All pull requests

Pull requests

• Reject DER-encoded asymmetric keys as HMAC secrets (CVE-2026-85394)

  #422·emgaurav opened Sep 16, 2026·

  ·
  1

• Fix RSA1_5 padding oracle: length-check the unwrapped CEK

  #415·RavSinghChandan opened Aug 5, 2026·

  ·
  1

• fix: reject tokens missing 'aud' claim when audience is expected

  #412·binggao1230 opened Jun 25, 2026·

  ·
  1

• Use constant-time comparison for the JWE auth tag and the OIDC at_hash claim

  #411·Nexory opened Jun 18, 2026·

  ·

• Reject JWS tokens declaring unsupported crit header extensions

  #410·arpitjain099 opened Jun 4, 2026·

  ·
  1

• Do not reject present aud claim when audience is None

  #409·arpitjain099 opened Jun 3, 2026·

  ·
  1

• Bump pytest from 8.3.5 to 9.0.3

  dependenciespython
  #405·dependabot[bot] opened Apr 14, 2026·

  ·

• Bump cryptography from 45.0.3 to 46.0.7

  dependenciespython
  #404·dependabot[bot] opened Apr 8, 2026·

  ·

• fix: replace ecdsa with cryptography to mitigate Minerva timing attack

  #400·serge-eric-kalaga opened Mar 13, 2026·

  ·

• fix: correct typo from ECSDA to ECDSA in TODO

  #397·seuthootDev opened Feb 27, 2026·

  ·

• fix test_incorrect_public_key_hmac_signing

  #393·dotlambda opened Oct 22, 2025·

  ·

• LLM tool generated fix for CVE-2024-33663

  #373·Chamiduz opened Feb 21, 2025·

  ·
  2

• Fix CVE-2024-33663

  #349·danigm opened May 2, 2024·

  ·
  13

• Resolve deprecation warnings related to datetime.utcnow in python 3.12

  #335·brouberol opened Nov 1, 2023·

  ·
  1

  10

• resolves #321, Added support for passing additional headers in JWE encryption.

  #323·debanshuk opened Jul 2, 2023·

  ·
  6

• Add "algorithm mismatch" error to improve jws

  #304·ghost opened Nov 7, 2022·

  ·
  4

• fixed get_unverified_claims() args description

  #301·Star3Lord opened Aug 26, 2022·

  ·
  2

• Can pass custom JSONEncoder class to jws.sign

  #284·chbndrhnns opened Jan 7, 2022·

  ·

• Implement RFC-7797 / JWS (Detached Payload) #166

  #272·finvu opened Jul 22, 2021·

  ·
  5

• Add option to provide current time when decoding JWT

  #267·ZipFile opened Jul 4, 2021·

  ·
  8

• Add unencoded payload option and move JWT type out of JWS

  #210·jricher opened Feb 15, 2021·

  ·
  1

• enable ES256K for ECDSA signing scheme

  enhancementhelp wanted
  #113·pohutukawa opened Nov 27, 2018·

  ·
  13