chore: require PyJWT >= 2.15.0 on Python 3.9+; remove stale requirements files

[nealrichardson]

PyJWT floor

Open Dependabot alerts include about 20 PyJWT advisories (one critical) against the locked 2.13.0. The fixes are in 2.14.0 and 2.15.0, and both need Python ≥ 3.9, so a plain floor would make the package uninstallable on 3.8. This uses version markers instead:

"pyjwt>=2.4.0; python_version < '3.9'",
"pyjwt>=2.15.0; python_version >= '3.9'",

rsconnect only calls jwt.encode(..., algorithm="HS256") (rsconnect/json_web_token.py). Most of the advisories are in decoding and PyJWKClient paths that rsconnect doesn't use, so this is mostly to protect users' environments. One advisory (#143) has no fixed release yet. uv.lock was regenerated with uv 0.13.0; the only change is pyjwt 2.13.0 → 2.15.1 for 3.9+.

Remove requirements.txt and docs/requirements.txt

Both are out of date. The root file lists six, black, flake8, setuptools_scm and semver<3, none of which are dependencies anymore. Nothing in this repo reads either file: snyk.yml regenerates requirements.txt with uv pip compile before scanning, and the docs build uses uv run --group docs.

⚠️ The root file's header says some integration test suites rely on it (#649). I couldn't find any in this repo. If an external test setup still reads it, that setup needs updating before this merges.

Testing

• Full test suite passes on Python 3.13.
• tests/test_json_web_token.py passes on 3.8 (old PyJWT) and 3.13 (PyJWT 2.15.1).
• uv lock --locked is clean.

🤖 Generated with Claude Code

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-14 14:11 UTC

[github-actions]

☂️ Python Coverage

current status: ✅

Overall Coverage

Lines	Covered	Coverage	Threshold	Status
8957	7733	86%	0%	🟢

New Files

No new covered files...

Modified Files

No covered modified files...

updated for commit: 16e8e90 by action🐍

[nealrichardson]

CI failure is #864

[zackverham]

If an external test setup still reads it, that setup needs updating before this merges.

Seems like the strat could be to just merge this and then fix-forward anything that breaks - does that feel right to you?

[nealrichardson]

If an external test setup still reads it, that setup needs updating before this merges.

Seems like the strat could be to just merge this and then fix-forward anything that breaks - does that feel right to you?

Yes, I think #649 is stale because we've done most of that already.