From cb1c4fc716009acbe87ae1076a2611df4abc7083 Mon Sep 17 00:00:00 2001 From: Chris Cata Date: Wed, 21 Oct 2026 21:15:37 -0500 Subject: [PATCH] security: PyJWT 2.13.0 -> 2.15.1 (Dependabot alerts 74-97) ABCT only calls jwt.encode (Coinbase ES256, Upbit HS256); no decode path, so the alerts were not reachable. Bumped anyway. Tests: 620 passed, the same as on 2.13.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01PLCATfYx1J2Z927aMXT9TH --- backend/requirements.txt | 2 +- requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/requirements.txt b/backend/requirements.txt index 68d397bb..76c4688c 100644 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -6,7 +6,7 @@ python-dotenv==1.2.2 aiosqlite==0.19.0 pydantic==2.13.4 bech32==1.2.0 -PyJWT==2.13.0 +PyJWT==2.15.1 cryptography==50.0.0 python-multipart>=0.0.31 # CVE-2024-24762 + later multipart DoS fixes bip_utils==2.9.3 diff --git a/requirements.txt b/requirements.txt index ffe2b507..445ade24 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,7 +6,7 @@ python-dotenv==1.2.2 aiosqlite==0.19.0 pydantic==2.13.4 bech32==1.2.0 -PyJWT==2.13.0 +PyJWT==2.15.1 cryptography==50.0.0 python-multipart==0.0.31 Pillow==12.3.0