CVS commit: pkgsrc/security/py-authlib

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Nov  6 13:27:52 UTC 2026

Modified Files:
        pkgsrc/security/py-authlib: Makefile distinfo

Log Message:
py-authlib: updated to 1.9.5

1.9.5

Security

authlib.jose refuses as an HMAC secret every OpenSSH public key or certificate that it can load as an RSA, EC or OKP key. It used to accept a key with a tab after the key type, and certificates. 
These keys verify RS256 and EdDSA tokens, so anyone who knew the public key could forge an HS256 token for an application that did not restrict the algorithms. This completes the fix for 
CVE-2026-114615. GHSA-f7j6-p4qx-gq99


To generate a diff of this commit:
cvs rdiff -u -r1.42 -r1.43 pkgsrc/security/py-authlib/Makefile
cvs rdiff -u -r1.39 -r1.40 pkgsrc/security/py-authlib/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/py-authlib/Makefile
diff -u pkgsrc/security/py-authlib/Makefile:1.42 pkgsrc/security/py-authlib/Makefile:1.43
--- pkgsrc/security/py-authlib/Makefile:1.42    Thu Nov  5 07:09:05 2026
+++ pkgsrc/security/py-authlib/Makefile Fri Nov  6 13:27:52 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.42 2026/11/05 07:09:05 adam Exp $
+# $NetBSD: Makefile,v 1.43 2026/11/06 13:27:52 adam Exp $
 
-DISTNAME=      authlib-1.9.4
+DISTNAME=      authlib-1.9.5
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    security python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=a/authlib/}

Index: pkgsrc/security/py-authlib/distinfo
diff -u pkgsrc/security/py-authlib/distinfo:1.39 pkgsrc/security/py-authlib/distinfo:1.40
--- pkgsrc/security/py-authlib/distinfo:1.39    Thu Nov  5 07:09:05 2026
+++ pkgsrc/security/py-authlib/distinfo Fri Nov  6 13:27:52 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.39 2026/11/05 07:09:05 adam Exp $
+$NetBSD: distinfo,v 1.40 2026/11/06 13:27:52 adam Exp $
 
-BLAKE2s (authlib-1.9.4.tar.gz) = 01b0efff3f346d61333eab6528774c999a7742270827060426ec9db55034468a
-SHA512 (authlib-1.9.4.tar.gz) = 93b96ad56eeef9218edb0d72f16bbe27c55f72aa07514db1e2318c5af9752e1b389dd30059507f86d6a81835083936cbb6998e489d35def8bf9d918ef2aeaa65
-Size (authlib-1.9.4.tar.gz) = 183479 bytes
+BLAKE2s (authlib-1.9.5.tar.gz) = a519758dd4d2cc6334c1047d7dd1e191edd7433c68e5c9b20cf161268ebbf74d
+SHA512 (authlib-1.9.5.tar.gz) = e405ee86ebf947f1bfb491084d1bcc893ea367dd6bf9bf198302b2260d1a4ca628113f2898a9759ba9950d4f8331cacb9f09f2495f710eae86ab01e8407dce0a
+Size (authlib-1.9.5.tar.gz) = 183564 bytes