-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 28 Oct 2026 10:37:22 +0200 Source: python-authlib Architecture: source Version: 1.9.1-1 Distribution: unstable Urgency: medium Maintainer: Debian Python Team <team+python@tracker.debian.org> Changed-By: Stefano Rivera <stefanor@debian.org> Closes: 1150509 1151845 Changes: python-authlib (1.9.1-1) unstable; urgency=medium . * New upstream release. - Avoid JWS signature bypass in JsonWebSignature.deserialize_json() (CVE-2026-96760, Closes: #1150509) - Avoid bypass in is_secure_transport() (CVE-2026-114614) - Enforce JOSE key, scope, and audience validation (CVE-2026-114615, CVE-2026-114618, CVE-2026-114619) - Avoid jose signature bypass with empty HMAC (CVE-2026-114616) - Enforce oauth nonce and JAR request validation (CVE-2026-114617, CVE-2026-114620) (Closes: #1151845) - Reject registration access token issued to another client (CVE-2026-116672) * Refresh patches. * Drop patch joserfc-1.7.3.patch, superseded upstream. * Build-Depend on python3-sphinxcontrib-mermaid. * Migrate from python3-httpx to python3-httpx2. - Skip test_falls_back_to_httpx_with_deprecation_warning. Checksums-Sha1: 913e3eec5683a022b50623b192a229f0375efe0f 2627 python-authlib_1.9.1-1.dsc e3430c65fad1744d4a7fd8b93c336633a5de9eee 388395 python-authlib_1.9.1.orig.tar.gz dd865dadd3200f914b4ac7bfaaaa0013f74daa7d 6164 python-authlib_1.9.1-1.debian.tar.xz 3480289d249688ed91919ab6544b253b7850c8cf 7342 python-authlib_1.9.1-1_source.buildinfo Checksums-Sha256: 1e8daae7a5d318fb1a0d782d3c8a47d151ea03b2b51b65793ab79f6ac3e65ae6 2627 python-authlib_1.9.1-1.dsc 9868306525d9907a3eaf97ff8f5dd754c3cb768e41823dc7f5565abfe3e169fb 388395 python-authlib_1.9.1.orig.tar.gz 3e13019073c4ae715d83fe88a15f0a86e0d588adf9316ecd21a0b1beb8767d31 6164 python-authlib_1.9.1-1.debian.tar.xz ebc7a140832da2597beccd98e2647596682f46b4d9a3434ce46328d8381b77c7 7342 python-authlib_1.9.1-1_source.buildinfo Files: 921c6a9d7c7f09674d49e9ddb33ae34a 2627 python optional python-authlib_1.9.1-1.dsc b98aa50b344bbc5930540c2017b80e52 388395 python optional python-authlib_1.9.1.orig.tar.gz 73787fef653a58995e898785af732a4c 6164 python optional python-authlib_1.9.1-1.debian.tar.xz 2828a4aefb24eced05df0f44ae4a11b4 7342 python optional python-authlib_1.9.1-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iIoEARYKADIWIQTumtb5BSD6EfafSCRHew2wJjpU2AUCauG27xQcc3RlZmFub3JA ZGViaWFuLm9yZwAKCRBHew2wJjpU2PzHAP9hSFGQMol+fc/PsedC1UcLk5kRVIW9 EihR4hnqbuqejgD/SM0Vr1lnQ6p5aswzP0oeXT/RSxpdEqbWjyeUNHWgQAQ= =8vRj -----END PGP SIGNATURE-----
