Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-Authlib for openSUSE:Factory checked in at 2026-11-02 16:38:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-Authlib (Old) and /work/SRC/openSUSE:Factory/.python-Authlib.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-Authlib" Mon Nov 2 16:38:33 2026 rev:36 rq:1394352 version:1.9.1 Changes: -------- --- /work/SRC/openSUSE:Factory/python-Authlib/python-Authlib.changes 2026-09-02 17:04:53.702801428 +0200 +++ /work/SRC/openSUSE:Factory/.python-Authlib.new.1255/python-Authlib.changes 2026-11-02 16:38:45.609210592 +0100 @@ -1,0 +2,30 @@ +Sun Nov 1 16:30:53 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 1.9.1: + * ID-JAG grant support, mandatory JWT-bearer audience + validation, nonce and JAR enforcement, httpx2 support + with httpx fallback, dependency lower bounds + * CVE-2026-96760: JWS JSON deserialization accepted empty + signatures without verification (boo#1283079) + * CVE-2026-114614: is_secure_transport accepted spoofed + hosts via textual prefix and userinfo parsing (boo#1287192) + * CVE-2026-114615: OctKey accepted PEM-prefixed asymmetric + key material as HMAC secret (boo#1287193) + * CVE-2026-114616: OctKey accepted zero-length HMAC keys, + allowing signature forgery (boo#1287195) + * CVE-2026-114617: untrusted nonce_supported claim could + disable ID-token nonce validation (boo#1287362) + * CVE-2026-114618: empty JWTBearerGrant audience lists + skipped audience verification (boo#1287999) + * CVE-2026-114619: OpenIDImplicitGrant checked raw payload + scope instead of the validated one (boo#1287998) + * CVE-2026-116672: ClientConfigurationEndpoint missed + registration token client check (boo#1288515) +- Drop fix-oauth-tests.patch, adopted upstream (PR#911) +- Sync dependency floors from upstream metadata + (cryptography>=45.0.1, joserfc>=1.6.8); add test + requirement on httpx2 +- Not affected by CVE-2026-41425 (boo#1263114) and + CVE-2025-62706 (boo#1252504), both fixed before 1.7.2 + +------------------------------------------------------------------- Old: ---- authlib-1.7.2.tar.gz fix-oauth-tests.patch New: ---- authlib-1.9.1.tar.gz ----------(Old B)---------- Old: registration token client check (boo#1288515) - Drop fix-oauth-tests.patch, adopted upstream (PR#911) - Sync dependency floors from upstream metadata ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-Authlib.spec ++++++ --- /var/tmp/diff_new_pack.4Z8pyy/_old 2026-11-02 16:38:46.556250276 +0100 +++ /var/tmp/diff_new_pack.4Z8pyy/_new 2026-11-02 16:38:46.558250360 +0100 @@ -26,24 +26,26 @@ %bcond_with test %endif ################################## - %define modname authlib %{?sle15_python_module_pythons} Name: python-Authlib%{psuffix} -Version: 1.7.2 +Version: 1.9.1 Release: 0 Summary: Python library for building OAuth and OpenID Connect servers License: BSD-3-Clause URL: https://authlib.org/ Source: https://github.com/lepture/%{modname}/archive/refs/tags/v%{version}.tar.gz#/%{modname}-%{version}.tar.gz -# PATCH-FIX-UPSTREAM fix-oauth-tests.patch gh#authlib/authlib@aaac6e5 -Patch0: fix-oauth-tests.patch BuildRequires: %{python_module base >= 3.10} BuildRequires: %{python_module pip} BuildRequires: %{python_module setuptools} BuildRequires: %{python_module wheel} +BuildRequires: fdupes BuildRequires: python-rpm-macros - +Requires: python-cryptography >= 45.0.1 +Requires: python-joserfc >= 1.6.8 +Suggests: python-requests +Provides: python-authlib +BuildArch: noarch # SECTION test requirements %if %{with test} BuildRequires: %{python_module Authlib = %{version}} @@ -54,9 +56,10 @@ BuildRequires: %{python_module Werkzeug} BuildRequires: %{python_module anyio} BuildRequires: %{python_module cachelib} -BuildRequires: %{python_module cryptography} +BuildRequires: %{python_module cryptography >= 45.0.1} +BuildRequires: %{python_module httpx2} BuildRequires: %{python_module httpx} -BuildRequires: %{python_module joserfc >= 1.6.0} +BuildRequires: %{python_module joserfc >= 1.6.8} BuildRequires: %{python_module pytest-asyncio} BuildRequires: %{python_module pytest-django} BuildRequires: %{python_module pytest} @@ -65,13 +68,6 @@ BuildRequires: %{python_module starlette} %endif # /SECTION - -BuildRequires: fdupes -Requires: python-cryptography -Requires: python-joserfc >= 1.6.0 -Suggests: python-requests -Provides: python-authlib -BuildArch: noarch %python_subpackages %description ++++++ authlib-1.7.2.tar.gz -> authlib-1.9.1.tar.gz ++++++ ++++ 8781 lines of diff (skipped)
