[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
aiohttp	3.14.4 → 3.14.5			dependencies	patch
mako	1.4.2 → 1.4.3			dependencies	patch
pip (changelog)	==26.2.1 → ==26.2.2				patch
pyjwt	2.15.0 → 2.15.1			dependencies	patch
pytest-asyncio (changelog)	1.4.0 → 1.4.1			dev	patch	1.4.1.post1
redis (source)	8.10.1 → 8.10.2				patch	8.10.3

---

Release Notes

aio-libs/aiohttp (aiohttp)

v3.14.5

Compare Source

===================

Bug fixes

• Stopped failing the WebSocket connection when a control frame has RSV1 set after permessage-deflate was negotiated; some clients set the bit on every frame and control frames are never decompressed -- by :user:bdraco.

  Related issues and pull requests on GitHub:
  :issue:14007.

Contributor-facing changes

• Changed two client tests to pass with a yarl that rejects an http URL
  with an empty host, such as http://, and writes http:/ without the
  // it used to add
  -- by :user:asvetlov.

  Related issues and pull requests on GitHub:
  :issue:13964.

---

pypa/pip (pip)

v26.2.2

Compare Source

jpadilla/pyjwt (pyjwt)

v2.15.1

Compare Source

Changed

- Add public ``jwt.decode`` regression coverage for AWS ALB-style padded
  ES256 tokens, including rejection of tampered payloads and signatures,
  in `#&#8203;1211 <https://github.com/jpadilla/pyjwt/pull/1211>`__.

`v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`#&#8203;1209 <https://github.com/jpadilla/pyjwt/issues/1209>`__).

`v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>`__
-----------------------------------------------------------------------

Security

• Wrap recursion errors from deeply nested JWT payloads in DecodeError
  instead of exposing a raw RecursionError.

Added

- Support Python 3.15 by @kytta in `#&#8203;1202 <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

• JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
  payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
  accepts either form and raises PyJWKSetError for anything else. As a
  result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
  for as long as it stays cached, rather than a freshly built one per call in
  #&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>__
• PyJWKClient.fetch_data() now raises
  PyJWKClientError("The JWKS endpoint did not return a JSON object") when
  the endpoint response is not a JSON object, instead of returning it for
  get_jwk_set() to reject. Callers reaching the JWKS through
  get_jwk_set() see the same error as before in
  #&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed

- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `#&#8203;914 <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
  a JSON object is skipped, a key whose components have the wrong type raises
  ``InvalidKeyError`` and is skipped, and a set left with no usable keys raises
  ``PyJWKSetError``. A single bad entry no longer fails an otherwise usable
  JWK Set in `#&#8203;1208 <https://github.com/jpadilla/pyjwt/pull/1208>`__
- Wrap ``http.client.HTTPException`` (e.g. ``IncompleteRead`` from a
  truncated response) in ``PyJWKClient.fetch_data`` as
  ``PyJWKClientConnectionError``, matching the other network failure
  modes the method already documents.

`v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>`__
-----------------------------------------------------------------------

Security

• Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>,
  GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>,
  GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>,
  and GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>.
• Reject automatic redirects when PyJWKClient fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>__.
• Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>__.
• Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>__
  and GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>__.
• Stop mutating the caller-supplied options mapping during decode
  when verify_signature is false, so a mapping reused across a
  signature-disabled peek and a fully verified decode cannot silently
  skip registered-claim verification. See
  GHSA-gvp8-978c-rx2q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q>__.
• Enforce compact JWS encoding rules during decoding. See
  GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>__.
• Reject detached-payload arguments for attached JWS inputs. Thanks to @xclow3n <https://github.com/xclow3n>__ for reporting this behavior; fixed in commit
  37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>__.

Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89>`__.

`v2.13.0 <https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0>`__
-----------------------------------------------------------------------

Security

• Reject JWK JSON documents passed as raw HMAC secrets in
  HMACAlgorithm.prepare_key to close an algorithm-confusion gap that
  the existing PEM/SSH guard did not cover. Reported by @​aradona91 in
  GHSA-xgmm-8j9v-c9wx <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx>__.
• Bind the JWT header alg to PyJWK.algorithm_name during
  verification so the caller's algorithms=[...] allow-list cannot be
  bypassed when decoding with a PyJWK / PyJWKClient key. Reported
  by @​sushi-gif in GHSA-jq35-7prp-9v3f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f>__.
• Reject non-http(s) URI schemes in PyJWKClient so attacker-
  influenced URIs cannot read local files or reach unintended schemes via
  urllib's default file:// / ftp:// / data: handlers. Reported
  by @​KEIJOT in GHSA-993g-76c3-p5m4 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4>__.
• Preserve the cached JWK Set on fetch errors in PyJWKClient.fetch_data.
  The previous finally-block put(None) pattern cleared the cache
  on any transient outage, turning one bad JWKS request into application-
  wide auth failure. Reported by @​eddieran in GHSA-fhv5-28vv-h8m8 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8>__.
• Skip the unconditional base64 decode of the compact-form payload segment
  when b64=false is set in the protected header, and require that
  segment to be empty (RFC 7515 Appendix F detached form). Closes an
  unauthenticated DoS amplifier. Reported by @​thesmartshadow in
  GHSA-w7vc-732c-9m39 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39>__.

Fixed

- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with
  ``InvalidKeyError`` instead of accepting them with only a warning.
  Thanks to @SnailSploit and @spartan8806 for independently flagging the
  footgun.
- Forward per-call ``options`` (including ``enforce_minimum_key_length``)
  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the
  option actually takes effect when set at the call site rather than only
  on the ``PyJWT`` instance. Thanks to @WLUB for the report.
- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds
  ``"b64"`` to the ``crit`` header parameter, and the decoder rejects
  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to
  @MachineLearning-Nerd for the report.

Changed

• Migrate the dev, docs, and tests package extras to dependency groups by @​kurtmckee in #&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>__

pytest-dev/pytest-asyncio (pytest-asyncio)

v1.4.1: pytest-asyncio v1.4.1

Compare Source

1.4.1 - 2026-10-25

Added

• Declared support for Python 3.15 (#​1588)

Fixed

• Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#​1090)

Notes for Downstream Packagers

• Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#​1518)

redis/docker-library-redis (redis)

v8.10.2

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 5pm on the first day of the month,on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.