From 16e8e905e8826721d14ab58e04feaedcf6c82d48 Mon Sep 17 00:00:00 2001 From: Neal Richardson Date: Tue, 13 Oct 2026 18:50:06 -0400 Subject: [PATCH] chore: require PyJWT >= 2.15.0 on Python 3.9+; remove stale requirements files PyJWT 2.15.0 fixes the open Dependabot advisories that have a fix. It needs Python >= 3.9, so 3.8 keeps the old floor. requirements.txt and docs/requirements.txt are out of date and unused in this repo: snyk.yml regenerates requirements.txt before scanning, and the docs build uses the `docs` dependency group. Co-Authored-By: Claude Opus 5.5 (1M context) --- docs/CHANGELOG.md | 3 +++ docs/requirements.txt | 9 --------- pyproject.toml | 3 ++- requirements.txt | 33 --------------------------------- uv.lock | 17 +++++++++-------- 5 files changed, 14 insertions(+), 51 deletions(-) delete mode 100644 docs/requirements.txt delete mode 100644 requirements.txt diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 2077475b2..c7c9e342a 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -15,6 +15,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 with the Python that runs `rsconnect`. Before, uv picked the newest installed Python that satisfied `requires-python`. Dependencies could then fail to install on a Python version so new that they had no wheels for it yet. +- On Python 3.9 and later, rsconnect-python now requires PyJWT 2.15.0 or later, which + fixes several security advisories. Python 3.8 keeps the old minimum, because no fixed + PyJWT release supports it. ## [1.31.1] - 2026-09-10 diff --git a/docs/requirements.txt b/docs/requirements.txt deleted file mode 100644 index 8d5e6d933..000000000 --- a/docs/requirements.txt +++ /dev/null @@ -1,9 +0,0 @@ -Pygments -markdown -markdown-include -mkdocs -mkdocs-exclude -mkdocs-macros-plugin -mkdocs-material -pymdown-extensions -mkdocs-click diff --git a/pyproject.toml b/pyproject.toml index 84bd53cbe..f312249a9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -13,7 +13,8 @@ dependencies = [ "pip>=10.0.0", "uv>=0.9.0", "semver>=2.0.0,<4.0.0", - "pyjwt>=2.4.0", + "pyjwt>=2.4.0; python_version < '3.9'", + "pyjwt>=2.15.0; python_version >= '3.9'", "click>=8.0.0", "packaging>=20.0", "toml>=0.10; python_version < '3.11'", diff --git a/requirements.txt b/requirements.txt deleted file mode 100644 index 66c7a919f..000000000 --- a/requirements.txt +++ /dev/null @@ -1,33 +0,0 @@ -# TODO(#649): this file shouldn't exist, but there currently are some -# integration test suites that rely on it. The integration tests deserve to be -# overhauled along the lines of the posit-sdk-py tests, so we can clean this up -# when we do that. - -# build-system.requires -setuptools>=61 -setuptools_scm[toml]>=3.4 -wheel - -# project.dependencies -six>=1.14.0 -click>=8.0.0 -pip>=10.0.0 -uv>=0.9.0 -semver>=2.0.0,<3.0.0 -pyjwt>=2.4.0 -black==24.3.0 - -# project.optional-dependencies.test -coverage -flake8-pyproject -flake8 -httpretty -ipykernel -nbconvert -pyright -pytest-cov -pytest -setuptools_scm[toml] -twine -types-Flask -types-six diff --git a/uv.lock b/uv.lock index 5c1a3a31b..601e00624 100644 --- a/uv.lock +++ b/uv.lock @@ -1,5 +1,5 @@ version = 1 -revision = 3 +revision = 5 requires-python = ">=3.8" resolution-markers = [ "python_full_version >= '3.14' and platform_python_implementation != 'PyPy'", @@ -3386,7 +3386,7 @@ wheels = [ [[package]] name = "pyjwt" -version = "2.13.0" +version = "2.15.1" source = { registry = "https://pypi.org/simple" } resolution-markers = [ "python_full_version >= '3.14' and platform_python_implementation != 'PyPy'", @@ -3399,9 +3399,9 @@ resolution-markers = [ dependencies = [ { name = "typing-extensions", version = "4.15.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" } +sdist = { url = "https://files.pythonhosted.org/packages/43/ea/5194e52748b0da83d71e082d75496eaec6e58f419f5e184786ded517e6a9/pyjwt-2.15.1.tar.gz", hash = "sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8", size = 121252, upload-time = "2026-09-28T18:40:42.598Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" }, + { url = "https://files.pythonhosted.org/packages/50/ca/44de4e75f8aadc457f0634be3b542815078ded46dca30efb960edeecad6e/pyjwt-2.15.1-py3-none-any.whl", hash = "sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193", size = 33860, upload-time = "2026-09-28T18:40:41.429Z" }, ] [[package]] @@ -4766,7 +4766,7 @@ dependencies = [ { name = "pip", version = "26.0.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.9.*'" }, { name = "pip", version = "26.1.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.10'" }, { name = "pyjwt", version = "2.9.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.9'" }, - { name = "pyjwt", version = "2.13.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.9'" }, + { name = "pyjwt", version = "2.15.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.9'" }, { name = "semver" }, { name = "toml", marker = "python_full_version < '3.11'" }, { name = "typing-extensions", version = "4.13.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.9'" }, @@ -4822,7 +4822,8 @@ requires-dist = [ { name = "keyring", marker = "extra == 'keyring'", specifier = ">=23.0.0" }, { name = "packaging", specifier = ">=20.0" }, { name = "pip", specifier = ">=10.0.0" }, - { name = "pyjwt", specifier = ">=2.4.0" }, + { name = "pyjwt", marker = "python_full_version < '3.9'", specifier = ">=2.4.0" }, + { name = "pyjwt", marker = "python_full_version >= '3.9'", specifier = ">=2.15.0" }, { name = "semver", specifier = ">=2.0.0,<4.0.0" }, { name = "snowflake-cli", marker = "extra == 'snowflake'" }, { name = "toml", marker = "python_full_version < '3.11'", specifier = ">=0.10" }, @@ -5088,7 +5089,7 @@ dependencies = [ { name = "platformdirs", version = "4.3.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version != '3.9.*'" }, { name = "platformdirs", version = "4.4.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.9.*'" }, { name = "pyjwt", version = "2.9.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version != '3.9.*'" }, - { name = "pyjwt", version = "2.13.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.9.*'" }, + { name = "pyjwt", version = "2.15.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.9.*'" }, { name = "pyopenssl", version = "24.3.0", source = { registry = "https://pypi.org/simple" } }, { name = "pytz" }, { name = "requests", version = "2.32.3", source = { registry = "https://pypi.org/simple" } }, @@ -5156,7 +5157,7 @@ dependencies = [ { name = "idna", version = "3.18", source = { registry = "https://pypi.org/simple" } }, { name = "packaging" }, { name = "platformdirs", version = "4.10.0", source = { registry = "https://pypi.org/simple" } }, - { name = "pyjwt", version = "2.13.0", source = { registry = "https://pypi.org/simple" } }, + { name = "pyjwt", version = "2.15.1", source = { registry = "https://pypi.org/simple" } }, { name = "pyopenssl", version = "25.3.0", source = { registry = "https://pypi.org/simple" } }, { name = "pytz" }, { name = "requests", version = "2.32.4", source = { registry = "https://pypi.org/simple" } },