From ac4c3302783a3137e55dcede54c466bdf8aa55b7 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:24:50 +0200 Subject: build(deps): require PyJWT 2.15 pip-audit reports two advisories against 2.14.0, both fixed in 2.15.0. PYSEC-2026-4141 reaches the hub: federation.py decodes a peer's token without verifying it first, and a deeply nested payload raises a RecursionError there, an unauthenticated 500. PYSEC-2026-4183 does not: no key is imported from a JWK. The builds resolve the newest release anyway; the floor keeps an older environment from satisfying them. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-common/pyproject.toml | 2 +- packages/meshbay-hub/pyproject.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/meshbay-common/pyproject.toml b/packages/meshbay-common/pyproject.toml index 781ee4e..9ff7ea5 100644 --- a/packages/meshbay-common/pyproject.toml +++ b/packages/meshbay-common/pyproject.toml @@ -11,7 +11,7 @@ license = "LGPL-3.0-or-later" license-files = ["COPYING", "COPYING.LESSER"] dependencies = [ "cryptography>=43.0", - "PyJWT>=2.9", + "PyJWT>=2.15", "blake3>=1.0", "msgpack>=1.1", ] diff --git a/packages/meshbay-hub/pyproject.toml b/packages/meshbay-hub/pyproject.toml index 1557734..fdb8122 100644 --- a/packages/meshbay-hub/pyproject.toml +++ b/packages/meshbay-hub/pyproject.toml @@ -19,7 +19,7 @@ dependencies = [ "aiosqlite>=0.20", # SQLite async (tests + dev without PostgreSQL) "httpx>=0.28", "slowapi>=0.1", # rate limiting - "PyJWT>=2.9", # JWT EdDSA (also in meshbay-common but explicit here) + "PyJWT>=2.15", # JWT EdDSA (also in meshbay-common but explicit here) "websockets>=12.0", # hub→node revocation push ] -- cgit v1.2.3