diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:24:50 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:24:50 +0200 |
| commit | ac4c3302783a3137e55dcede54c466bdf8aa55b7 (patch) | |
| tree | 2a4ceb35dd45171c93e66ae790845011cf0b3473 /packages/meshbay-hub/pyproject.toml | |
| parent | 283771ff468bd9e1a60a4902a5ada4319c063073 (diff) | |
| download | meshbay-ac4c3302783a3137e55dcede54c466bdf8aa55b7.tar.gz | |
build(deps): require PyJWT 2.15
pip-audit reports two advisories against 2.14.0, both fixed in 2.15.0.
PYSEC-2026-4141 reaches the hub: federation.py decodes a peer's token
without verifying it first, and a deeply nested payload raises a
RecursionError there, an unauthenticated 500. PYSEC-2026-4183 does not:
no key is imported from a JWK. The builds resolve the newest release
anyway; the floor keeps an older environment from satisfying them.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-hub/pyproject.toml')
| -rw-r--r-- | packages/meshbay-hub/pyproject.toml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/packages/meshbay-hub/pyproject.toml b/packages/meshbay-hub/pyproject.toml index 1557734..fdb8122 100644 --- a/packages/meshbay-hub/pyproject.toml +++ b/packages/meshbay-hub/pyproject.toml @@ -19,7 +19,7 @@ dependencies = [ "aiosqlite>=0.20", # SQLite async (tests + dev without PostgreSQL) "httpx>=0.28", "slowapi>=0.1", # rate limiting - "PyJWT>=2.9", # JWT EdDSA (also in meshbay-common but explicit here) + "PyJWT>=2.15", # JWT EdDSA (also in meshbay-common but explicit here) "websockets>=12.0", # hub→node revocation push ] |