chore(release): bump version to 1.6.2

Co-Authored-By: Claude Sonnet 5 <[email protected]>
fix(auth): replace unmaintained python-jose with PyJWT
2026-10-20 08:47:40 +02:00 · 2026-10-20 08:47:33 +02:00 · 2026-10-20 08:42:12 +02:00 · 2026-10-20 08:42:03 +02:00
3 changed files with 14 additions and 13 deletions
@@ -3,9 +3,10 @@
 from datetime import datetime, timedelta
 from typing import Optional

+import jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from jose import JWTError, jwt
+from jwt import PyJWTError
 from sqlalchemy.orm import Session

 from app.database import get_db
@@ -56,7 +57,7 @@ def verify_mfa_token(token: str) -> str:
                detail="Invalid MFA token.",
            )
        return username
-    except JWTError:
+    except PyJWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="MFA token expired or invalid.",
@@ -95,7 +96,7 @@ def get_current_user(
                status_code=status.HTTP_401_UNAUTHORIZED,
                detail="Invalid token payload.",
            )
-    except JWTError:
+    except PyJWTError:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid or expired token.",
@@ -34,7 +34,7 @@ logger = logging.getLogger(__name__)
 app = FastAPI(
    title="NetBird MSP Appliance",
    description="Multi-tenant NetBird management platform for MSPs",
-    version="1.6.0",
+    version="1.6.2",
    docs_url="/api/docs",
    redoc_url="/api/redoc",
    openapi_url="/api/openapi.json",
@@ -5,24 +5,24 @@ sqlalchemy==2.0.23
 aiosqlite==0.19.0
 pydantic==2.5.2
 pydantic-settings==2.1.0
-python-jose[cryptography]==3.3.0
+PyJWT==2.15.1
 passlib[bcrypt]==1.7.4
 bcrypt==4.1.2
-cryptography==41.0.7
-python-multipart==0.0.6
-httpx==0.26.0
-jinja2==3.1.2
+cryptography==50.0.0
+python-multipart==0.0.31
+httpx==0.28.1
+jinja2==3.1.6
 docker==7.0.0
 requests<2.32.0
 urllib3<2
 psutil==5.9.7
 pyyaml==6.0.1
-msal==1.28.0
+msal==1.39.0
 pyotp==2.9.0
 qrcode[pil]==7.4.2
 slowapi==0.1.9
 pywinrm>=0.4.3
 ldap3>=2.9.1
-pytest==7.4.3
-pytest-asyncio==0.23.2
-pytest-httpx==0.28.0
+pytest==9.0.3
+pytest-asyncio==1.4.0
+pytest-httpx==0.36.2
Author	SHA1	Message	Date
twothatITandClaude Sonnet 5	419598220a	chore(release): bump version to 1.6.2 Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-10-20 08:47:40 +02:00
twothatITandClaude Sonnet 5	565dc5f710	fix(auth): replace unmaintained python-jose with PyJWT Dependabot alert #25 (python-jose algorithm confusion guard bypassed by DER-encoded public keys, CVE-2026-85394, Critical) has no patched version of python-jose available at all - it's affected through the latest release 3.5.0. python-jose was only used in app/dependencies.py for plain HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...] was already explicitly restricted on every decode call, so the specific RS256/HS256 confusion path didn't apply here), but staying on an unmaintained library that keeps generating unfixable critical alerts isn't sustainable. Swapped to PyJWT, which is actively maintained, already pulled in transitively via msal, and a near drop-in replacement for this app's encode()/decode() usage. Verified with a Docker build and in-container token create/verify/reject round-trip. Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-10-20 08:47:33 +02:00
twothatITandClaude Sonnet 5	4078295ea9	chore(release): bump version to 1.6.1 Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-10-20 08:42:12 +02:00
twothatITandClaude Sonnet 5	6b5cbc722f	fix(deps): resolve all 25 open Dependabot alerts Bumps every flagged dependency to its patched (or latest compatible) version: python-jose 3.3.0->3.4.0 (2 critical algorithm-confusion alerts), cryptography 41.0.7->50.0.0 (7 alerts incl. a Bleichenbacher timing oracle and outdated bundled OpenSSL), python-multipart 0.0.6->0.0.31 (9 alerts, incl. a high-severity arbitrary file write), Jinja2 3.1.2->3.1.6 (5 sandbox breakout / HTML injection alerts), and pytest 7.4.3->9.0.3 (1 alert, dev-only). msal had to move 1.28.0->1.39.0 because it pinned cryptography<45; httpx had to move 0.26.0->0.28.1 and pytest-asyncio 0.23.2->1.4.0 and pytest-httpx 0.28.0->0.36.2 to keep the dependency set resolvable together with the above. Verified with a full Docker build and a running container (health check, settings load, DB migrations all green). Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-10-20 08:42:03 +02:00