------------------------------------------

Security

[CVE-2022-29217] Prevent key confusion through non-blocklisted public key formats. GHSA-ffqj-6fqr-9h24

Changed


- Explicit check the key for ECAlgorithm by @estin in `#&#8203;713 <https://github.com/jpadilla/pyjwt/pull/713>`__
- Raise DeprecationWarning for jwt.decode(verify=...) by @akx in `#&#8203;742 <https://github.com/jpadilla/pyjwt/pull/742>`__

Fixed
~~~~~

- Don't use implicit optionals by @rekyungmin in `#&#8203;705 <https://github.com/jpadilla/pyjwt/pull/705>`__
- documentation fix: show correct scope for decode_complete() by @sseering in `#&#8203;661 <https://github.com/jpadilla/pyjwt/pull/661>`__
- fix: Update copyright information by @kkirsche in `#&#8203;729 <https://github.com/jpadilla/pyjwt/pull/729>`__
- Don't mutate options dictionary in .decode_complete() by @akx in `#&#8203;743 <https://github.com/jpadilla/pyjwt/pull/743>`__

Added
~~~~~

- Add support for Python 3.10 by @hugovk in `#&#8203;699 <https://github.com/jpadilla/pyjwt/pull/699>`__
- api_jwk: Add PyJWKSet.__getitem__ by @woodruffw in `#&#8203;725 <https://github.com/jpadilla/pyjwt/pull/725>`__
- Update usage.rst by @guneybilen in `#&#8203;727 <https://github.com/jpadilla/pyjwt/pull/727>`__
- Docs: mention performance reasons for reusing RSAPrivateKey when encoding by @dmahr1 in `#&#8203;734 <https://github.com/jpadilla/pyjwt/pull/734>`__
- Fixed typo in usage.rst by @israelabraham in `#&#8203;738 <https://github.com/jpadilla/pyjwt/pull/738>`__
- Add detached payload support for JWS encoding and decoding by @fviard in `#&#8203;723 <https://github.com/jpadilla/pyjwt/pull/723>`__
- Replace various string interpolations with f-strings by @akx in `#&#8203;744 <https://github.com/jpadilla/pyjwt/pull/744>`__
- Update CHANGELOG.rst by @hipertracker in `#&#8203;751 <https://github.com/jpadilla/pyjwt/pull/751>`__

`v2.3.0 <https://github.com/jpadilla/pyjwt/compare/2.2.0...2.3.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Revert "Remove arbitrary kwargs." `#&#8203;701 <https://github.com/jpadilla/pyjwt/pull/701>`__

Added
~~~~~

- Add exception chaining `#&#8203;702 <https://github.com/jpadilla/pyjwt/pull/702>`__

`v2.2.0 <https://github.com/jpadilla/pyjwt/compare/2.1.0...2.2.0>`__
-----------------------------------------------------------------------

Changed

Remove arbitrary kwargs. #657 <https://github.com/jpadilla/pyjwt/pull/657>__
Use timezone package as Python 3.5+ is required. #694 <https://github.com/jpadilla/pyjwt/pull/694>__

Fixed

- Assume JWK without the "use" claim is valid for signing as per RFC7517 `#&#8203;668 <https://github.com/jpadilla/pyjwt/pull/668>`__
- Prefer `headers["alg"]` to `algorithm` in `jwt.encode()`. `#&#8203;673 <https://github.com/jpadilla/pyjwt/pull/673>`__
- Fix aud validation to support {'aud': null} case. `#&#8203;670 <https://github.com/jpadilla/pyjwt/pull/670>`__
- Make `typ` optional in JWT to be compliant with RFC7519. `#&#8203;644 <https://github.com/jpadilla/pyjwt/pull/644>`__
-  Remove upper bound on cryptography version. `#&#8203;693 <https://github.com/jpadilla/pyjwt/pull/693>`__

Added

Add support for Ed448/EdDSA. #675 <https://github.com/jpadilla/pyjwt/pull/675>__

`v2.12.0`

Compare Source

Security

Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1132
chore(docs): fix docs build by @tamird in #1137
Annotate PyJWKSet.keys for pyright by @tamird in #1134
fix: close HTTPError to prevent ResourceWarning on Python 3.14 by @veeceey in #1133
chore: remove superfluous constants by @tamird in #1136
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1135
chore(tests): enable mypy by @tamird in #1138
Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #1142
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1141
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1145
fix: do not store reference to algorithms dict on PyJWK by @akx in #1143
Use PyJWK algorithm when encoding without explicit algorithm by @jpadilla in #1148

New Contributors

@tamird made their first contribution in #1137
@veeceey made their first contribution in #1133

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

`v2.11.0`

Compare Source

What's Changed

Fixed type error in comment by @shuhaib-aot in #1026
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1018
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1033
Make note of use of leeway with nbf by @djw8605 in #1034
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1035
Fixes #964: Validate key against allowed types for Algorithm family by @pachewise in #985
Feat #1024: Add iterator for PyJWKSet by @pachewise in #1041
Fixes #1039: Add iss, issuer type checks by @pachewise in #1040
Fixes #660: Improve typing/logic for options in decode, decode_complete; Improve docs by @pachewise in #1045
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1042
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1052
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1053
Fix #1022: Map algorithm=None to "none" by @qqii in #1056
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1055
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1058
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1060
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1061
Fixes #1047: Correct PyJWKClient.get_signing_key_from_jwt annotation by @khvn26 in #1048
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1062
Fixed doc string typo in _validate_jti() function #1063 by @kuldeepkhatke in #1064
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1065
Update SECURITY.md by @auvipy in #1057
Typing fix: use float instead of int for lifespan and timeout by @nikitagashkov in #1068
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1067
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1071
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1076
Fix TYP header documentation by @fobiasmog in #1046
doc: Document claims sub and jti by @cleder in #1088
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1077
Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #1089
Bump actions/stale from 8 to 10 by @dependabot[bot] in #1090
Bump actions/checkout from 4 to 5 by @dependabot[bot] in #1083
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1091
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1093
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1096
Resolve package build warnings by @kurtmckee in #1105
Support Python 3.14, and test against PyPy 3.10+ by @kurtmckee in #1104
Fix a SyntaxWarning caused by invalid escape sequences by @kurtmckee in #1103
Standardize CHANGELOG links to PRs by @kurtmckee in #1110
Migrate from pep517, which is deprecated, to build by @kurtmckee in #1108
Fix incorrectly-named test suite function by @kurtmckee in #1116
Fix Read the Docs builds by @kurtmckee in #1111
Bump actions/download-artifact from 4 to 6 by @dependabot[bot] in #1118
Escalate test suite warnings to errors by @kurtmckee in #1107
Add pyupgrade as a pre-commit hook by @kurtmckee in #1109
Simplify the test suite decorators by @kurtmckee in #1113
Improve coverage config and eliminate unused test suite code by @kurtmckee in #1115
Build a shared wheel once in the test suite by @kurtmckee in #1114
Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1122
Thoroughly test type annotations, and resolve errors by @kurtmckee in #1112
Fix leeway value in usage documentation by @Matthew1471 in #1124
Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #1125

New Contributors

@shuhaib-aot made their first contribution in #1026
@qqii made their first contribution in #1056
@khvn26 made their first contribution in #1048
@kuldeepkhatke made their first contribution in #1064
@nikitagashkov made their first contribution in #1068
@fobiasmog made their first contribution in #1046
@Matthew1471 made their first contribution in #1124

Full Changelog: jpadilla/pyjwt@2.10.1...2.11.0

`v2.10.1`

Compare Source

Fixed

Prevent partial matching of iss claim. Thanks @fabianbadoi! (See: GHSA-75c5-xw7c-p5pm)

Full Changelog: jpadilla/pyjwt@2.10.0...2.10.1

`v2.10.0`

Compare Source

What's Changed

chore: use sequence for typing rather than list by @imnotjames in #970
Add support for Python 3.13 by @hugovk in #972
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #971
Add an RTD config file to resolve RTD build failures by @kurtmckee in #977
docs: Update iat exception docs by @pachewise in #974
Remove algorithm requirement for JWT API by @luhn in #975
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #978
Create SECURITY.md by @auvipy in #973
docs fix: decode_complete scope and algorithms by @RbnRncn in #982
fix doctest for docs/usage.rst by @pachewise in #986
fix test_utils.py not to xfail by @pachewise in #987
Correct jwt.decode audience param doc expression by @peter279k in #994
Add PS256 encoding and decoding usage by @peter279k in #992
Add API docs for PyJWK by @luhn in #980
Refactor project configuration files from setup.cfg to pyproject.toml PEP-518 by @cleder in #995
Add JWK support to JWT encode by @luhn in #979
Update pre-commit hooks to lint pyproject.toml by @cleder in #1002
Add EdDSA algorithm encoding/decoding usage by @peter279k in #993
Ruff linter and formatter changes by @gagandeepp in #1001
Validate sub and jti claims for the token by @Divan009 in #1005
Add ES256 usage by @Gautam-Hegde in #1003
Encode EC keys with a fixed bit length by @way-dave in #990
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1000
Drop support for Python 3.8 by @kkirsche in #1007
Prepare 2.10.0 release by @benvdh in #1011
Bump codecov/codecov-action from 4 to 5 by @dependabot in #1014
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #1006

New Contributors

@imnotjames made their first contribution in #970
@kurtmckee made their first contribution in #977
@pachewise made their first contribution in #974
@RbnRncn made their first contribution in #982
@peter279k made their first contribution in #994
@cleder made their first contribution in #995
@gagandeepp made their first contribution in #1001
@Divan009 made their first contribution in #1005
@Gautam-Hegde made their first contribution in #1003
@way-dave made their first contribution in #990

Full Changelog: jpadilla/pyjwt@2.9.0...2.10.0

`v2.9.0`

Compare Source

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #905
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #909
Add support for Python 3.12 by @hugovk in #910
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #911
Fix an unnecessary str concat by @sirosen in #904
Update jwt-api to accept either a string or list of strings for issuer validation by @mattpollak in #913
Bump actions/checkout from 3 to 4 by @dependabot in #916
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #917
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #922
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #926
Bump actions/setup-python from 4 to 5 by @dependabot in #931
Bump hynek/build-and-inspect-python-package from 1 to 2 by @dependabot in #935
docs/api: document strict_aud on decode_complete by @woodruffw in #923
chore: fix docs step by @jpadilla in #950
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #953
Add coverage and improve performance of is_ssh_key by @bdraco in #940
Decode with PyJWK by @luhn in #886
Remove an unused variable from an example code block by @kenkoooo in #958
Handle load_pem_public_key ValueError by @CollinEMac in #952
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #960
Raise exception when required cryptography dependency is missing by @tobloef in #963
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #965
Add 2.9.0 changelog. Fixes #949 by @benvdh in #967

New Contributors

@mattpollak made their first contribution in #913
@bdraco made their first contribution in #940
@luhn made their first contribution in #886
@kenkoooo made their first contribution in #958
@CollinEMac made their first contribution in #952
@tobloef made their first contribution in #963
@benvdh made their first contribution in #967

Full Changelog: jpadilla/pyjwt@2.8.0...2.9.0

`v2.8.0`

Compare Source

What's Changed

Export PyJWKClientConnectionError class by @daviddavis in #887
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #889
Patch 1 by @juur in #891
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #896
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #898
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #900
Update python version by @auvipy in #895
api_jwt: add a strict_aud option by @woodruffw in #902

New Contributors

@juur made their first contribution in #891

Full Changelog: jpadilla/pyjwt@2.7.0...2.8.0

`v2.7.0`

Compare Source

What's Changed

Add classifier for Python 3.11 by @eseifert in #818
Add Algorithm.compute_hash_digest and use it to implement at_hash validation example by @sirosen in #775
fix: use datetime.datetime.timestamp function to have a milliseconds by @daillouf in #821
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #825
Custom header configuration in jwk client by @thundercat1 in #823
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #828
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #833
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #835
Add PyJWT._{de,en}code_payload hooks by @akx in #829
Add sort_headers parameter to api_jwt.encode by @evroon in #832
Make mypy configuration stricter and improve typing by @akx in #830
Bump actions/stale from 6 to 7 by @dependabot in #840
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #838
Add more types by @Viicos in #843
Differentiate between two errors by @irdkwmnsb in #809
Fix _validate_iat validation by @Viicos in #847
Improve error messages when cryptography isn't installed by @Viicos in #846
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #852
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #855
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #859
Make Algorithm an abstract base class by @Viicos in #845
docs: correct mistake in the changelog about verify param by @gbillig in #866
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #868
Bump actions/stale from 7 to 8 by @dependabot in #872
[pre-commit.ci] pre-commit autoupda

✂ Note

PR body was truncated to here.

mend-for-github-com Bot added the security fix Security fix generated by Mend label Mar 26, 2026

Update dependency PyJWT to v2.13.0

ea500d0

mend-for-github-com Bot force-pushed the whitesource-remediate/pyjwt-2.x branch from af49208 to ea500d0 Compare June 1, 2026 00:50

mend-for-github-com Bot changed the title ~~Update dependency PyJWT to v2.12.0~~ Update dependency PyJWT to v2.13.0 Jun 1, 2026

Navigation Menu

Uh oh!

Update dependency PyJWT to v2.13.0 - #34

Update dependency PyJWT to v2.13.0#34
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/pyjwt-2.x

mend-for-github-com Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

mend-for-github-com Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Security

What's Changed

New Contributors

What's Changed

New Contributors

Fixed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

mend-for-github-com Bot commented Mar 26, 2026 •

edited

Loading