chore: Replace python-jose with PyJWT #3521
Merged
+30
−65
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
anoadragon453
added a commit
to anoadragon453/nixpkgs
that referenced
this pull request
May 7, 2024
* authlib was required in v1.4.0 (mealie-recipes/mealie#3280) * pillow-heif was required in v1.5.0 (mealie-recipes/mealie#3409) * pydantic-settings was required in v1.3.0 (mealie-recipes/mealie#3134 - same PR as pydantic v2 bump) * pyjwt was required in v1.6.0 (mealie-recipes/mealie#3521)
anoadragon453
added a commit
to anoadragon453/nixpkgs
that referenced
this pull request
May 7, 2024
This was replaced by pyjwt. See mealie-recipes/mealie#3521.
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
(REQUIRED)
What this PR does / why we need it:
(REQUIRED)
python-jose has a high-security vulnerability which has been known about for a month, but python-jose hasn't been updated in a year.
PyJWT is much more actively updated and fixed the same issue several versions ago.
I don't think we're actually impacted by this issue because we always specify the algorithm explicitly, but it was such an easy dependency replacement I thought it would be a good idea to take care of it now.
Which issue(s) this PR fixes:
(REQUIRED)
Fixes https://github.com/mealie-recipes/mealie/security/dependabot/194
Fixes https://github.com/mealie-recipes/mealie/security/dependabot/195
Special notes for your reviewer:
(fill-in or delete this section)
Apparently this isn't the first time python-jose has been out of date