fix(auth): replace unmaintained python-jose with PyJWT

Dependabot alert #25 (python-jose algorithm confusion guard bypassed by
DER-encoded public keys, CVE-2026-85394, Critical) has no patched version
of python-jose available at all - it's affected through the latest
release 3.5.0. python-jose was only used in app/dependencies.py for plain
HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...]
was already explicitly restricted on every decode call, so the specific
RS256/HS256 confusion path didn't apply here), but staying on an
unmaintained library that keeps generating unfixable critical alerts isn't
sustainable.

Swapped to PyJWT, which is actively maintained, already pulled in
transitively via msal, and a near drop-in replacement for this app's
encode()/decode() usage. Verified with a Docker build and in-container
token create/verify/reject round-trip.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

This commit is contained in:

twothatIT

2026-10-20 08:47:33 +02:00

co-authored by

Claude Sonnet 5

parent 4078295ea9

commit 565dc5f710

2 changed files with 5 additions and 4 deletions

requirements.txt

+1 -1

View File

@@ -5,7 +5,7 @@ sqlalchemy==2.0.23
 aiosqlite==0.19.0
 pydantic==2.5.2
 pydantic-settings==2.1.0
 python-jose[cryptography]==3.4.0
 PyJWT==2.15.1
 passlib[bcrypt]==1.7.4
 bcrypt==4.1.2
 cryptography==50.0.0