[etserend]

Summary

Fixes CVE-2026-49265 in oauthlib (fixed in 4.0.0): updates the locked version from 3.3.1 to 4.0.0.

From 3.0.0 until 4.0.0, oauthlib's PKCE checks in the OAuth2 authorization-code grant compare the attacker-supplied code_verifier with the stored challenge using ordinary string equality, which can leak timing information. The advisory describes this as a defense-in-depth concern for OAuth provider (authorization server) implementations; practical exploitation also needs an intercepted single-use authorization code.

splunk-ao does not import oauthlib and does not run an OAuth provider. oauthlib is only reached transitively in the lock: kubernetes 33.1.0 -> requests-oauthlib 2.0.0 -> oauthlib, i.e. the optional crewai and all extras on Python 3.13 and older.

Changes

• poetry.lock: oauthlib 3.3.1 -> 4.0.0. No other package changes, pyproject.toml is untouched (lock-only fix, as for the other transitive-only updates). The new version is within the existing uncapped constraints (kubernetes: oauthlib >=3.2.2, requests-oauthlib: oauthlib >=3.0.0).

Major-version check

oauthlib 4.0.0 is a major release. Its breaking changes are provider-side only: JSONP support removed from the token revocation endpoint, and client authentication reorganized in the provider grant types (a request missing grant_type now returns 400 invalid_request). kubernetes and requests-oauthlib use the client side.

Test plan

• poetry check --lock passes; poetry update oauthlib --lock changes only oauthlib, content-hash unchanged
• Scratch Python 3.13 venv with the locked kubernetes==33.1.0 and requests-oauthlib==2.0.0: pip check clean on oauthlib 4.0.0, and the same client-side checks pass on 3.3.1 and 4.0.0 (WebApplicationClient authorization URL and token parsing, OAuth2Session authorization URL, client-credentials and password request bodies, OAuth1 signing, import of kubernetes.config.kube_config)
• CI

Not verified: the project's unit suite and type-check were not run (oauthlib is not installed in the default development environment, which is Python 3.14 without the crewai extra), and no real Kubernetes OIDC login was exercised.

🤖 Generated with Claude Code

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — The lock-only bump of oauthlib to 4.0.0 is consistent and the hashes are correct. The locked client-side consumer still imports cleanly.