chore(deps): bump the uv group across 1 directory with 2 updates

[dependabot]

Bumps the uv group with 2 updates in the / directory: oauthlib and pyjwt.

Updates oauthlib from 3.3.1 to 4.0.0

Release notes

Sourced from oauthlib's releases.

4.0.0

Introduction

The release 4.0.0 defines the foundation that enables AI contributions and will improve the maintenance of oauthlib by using AI agents, skills, code for both contributors and maintainers. It includes devcontainer, skills and cleanup of instructions.

What's Changed

Important: this release contains 2 breaking changes. See CHANGELOG.rst for details:

• Removed JSONP support from token revocation endpoint (#951)
• Client authentication validation reorganized across grants (#919, #920): the grant_type parameter is now validated before client authentication.

• Replace pyenv with uv in documentation and tooling by @​JonathanHuot in oauthlib/oauthlib#910
• Improve github action to publish package by @​JonathanHuot in oauthlib/oauthlib#915
• Add pre-commit to run linters, formatters, etc. on code changes by @​cclauss in oauthlib/oauthlib#918
• Fix client authentication for DeviceCodeGrant when getting a token by @​hekhuisk in oauthlib/oauthlib#920
• Add project URLs to this project's PyPI page by @​Flimm in oauthlib/oauthlib#921
• Fix a typo in ServiceApplicationClient docstring. by @​rafalkrupinski in oauthlib/oauthlib#923
• Correct grammar in function help by @​verhovsky in oauthlib/oauthlib#924
• Add Python 3.14 to the testing by @​cclauss in oauthlib/oauthlib#925
• Initial python/uv/tox devcontainer by @​JonathanHuot in oauthlib/oauthlib#930
• Fix ruff checks about unused variables by @​JonathanHuot in oauthlib/oauthlib#931
• Drop EOL Python 3.8 from CI by @​auvipy in oauthlib/oauthlib#932
• Set Open Collective username to 'oauthlib' by @​auvipy in oauthlib/oauthlib#933
• pre-commit autoupdate 2026_02_21 by @​cclauss in oauthlib/oauthlib#934
• Remove a trailing whitespace fo fix failing pre-commit by @​cclauss in oauthlib/oauthlib#935
• Fix typos discovered by typos by @​cclauss in oauthlib/oauthlib#938
• Add resource to Request._params by @​juannyG in oauthlib/oauthlib#942
• Release 3.4.0: Add OAuthLib Maintainer agent by @​JonathanHuot in oauthlib/oauthlib#950
• Remove JSONP support from token revocation by @​JonathanHuot in oauthlib/oauthlib#951
• Improve PKCE code comparison by @​JonathanHuot in oauthlib/oauthlib#963
• Release 4.0.0: bump and update changelog by @​JonathanHuot in oauthlib/oauthlib#976

New Contributors

• @​hekhuisk made their first contribution in oauthlib/oauthlib#920
• @​Flimm made their first contribution in oauthlib/oauthlib#921
• @​verhovsky made their first contribution in oauthlib/oauthlib#924
• @​juannyG made their first contribution in oauthlib/oauthlib#942

Full Changelog: oauthlib/oauthlib@v3.3.1...v4.0.0

Changelog

Sourced from oauthlib's changelog.

4.0.0 (2026-09-28):

OAuth2.0 Provider:

• Breaking: #951: Removed JSONP support from token revocation endpoint. JSONP has been superseded by CORS for cross-origin requests. The enable_jsonp parameter has been removed from RevocationEndpoint and the callback parameter has been removed from prepare_token_revocation_request.
• Breaking: #919, #920: Fixed DeviceCodeGrant.validate_token_request trying to authenticate public clients. Client authentication validation has been reorganized and is now shared across AuthorizationCodeGrant, DeviceCodeGrant, RefreshTokenGrant and ResourceOwnerPasswordCredentialsGrant: the grant_type parameter is validated before client authentication, so requests missing grant_type now return 400 invalid_request instead of 401 invalid_client.
• #963: Improved PKCE code comparison

Misc:

• #904: Stop installing examples into site-packages.
• #930: Add devcontainer, Add Python3.14, Python3.14t.
• #931: Fix ruff checks about unused variables.
• #932: Dropped EOL Python 3.8 from CI.
• #934: Pre-commit hooks autoupdate.
• #938: Fix typos discovered by typos.
• Add OAuthLib Maintainer agent for automated issue/PR triage and release management.

Commits

• 145a9a4 Release 4.0.0: clarify changelog breaking changes and reformat entries
• c8344d6 Update CHANGELOG.rst
• e172830 Release 4.0.0: bump version to 4.0.0 and update changelog
• 40b0ab5 Merge pull request #963 from oauthlib/ft/pkcecode
• 1b68cea Merge pull request #920 from hekhuisk/validate-client-authentication
• c951a1d Organized validate_client functions for all grant to avoid mistake in grnat i...
• 74664d3 Improve PKCE code comparison
• 9859b05 Merge pull request #950 from oauthlib/feature/3.4.0-maintainer-agent
• 9bf9b97 Merge branch 'master' into feature/3.4.0-maintainer-agent
• 1ba7429 Clarify agent instructions
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
</code></pre>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c6fe464b356ff4b1ebc9ba62172d331a40aa27df&quot;&gt;&lt;code&gt;c6fe464&lt;/code&gt;&lt;/a> release: prepare v2.14.0</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f5413029ae7a2e31b1367b5303ea86a2f54ccf42&quot;&gt;&lt;code&gt;f541302&lt;/code&gt;&lt;/a> style: apply Ruff formatting</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95&quot;&gt;&lt;code&gt;801cd12&lt;/code&gt;&lt;/a> fix: reject public JWK container HMAC keys</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb&quot;&gt;&lt;code&gt;af8181c&lt;/code&gt;&lt;/a> fix: reject empty HMAC keys from JWKs</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1&quot;&gt;&lt;code&gt;ba4853a&lt;/code&gt;&lt;/a> Throttle repeated PyJWKClient refreshes</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499&quot;&gt;&lt;code&gt;2798504&lt;/code&gt;&lt;/a> fix: reject DER public keys as HMAC secrets</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07&quot;&gt;&lt;code&gt;8b4e233&lt;/code&gt;&lt;/a> fix: reject loader-accepted PEM variants</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1f8180a211256dfe5cf32294b6753f554a5a4258&quot;&gt;&lt;code&gt;1f8180a&lt;/code&gt;&lt;/a> fix: format JWS tests</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/cff1ac55fe5f1096fd05295b269fce053ee290ab&quot;&gt;&lt;code&gt;cff1ac5&lt;/code&gt;&lt;/a> Fix redirect handler return annotation</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56&quot;&gt;&lt;code&gt;0a795b8&lt;/code&gt;&lt;/a> Reject redirects in PyJWKClient fetches</li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

You can disable automated security fix PRs for this repo from the Security Alerts page.

[blocksorg]

Mention Blocks like a regular teammate with your question or request:

@blocks review this pull request
@blocks make the following changes ...
@blocks create an issue from what was mentioned in the following comment ...
@blocks explain the following code ...
@blocks are there any security or performance concerns?

Run @blocks /help for more information.

Workspace settings | Disable this message