Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 19, 2021

Bumps authlib from 0.15.3 to 0.15.5.

Release notes

Sourced from authlib's releases.

Version 0.15.5

  • Make Authlib compatible with latest httpx
  • Make Authlib compatible with latest werkzeug
  • Allow customize RFC7523 alg value

Version 0.15.4

Security fix when JWT claims is None.

For example, JWT payload has iss=None:

{
  "iss": None,
  ...
}

But we need to decode it with claims:

claims_options = {
  'iss': {'essential': True, 'values': ['required']}
}
jwt.decode(token, key, claims_options=claims_options)

It didn't raise an error before this fix.

Changelog

Sourced from authlib's changelog.

Version 0.15.5

Released on Oct 18, 2021.

  • Make Authlib compatible with latest httpx
  • Make Authlib compatible with latest werkzeug
  • Allow customize RFC7523 alg value

Version 0.15.4

Released on Jul 17, 2021.

  • Security fix when JWT claims is None
Commits
  • d8e428c Version bump 0.15.5
  • f249628 Add changelog
  • 38ac0d2 Improve rfc7523 parameters compatibility.
  • e880f16 Rename parameters of InsufficientScopeError
  • afaeaf9 Merge pull request #392 from minddistrict/allow-passing-in-additionl-jwt-headers
  • 38c6444 Merge pull request #333 from jeffsawatzky/maintain-0.15
  • 2ea533c Merge pull request #388 from minddistrict/backport-httpx-oauth2-client-fixes-...
  • fca7f85 fix assertion client for httpx
  • 4d8a6ef Merge pull request #390 from minddistrict/parameterize-signing-algoritm-for-r...
  • 1e511ed Merge pull request #393 from nam3less/maintain-0.15-bugfix-377
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [authlib](https://github.com/lepture/authlib) from 0.15.3 to 0.15.5.
- [Release notes](https://github.com/lepture/authlib/releases)
- [Changelog](https://github.com/lepture/authlib/blob/v0.15.5/docs/changelog.rst)
- [Commits](authlib/authlib@v0.15.3...v0.15.5)

---
updated-dependencies:
- dependency-name: authlib
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 19, 2021
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Mar 16, 2022

Superseded by #116.

@dependabot dependabot bot closed this Mar 16, 2022
@dependabot dependabot bot deleted the dependabot/pip/authlib-0.15.5 branch March 16, 2022 05:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant