From a1aef0578347bddbaf7f67dab1b5ccaed082e6b6 Mon Sep 17 00:00:00 2001 From: etserend Date: Tue, 20 Oct 2026 20:18:46 -0500 Subject: [PATCH 1/2] fix(deps): raise PyJWT floor to 2.15.0 (VULN-120053) PyJWT before 2.14.0 does not revalidate redirect destinations against the JWKS trust boundary in PyJWKClient, so a trusted JWKS endpoint that returns an attacker-influenced redirect can lead to disclosed credentials or substituted verification keys (CVE-2026-102267). The remediation version is 2.15.0. Raise the existing direct pyjwt floor from 2.13.0 to 2.15.0 and update the lockfile: pyjwt 2.13.0 -> 2.15.1. No other package changes. Co-Authored-By: Claude Code --- poetry.lock | 8 ++++---- pyproject.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/poetry.lock b/poetry.lock index 68a4dc3a..42a27495 100644 --- a/poetry.lock +++ b/poetry.lock @@ -4384,14 +4384,14 @@ windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pyjwt" -version = "2.13.0" +version = "2.15.1" description = "JSON Web Token implementation in Python" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728"}, - {file = "pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423"}, + {file = "pyjwt-2.15.1-py3-none-any.whl", hash = "sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193"}, + {file = "pyjwt-2.15.1.tar.gz", hash = "sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8"}, ] [package.dependencies] @@ -6706,4 +6706,4 @@ openai = ["cryptography", "mcp", "openai", "openai-agents", "packaging"] [metadata] lock-version = "2.1" python-versions = "^3.11,<3.15" -content-hash = "8219ff5a4bc2c3be82d45473a92cb251482d8b3b5c02ca3a41ef68432f52deb1" +content-hash = "f36dd8a3b6b03ce132d4e2377d78773224aa37f2ffe2590d2faa259c9a84d4b2" diff --git a/pyproject.toml b/pyproject.toml index 68b51b12..f2eba092 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -39,7 +39,7 @@ all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3 python = "^3.11,<3.15" aiohttp = { version = ">=3.14.1,<4", optional = true } pydantic = "^2.11.9" -pyjwt = ">=2.13.0,<3.0.0" +pyjwt = ">=2.15.0,<3.0.0" wrapt = "^1.14" attrs = ">=22.2.0" python-dateutil = "^2.8.0" From 4ad86408caac9f4466ff89b19deca2a5bd4dfb96 Mon Sep 17 00:00:00 2001 From: etserend Date: Tue, 20 Oct 2026 20:53:49 -0500 Subject: [PATCH 2/2] fix(deps): update example pyjwt pins to 2.15.1 (VULN-120053) Three example manifests still pinned the affected PyJWT 2.13.0, so following their instructions installs a vulnerable version, and the unpinned splunk-ao in the requirements files would conflict with the new pyjwt floor after the next release. Earlier vulnerability fixes updated example pins in the same PR. - examples/logging-samples/openai-responses/requirements.txt: pyjwt 2.15.1 - examples/agent/startup-simulator-3000/requirements.txt: pyjwt 2.15.1 - examples/agent/langgraph-fsi-agent/before/poetry.lock: pyjwt 2.15.1 (lock refresh only; no other package changes) Co-Authored-By: Claude Code --- examples/agent/langgraph-fsi-agent/before/poetry.lock | 6 +++--- examples/agent/startup-simulator-3000/requirements.txt | 2 +- examples/logging-samples/openai-responses/requirements.txt | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/examples/agent/langgraph-fsi-agent/before/poetry.lock b/examples/agent/langgraph-fsi-agent/before/poetry.lock index 0ec5e364..f42d1ebe 100644 --- a/examples/agent/langgraph-fsi-agent/before/poetry.lock +++ b/examples/agent/langgraph-fsi-agent/before/poetry.lock @@ -3448,14 +3448,14 @@ windows-terminal = ["colorama (>=0.4.6)"] [[package]] name = "pyjwt" -version = "2.13.0" +version = "2.15.1" description = "JSON Web Token implementation in Python" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728"}, - {file = "pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423"}, + {file = "pyjwt-2.15.1-py3-none-any.whl", hash = "sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193"}, + {file = "pyjwt-2.15.1.tar.gz", hash = "sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8"}, ] [package.extras] diff --git a/examples/agent/startup-simulator-3000/requirements.txt b/examples/agent/startup-simulator-3000/requirements.txt index 2187e916..9508ac33 100644 --- a/examples/agent/startup-simulator-3000/requirements.txt +++ b/examples/agent/startup-simulator-3000/requirements.txt @@ -32,7 +32,7 @@ packaging==24.2 pydantic pydantic-core pydantic-settings -pyjwt==2.13.0 +pyjwt==2.15.1 python-dateutil==2.9.0.post0 python-dotenv==1.2.2 pyyaml==6.0.2 diff --git a/examples/logging-samples/openai-responses/requirements.txt b/examples/logging-samples/openai-responses/requirements.txt index d83e3f8f..f6bf4963 100644 --- a/examples/logging-samples/openai-responses/requirements.txt +++ b/examples/logging-samples/openai-responses/requirements.txt @@ -51,7 +51,7 @@ pydantic-partial==0.10.1 # via galileo-core pydantic-settings==2.12.0 # via galileo-core -pyjwt==2.13.0 +pyjwt==2.15.1 # via # splunk-ao # galileo-core