CVS commit: pkgsrc/security/py-authlib

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Nov  3 14:04:51 UTC 2026

Modified Files:
        pkgsrc/security/py-authlib: Makefile distinfo

Log Message:
py-authlib: updated to 1.9.3

Version 1.9.3 — 2026-11-03

Security

The OpenID Connect implicit and hybrid grants refuse response_mode=form_post when the redirect URI does not use the http or https scheme. They return an invalid_request error and do not redirect. A 
client with a javascript: redirect URI could run a script in the origin of the authorization server, even when the user denied the authorization. GHSA-gp2m-377p-m4j3

Version 1.9.2 — 2026-11-01

Security

IDJAGGrant limits the access token to the scopes in the scope claim of the ID-JAG. A client used to get any scope allowed by its registration, even when the IdP granted fewer scopes. Without a scope 
request parameter, the access token now gets the scopes of the claim instead of no scope. GHSA-f3fg-34g9-v7jx


To generate a diff of this commit:
cvs rdiff -u -r1.40 -r1.41 pkgsrc/security/py-authlib/Makefile
cvs rdiff -u -r1.37 -r1.38 pkgsrc/security/py-authlib/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-authlib/Makefile
diff -u pkgsrc/security/py-authlib/Makefile:1.40 pkgsrc/security/py-authlib/Makefile:1.41
--- pkgsrc/security/py-authlib/Makefile:1.40    Tue Oct 20 04:50:37 2026
+++ pkgsrc/security/py-authlib/Makefile Tue Nov  3 14:04:51 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.40 2026/10/20 04:50:37 adam Exp $
+# $NetBSD: Makefile,v 1.41 2026/11/03 14:04:51 adam Exp $
 
-DISTNAME=      authlib-1.9.1
+DISTNAME=      authlib-1.9.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/authlib/}

Index: pkgsrc/security/py-authlib/distinfo
diff -u pkgsrc/security/py-authlib/distinfo:1.37 pkgsrc/security/py-authlib/distinfo:1.38
--- pkgsrc/security/py-authlib/distinfo:1.37    Tue Oct 20 04:50:37 2026
+++ pkgsrc/security/py-authlib/distinfo Tue Nov  3 14:04:51 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.37 2026/10/20 04:50:37 adam Exp $
+$NetBSD: distinfo,v 1.38 2026/11/03 14:04:51 adam Exp $
 
-BLAKE2s (authlib-1.9.1.tar.gz) = 6a6fc56f14b0bbe5ef0f941285fb45a1657952b1864262d7e32aebf66c79b6cb
-SHA512 (authlib-1.9.1.tar.gz) = 241ba340e2f8aa0682640c4e558f3d82844814de1a7a3ef2a70ebf4c6337c4a2d330c63adc1c3334239e5929f0c19b7b99d646fa5b82f5fa8a2c918ab4ecffaf
-Size (authlib-1.9.1.tar.gz) = 182700 bytes
+BLAKE2s (authlib-1.9.3.tar.gz) = 0df34bedabf78cbfc86c4d398d95946bd9420c7845f9574ae2afffccc221f6e7
+SHA512 (authlib-1.9.3.tar.gz) = c508ee643e27c2493178561df4b68b7f89ec5f4d529bb0dcd40af43f36cafdbdbb0fc78a9db3ec2c52889441826f29531f8e85c32bac17a4e1c4b196782c6d05
+Size (authlib-1.9.3.tar.gz) = 183209 bytes