CVS commit: pkgsrc/textproc/py-JWT

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Sep 13 12:56:50 UTC 2026

Modified Files:
        pkgsrc/textproc/py-JWT: Makefile distinfo

Log Message:
py-JWT: update to 2.14.0.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security
~~~~~~~~

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce detached-payload and compact JWS encoding rules during decoding.
  See `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__
  and `GHSA-mvj7-wp6q-v59j <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-mvj7-wp6q-v59j>`__.

Fixed
~~~~~

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.


To generate a diff of this commit:
cvs rdiff -u -r1.34 -r1.35 pkgsrc/textproc/py-JWT/Makefile
cvs rdiff -u -r1.28 -r1.29 pkgsrc/textproc/py-JWT/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/py-JWT/Makefile
diff -u pkgsrc/textproc/py-JWT/Makefile:1.34 pkgsrc/textproc/py-JWT/Makefile:1.35
--- pkgsrc/textproc/py-JWT/Makefile:1.34        Sun May 24 18:24:13 2026
+++ pkgsrc/textproc/py-JWT/Makefile     Sun Sep 13 12:56:50 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.34 2026/05/24 18:24:13 wiz Exp $
+# $NetBSD: Makefile,v 1.35 2026/09/13 12:56:50 wiz Exp $
 
-DISTNAME=      pyjwt-2.13.0
+DISTNAME=      pyjwt-2.14.0
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/pyjwt/JWT/}
 CATEGORIES=    textproc python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=P/PyJWT/}

Index: pkgsrc/textproc/py-JWT/distinfo
diff -u pkgsrc/textproc/py-JWT/distinfo:1.28 pkgsrc/textproc/py-JWT/distinfo:1.29
--- pkgsrc/textproc/py-JWT/distinfo:1.28        Sun May 24 18:24:13 2026
+++ pkgsrc/textproc/py-JWT/distinfo     Sun Sep 13 12:56:50 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.28 2026/05/24 18:24:13 wiz Exp $
+$NetBSD: distinfo,v 1.29 2026/09/13 12:56:50 wiz Exp $
 
-BLAKE2s (pyjwt-2.13.0.tar.gz) = 979d948b8ff340fe63e7e79d7597b897907fd181ded03c0b7cf3ae11b48107c3
-SHA512 (pyjwt-2.13.0.tar.gz) = e12fcc5171e48ef74f4384287c05d94367b7add4844066b650abd6c82534e557959f59ffce9bd6d4dc6970b99b7357be5bb652d0546937b3a64dfd329b63b561
-Size (pyjwt-2.13.0.tar.gz) = 107515 bytes
+BLAKE2s (pyjwt-2.14.0.tar.gz) = db0c5b3faedbe47055a9187e9a4adc67fc65952e25e3112fb0b3f4cbdb16fca2
+SHA512 (pyjwt-2.14.0.tar.gz) = 33b5ea83edb24fd4d73cc471c1d5ecbd0be45eef1d19c873a0a9a5615d2d52d8401176c71287a466c05f1086479dabeded203910c5815927574b8ebd07428936
+Size (pyjwt-2.14.0.tar.gz) = 113177 bytes