build(deps): Bump python-jose[cryptography] from 3.3.0 to 3.5.0 in /services/context-broker

[dependabot]

Bumps python-jose[cryptography] from 3.3.0 to 3.5.0.

Release notes

Sourced from python-jose[cryptography]'s releases.

3.5.0

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

https://pypi.org/project/python-jose/3.5.0/

3.4.0

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Changelog

Sourced from python-jose[cryptography]'s changelog.

3.5.0 -- 2025-05-28

News

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

3.4.0 -- 2025-02-14

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Commits

• 018b310 Prepare release 3.5.0 (#388)
• 393c374 Improve jwt.decode key doc (#198)
• 50d4390 utils.py: fix types in docstrings for base64url_encode/decode (#269)
• 8fd0b63 Add RTD config file to silence emailed deprecation warnings (#333)
• 6f03385 Added possibility to call jwk.construct() with a private key (#295)
• 2f0aca6 Add python_requires arg to setup.cfg (#273)
• 895777e Updated pyasn version to match latest (#338)
• 45bd124 Update jwk.py (#328)
• 1f0ae0a docs: Fix a few typos (#299)
• ceaac36 Do not use utc_now on module level (#372)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/python-jose	3.5.0	🟢 5.1	Details Check Score Reason Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Code-Review 🟢 6 Found 17/27 approved changesets -- score normalized to 6 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• services/context-broker/requirements.txt