From 855daceccb14d9ccbc9d4e7131a3a29756cf37cf Mon Sep 17 00:00:00 2001
From: Jonathan Springer <jps@s390x.com>
Date: Mon, 5 Oct 2026 10:42:21 +0100
Subject: [PATCH] chore(deps): constrain PyJWT>=2.15.0 to resolve dependabot
 alerts

Address open dependabot security alerts against the root uv.lock:

- PyJWT 2.13.0 -> 2.15.0: fixes 10 advisories including the critical
  asymmetric-PEM detection bypass, JWKS redirect following, DER-keys-as-
  HMAC-secrets, and the RecursionError DoS (first patched in 2.15.0).

PyJWT is a transitive dependency, so it is pinned via
tool.uv.constraint-dependencies rather than added to project dependency
lists. uv.lock rebuilt with 'uv lock'; no other packages changed.

urllib3 (2.8.0, #192), anyio (4.14.2), cryptography (49.0.0), and hpack
(4.2.0) alerts are already resolved at their locked versions. Alerts
against deleted per-plugin uv.lock manifests are stale and will close on
the next dependabot scan.

Signed-off-by: Jonathan Springer <jps@s390x.com>
---
 pyproject.toml |  2 ++
 uv.lock        | 10 ++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index a7a1450..4998cbf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,10 +11,12 @@ constraint-dependencies = [
     "maturin>=1.13.3,<2.0",
     "mcp>=2.0.0",
     "pydantic>=2.13.5,<3",
+    "PyJWT>=2.15.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=1.3.0",
     "PyYAML>=6.0.3",
     "redis>=7.4.0",
+    "urllib3>=2.8.0",
 ]
 build-constraint-dependencies = [
     "maturin>=1.13.3,<2.0",
diff --git a/uv.lock b/uv.lock
index 2fb210b..50e24dc 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.11"
 resolution-markers = [
     "python_full_version >= '3.15' and sys_platform == 'win32'",
@@ -36,10 +36,12 @@ constraints = [
     { name = "maturin", specifier = ">=1.13.3,<2.0" },
     { name = "mcp", specifier = ">=2.0.0" },
     { name = "pydantic", specifier = ">=2.13.5,<3" },
+    { name = "pyjwt", specifier = ">=2.15.0" },
     { name = "pytest", specifier = ">=9.0.3" },
     { name = "pytest-asyncio", specifier = ">=1.3.0" },
     { name = "pyyaml", specifier = ">=6.0.3" },
     { name = "redis", specifier = ">=7.4.0" },
+    { name = "urllib3", specifier = ">=2.8.0" },
 ]
 build-constraints = [{ name = "maturin", specifier = ">=1.13.3,<2.0" }]
 
@@ -1630,11 +1632,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.15.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/02/a5/5197bfd06417837ac079921c66fa6393f1dea3557272a263cebfef69e432/pyjwt-2.15.0.tar.gz", hash = "sha256:b11c5f9791d7bf51c2b39a81ed669f6b2dbbd669df2942f6c60167e9e3d1abe4", size = 120513, upload-time = "2026-09-23T16:56:00.689Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/55/40e45bf052ee8ee12a4dfd785519660f8effa7b065442b91646ec6828619/pyjwt-2.15.0-py3-none-any.whl", hash = "sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8", size = 33680, upload-time = "2026-09-23T16:55:59.241Z" },
 ]
 
 [package.optional-dependencies]