fix(deps): update dependency pyjwt to v2.15.1 by renovate[bot] · Pull Request #494 · Spillhuset/shqueue

renovate · 2026-01-30T22:13:54Z

This PR contains the following updates:

Package	Change	Age	Confidence
pyjwt	`2.10.1` → `2.15.1`

Release Notes

jpadilla/pyjwt (pyjwt)

`v2.15.1`

Compare Source

Changed


- Add public ``jwt.decode`` regression coverage for AWS ALB-style padded
  ES256 tokens, including rejection of tampered payloads and signatures,
  in `#&#8203;1211 <https://github.com/jpadilla/pyjwt/pull/1211>`__.

`v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`#&#8203;1209 <https://github.com/jpadilla/pyjwt/issues/1209>`__).

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__
-----------------------------------------------------------------------

Security

Wrap recursion errors from deeply nested JWT payloads in DecodeError
instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `#&#8203;1202 <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
#1208 <https://github.com/jpadilla/pyjwt/pull/1208>__
PyJWKClient.fetch_data() now raises
PyJWKClientError("The JWKS endpoint did not return a JSON object") when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
#1208 <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Wrap ``http.client.HTTPException`` (e.g. ``IncompleteRead`` from a
  truncated response) in ``PyJWKClient.fetch_data`` as
  ``PyJWKClientConnectionError``, matching the other network failure
  modes the method already documents.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security

Harden HMAC key validation against public-key material supplied as JWK,
JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>,
GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>.
Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
redirected destinations from being treated as trusted key sources. See
GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
Limit repeated JWKS refreshes caused by unknown key IDs while preserving
normal key-rotation behavior. See
GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
Handle deeply nested and malformed JWS/JWK input without uncaught recursion
errors or whole-set parsing failures. See
GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
Stop mutating the caller-supplied options mapping during decode
when verify_signature is false, so a mapping reused across a
signature-disabled peek and a fully verified decode cannot silently
skip registered-claim verification. See
GHSA-gvp8-978c-rx2q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q>__.
Enforce compact JWS encoding rules during decoding. See
GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed


- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__
-----------------------------------------------------------------------

Security

Reject JWK JSON documents passed as raw HMAC secrets in
HMACAlgorithm.prepare_key to close an algorithm-confusion gap that
the existing PEM/SSH guard did not cover. Reported by @aradona91 in
GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>__.
Bind the JWT header alg to PyJWK.algorithm_name during
verification so the caller's algorithms=[...] allow-list cannot be
bypassed when decoding with a PyJWK / PyJWKClient key. Reported
by @sushi-gif in GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>__.
Reject non-http(s) URI schemes in PyJWKClient so attacker-
influenced URIs cannot read local files or reach unintended schemes via
urllib's default file:// / ftp:// / data: handlers. Reported
by @KEIJOT in GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>__.
Preserve the cached JWK Set on fetch errors in PyJWKClient.fetch_data.
The previous finally-block put(None) pattern cleared the cache
on any transient outage, turning one bad JWKS request into application-
wide auth failure. Reported by @eddieran in GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>__.
Skip the unconditional base64 decode of the compact-form payload segment
when b64=false is set in the protected header, and require that
segment to be empty (RFC 7515 Appendix F detached form). Closes an
unauthenticated DoS amplifier. Reported by @thesmartshadow in
GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>__.

Fixed


- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``"b64"`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups by @kurtmckee in #1152 <https://github.com/jpadilla/pyjwt/pull/1152>__

`v2.15.0`

Compare Source

See the 2.15.0 changelog for complete release details.

`v2.14.0`

Compare Source

See the 2.14.0 changelog for the complete release details and related security advisories.

`v2.13.0`

Compare Source

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @aradona91.
GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @sushi-gif.
GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @thesmartshadow.
GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @KEIJOT.
GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @eddieran.

Fixed

Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @SnailSploit and @spartan8806 for the reports.
Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @WLUB for the report.
RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @MachineLearning-Nerd for the report.

Changed

Migrate the dev, docs, and tests package extras to dependency groups, by @kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

`v2.12.1`

Compare Source

Fixed


- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed

Annotate PyJWKSet.keys for pyright by @tamird in #1134 <https://github.com/jpadilla/pyjwt/pull/1134>__
Close HTTPError response to prevent ResourceWarning on Python 3.14 by @veeceey in #1133 <https://github.com/jpadilla/pyjwt/pull/1133>__
Do not keep algorithms dict in PyJWK instances by @akx in #1143 <https://github.com/jpadilla/pyjwt/pull/1143>__
Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>__
Use PyJWK algorithm when encoding without explicit algorithm in #1148 <https://github.com/jpadilla/pyjwt/pull/1148>__

Added


- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed

Enforce ECDSA curve validation per RFC 7518 Section 3.4.
Fix build system warnings by @kurtmckee in #1105 <https://github.com/jpadilla/pyjwt/pull/1105>__
Validate key against allowed types for Algorithm family in #964 <https://github.com/jpadilla/pyjwt/pull/964>__
Add iterator for JWKSet in #1041 <https://github.com/jpadilla/pyjwt/pull/1041>__
Validate iss claim is a string during encoding and decoding by @pachewise in #1040 <https://github.com/jpadilla/pyjwt/pull/1040>__
Improve typing/logic for options in decode, decode_complete by @pachewise in #1045 <https://github.com/jpadilla/pyjwt/pull/1045>__
Declare float supported type for lifespan and timeout by @nikitagashkov in #1068 <https://github.com/jpadilla/pyjwt/pull/1068>__
Fix SyntaxWarning\s/DeprecationWarning\s caused by invalid escape sequences by @kurtmckee in #1103 <https://github.com/jpadilla/pyjwt/pull/1103>__
Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in #1114 <https://github.com/jpadilla/pyjwt/pull/1114>__
Development: Test type annotations across all supported Python versions,
increase the strictness of the type checking, and remove the mypy pre-commit hook
by @kurtmckee in #1112 <https://github.com/jpadilla/pyjwt/pull/1112>__

Added


- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed

Prevent partial matching of iss claim by @fabianbadoi in GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>__

`v2.12.0`

Compare Source

Fixed


- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed

Annotate PyJWKSet.keys for pyright by @tamird in #1134 <https://github.com/jpadilla/pyjwt/pull/1134>__
Close HTTPError response to prevent ResourceWarning on Python 3.14 by @veeceey in #1133 <https://github.com/jpadilla/pyjwt/pull/1133>__
Do not keep algorithms dict in PyJWK instances by @akx in #1143 <https://github.com/jpadilla/pyjwt/pull/1143>__
Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>__
Use PyJWK algorithm when encoding without explicit algorithm in #1148 <https://github.com/jpadilla/pyjwt/pull/1148>__

Added


- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed

Enforce ECDSA curve validation per RFC 7518 Section 3.4.
Fix build system warnings by @kurtmckee in #1105 <https://github.com/jpadilla/pyjwt/pull/1105>__
Validate key against allowed types for Algorithm family in #964 <https://github.com/jpadilla/pyjwt/pull/964>__
Add iterator for JWKSet in #1041 <https://github.com/jpadilla/pyjwt/pull/1041>__
Validate iss claim is a string during encoding and decoding by @pachewise in #1040 <https://github.com/jpadilla/pyjwt/pull/1040>__
Improve typing/logic for options in decode, decode_complete by @pachewise in #1045 <https://github.com/jpadilla/pyjwt/pull/1045>__
Declare float supported type for lifespan and timeout by @nikitagashkov in #1068 <https://github.com/jpadilla/pyjwt/pull/1068>__
Fix SyntaxWarning\s/DeprecationWarning\s caused by invalid escape sequences by @kurtmckee in #1103 <https://github.com/jpadilla/pyjwt/pull/1103>__
Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in #1114 <https://github.com/jpadilla/pyjwt/pull/1114>__
Development: Test type annotations across all supported Python versions,
increase the strictness of the type checking, and remove the mypy pre-commit hook
by @kurtmckee in #1112 <https://github.com/jpadilla/pyjwt/pull/1112>__

Added


- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed

Prevent partial matching of iss claim by @fabianbadoi in GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>__

`v2.11.0`

Compare Source

What's Changed

Fixed type error in comment by @shuhaib-aot in #1026
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1018
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1033
Make note of use of leeway with nbf by @djw8605 in #1034
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1035
Fixes #964: Validate key against allowed types for Algorithm family by @pachewise in #985
Feat #1024: Add iterator for PyJWKSet by @pachewise in #1041
Fixes #1039: Add iss, issuer type checks by @pachewise in #1040
Fixes #660: Improve typing/logic for options in decode, decode_complete; Improve docs by @pachewise in #1045
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1042
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1052
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1053
Fix #1022: Map algorithm=None to "none" by @qqii in #1056
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1055
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1058
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1060
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1061
Fixes #1047: Correct PyJWKClient.get_signing_key_from_jwt annotation by @khvn26 in #1048
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1062
Fixed doc string typo in _validate_jti() function #1063 by @kuldeepkhatke in #1064
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1065
Update SECURITY.md by @auvipy in #1057
Typing fix: use float instead of int for lifespan and timeout by @nikitagashkov in #1068
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1067
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1071
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1076
Fix TYP header documentation by @fobiasmog in #1046
doc: Document claims sub and jti by @cleder in #1088
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1077
Bump actions/setup-python from 5 to 6 by @dependabot[bot] in #1089
Bump actions/stale from 8 to 10 by @dependabot[bot] in #1090
Bump actions/checkout from 4 to 5 by @dependabot[bot] in #1083
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1091
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1093
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1096
Resolve package build warnings by @kurtmckee in #1105
Support Python 3.14, and test against PyPy 3.10+ by @kurtmckee in #1104
Fix a SyntaxWarning caused by invalid escape sequences by @kurtmckee in #1103
Standardize CHANGELOG links to PRs by @kurtmckee in #1110
Migrate from pep517, which is deprecated, to build by @kurtmckee in #1108
Fix incorrectly-named test suite function by @kurtmckee in #1116
Fix Read the Docs builds by @kurtmckee in #1111
Bump actions/download-artifact from 4 to 6 by @dependabot[bot] in #1118
Escalate test suite warnings to errors by @kurtmckee in #1107
Add pyupgrade as a pre-commit hook by @kurtmckee in #1109
Simplify the test suite decorators by @kurtmckee in #1113
Improve coverage config and eliminate unused test suite code by @kurtmckee in #1115
Build a shared wheel once in the test suite by @kurtmckee in #1114
Bump actions/checkout from 5 to 6 by @dependabot[bot] in #1122
Thoroughly test type annotations, and resolve errors by @kurtmckee in #1112
Fix leeway value in usage documentation by @Matthew1471 in #1124
Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in #1125

New Contributors

@shuhaib-aot made their first contribution in #1026
@qqii made their first contribution in #1056
@khvn26 made their first contribution in #1048
@kuldeepkhatke made their first contribution in #1064
@nikitagashkov made their first contribution in #1068
@fobiasmog made their first contribution in #1046
@Matthew1471 made their first contribution in #1124

Full Changelog: jpadilla/pyjwt@2.10.1...2.11.0

Configuration

📅 Schedule: (in timezone Europe/Oslo)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

renovate Bot added the dependencies label Jan 30, 2026

renovate Bot assigned promise Jan 30, 2026

renovate Bot force-pushed the renovate/pyjwt-2.x branch 6 times, most recently from 6aa4647 to c9078a7 Compare February 5, 2026 09:40

renovate Bot force-pushed the renovate/pyjwt-2.x branch 6 times, most recently from 95cdaa8 to 86464e5 Compare February 13, 2026 13:40

renovate Bot force-pushed the renovate/pyjwt-2.x branch 5 times, most recently from bf35599 to 471c71a Compare March 3, 2026 20:44

renovate Bot force-pushed the renovate/pyjwt-2.x branch 3 times, most recently from 8a55c13 to c674a8d Compare March 12, 2026 01:13

renovate Bot changed the title ~~chore(deps): update dependency pyjwt to v2.11.0~~ chore(deps): update dependency pyjwt to v2.12.0 Mar 12, 2026

renovate Bot force-pushed the renovate/pyjwt-2.x branch from c674a8d to e095ecd Compare March 12, 2026 18:14

renovate Bot changed the title ~~chore(deps): update dependency pyjwt to v2.12.0~~ chore(deps): update dependency pyjwt to v2.12.1 Mar 13, 2026

renovate Bot force-pushed the renovate/pyjwt-2.x branch from e095ecd to 80be1a5 Compare March 13, 2026 20:56

renovate Bot force-pushed the renovate/pyjwt-2.x branch 3 times, most recently from 5951dd1 to 9856cb8 Compare April 1, 2026 05:36

renovate Bot force-pushed the renovate/pyjwt-2.x branch from 9856cb8 to 52e49b8 Compare April 7, 2026 21:20

renovate Bot force-pushed the renovate/pyjwt-2.x branch 4 times, most recently from b6d8ced to fcbc464 Compare April 26, 2026 22:01

renovate Bot force-pushed the renovate/pyjwt-2.x branch 3 times, most recently from 2cb02f6 to 5f4ff32 Compare May 5, 2026 17:48

renovate Bot force-pushed the renovate/pyjwt-2.x branch 5 times, most recently from c0153f4 to 76383dc Compare May 16, 2026 21:43

renovate Bot force-pushed the renovate/pyjwt-2.x branch 2 times, most recently from 419d8ee to 8cd8fa3 Compare May 20, 2026 00:52

renovate Bot changed the title ~~chore(deps): update dependency pyjwt to v2.12.1~~ chore(deps): update dependency pyjwt to v2.13.0 May 21, 2026

renovate Bot force-pushed the renovate/pyjwt-2.x branch 4 times, most recently from 7644192 to 3b1d39e Compare May 24, 2026 21:32

renovate Bot force-pushed the renovate/pyjwt-2.x branch 5 times, most recently from da8058b to 6b696b7 Compare June 4, 2026 01:27

renovate Bot force-pushed the renovate/pyjwt-2.x branch 2 times, most recently from 04b8a6c to 3d95fc5 Compare June 11, 2026 15:44

renovate Bot force-pushed the renovate/pyjwt-2.x branch 3 times, most recently from f459d20 to e60217d Compare June 19, 2026 03:54

fix(deps): update dependency pyjwt to v2.15.1

9aa779a

Navigation Menu

Repository navigation

fix(deps): update dependency pyjwt to v2.15.1 - #494

fix(deps): update dependency pyjwt to v2.15.1#494
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pyjwt-2.x

renovate Bot commented Jan 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.15.1

v2.15.0

v2.14.0

v2.13.0

PyJWT 2.13.0 — Security Release

Security

Fixed

Changed

Upgrade notes

v2.12.1

v2.12.0

v2.11.0

What's Changed

New Contributors

Configuration

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jan 30, 2026 •

edited

Loading

`v2.15.1`

`v2.15.0`

`v2.14.0`

`v2.13.0`

`v2.12.1`

`v2.12.0`

`v2.11.0`