nealrichardson · Oct 14, 2026 · Oct 13, 2026
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
@@ -15,6 +15,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   with the Python that runs `rsconnect`. Before, uv picked the newest installed Python
   that satisfied `requires-python`. Dependencies could then fail to install on a
   Python version so new that they had no wheels for it yet.
+- On Python 3.9 and later, rsconnect-python now requires PyJWT 2.15.0 or later, which
+  fixes several security advisories. Python 3.8 keeps the old minimum, because no fixed
+  PyJWT release supports it.
 
 ## [1.31.1] - 2026-09-10
 

diff --git a/docs/requirements.txt b/docs/requirements.txt
diff --git a/pyproject.toml b/pyproject.toml
@@ -13,7 +13,8 @@ dependencies = [
     "pip>=10.0.0",
     "uv>=0.9.0",
     "semver>=2.0.0,<4.0.0",
-    "pyjwt>=2.4.0",
+    "pyjwt>=2.4.0; python_version < '3.9'",
+    "pyjwt>=2.15.0; python_version >= '3.9'",
     "click>=8.0.0",
     "packaging>=20.0",
     "toml>=0.10; python_version < '3.11'",

diff --git a/requirements.txt b/requirements.txt
diff --git a/uv.lock b/uv.lock