diff mbox series

[meta-python,5/7] python-pyjwt: upgrade 2.11.0 -> 2.12.1

Message ID 20260317172346.2862459-5-skandigraun@gmail.com
State Under Review
Headers show
Series [meta-oe,1/7] libsodium: mark CVE-2025-69277 patched | expand

Commit Message

Gyorgy Sarvari March 17, 2026, 5:23 p.m. UTC 
Contains fix for CVE-2026-32597. Since NVD tracks this CVE
without version info, mark the CVE explicitly patched.

Changes:
2.12.1:
Add typing_extensions dependency for Python < 3.11

2.12.0:
chore(docs): fix docs build
Annotate PyJWKSet.keys for pyright
fix: close HTTPError to prevent ResourceWarning on Python 3.14
chore: remove superfluous constants
chore(tests): enable mypy
Bump actions/download-artifact from 7 to 8
fix: do not store reference to algorithms dict on PyJWK
Use PyJWK algorithm when encoding without explicit algorithm
Validate the crit (Critical) Header Parameter defined in RFC 7515 ยง4.1.11. (CVE-2026-32597)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../{python3-pyjwt_2.11.0.bb => python3-pyjwt_2.12.1.bb}      | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 rename meta-python/recipes-devtools/python/{python3-pyjwt_2.11.0.bb => python3-pyjwt_2.12.1.bb} (80%)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.11.0.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
similarity index 80%
rename from meta-python/recipes-devtools/python/python3-pyjwt_2.11.0.bb
rename to meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
index 4e81efe45f..28eceece97 100644
--- a/meta-python/recipes-devtools/python/python3-pyjwt_2.11.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.12.1.bb
@@ -5,11 +5,12 @@  HOMEPAGE = "https://github.com/jpadilla/pyjwt"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e4b56d2c9973d8cf54655555be06e551"
 
-SRC_URI[sha256sum] = "35f95c1f0fbe5d5ba6e43f00271c275f7a1a4db1dab27bf708073b75318ea623"
+SRC_URI[sha256sum] = "c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b"
 
 PYPI_PACKAGE = "pyjwt"
 CVE_PRODUCT = "pyjwt"
 CVE_STATUS[CVE-2025-45768] = "disputed: vulnerability can be avoided if the library is used correctly"
+CVE_STATUS[CVE-2026-32597] = "fixed-version: fixed in 2.12.0"
 
 inherit pypi python_setuptools_build_meta
 
@@ -19,3 +20,4 @@  RDEPENDS:${PN} = "\
 "
 
 BBCLASSEXTEND = "native nativesdk"
+