Sourced from python-jose's releases.

3.5.0

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

https://pypi.org/project/python-jose/3.5.0/

3.4.0

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Sourced from python-jose's changelog.

3.5.0 -- 2025-05-28

News

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

3.4.0 -- 2025-02-14

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

• 018b310 Prepare release 3.5.0 (#388)
• 393c374 Improve jwt.decode key doc (#198)
• 50d4390 utils.py: fix types in docstrings for base64url_encode/decode (#269)
• 8fd0b63 Add RTD config file to silence emailed deprecation warnings (#333)
• 6f03385 Added possibility to call jwk.construct() with a private key (#295)
• 2f0aca6 Add python_requires arg to setup.cfg (#273)
• 895777e Updated pyasn version to match latest (#338)
• 45bd124 Update jwk.py (#328)
• 1f0ae0a docs: Fix a few typos (#299)
• ceaac36 Do not use utc_now on module level (#372)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)