Subject: CVS commit: pkgsrc/security/py-authlib
From: Adam Ciarcinski
Date: 2022-10-14 11:06:36
Message id: 20221014090636.928BFFA90@cvs.NetBSD.org

Log Message:
py-authlib: updated to 1.1.0

Version 1.1.0

This release contains breaking changes and security fixes.

Allow to pass claims_options to Framework OpenID Connect clients.
Fix .stream with context for HTTPX OAuth clients.
Fix Starlette OAuth client for cache store.

Breaking changes:

Raise InvalidGrantError for invalid code, redirect_uri and no user errors in \ 
OAuth 2.0 server.

The default authlib.jose.jwt would only work with JSON Web Signature algorithms, \ 
if you would like to use JWT with JWE algorithms, please pass the algorithms \ 
parameter:

jwt = JsonWebToken(['A128KW', 'A128GCM', 'DEF'])
Security fixes: CVE-2022-39175 and CVE-2022-39174, both related to JOSE.

Version 1.0.1

Fix authenticate_none method.
Allow to pass in alternative signing algorithm to RFC7523 authentication methods.
Fix missing_token for Flask OAuth client.
Allow openid in any place of the scope.
Security fix for validating essential value on blank value in JWT.

Version 1.0.0

We have dropped support for Python 2 in this release. We have removed built-in \ 
SQLAlchemy integration.

OAuth Client Changes:

The whole framework client integrations have been restructured, if you are using \ 
the client properly, e.g. oauth.register(...), it would work as before.

OAuth Provider Changes:

In Flask OAuth 2.0 provider, we have removed the deprecated OAUTH2_JWT_XXX \ 
configuration, instead, developers should define .get_jwt_config on OpenID \ 
extensions and grant types.

SQLAlchemy integrations has been removed from Authlib. Developers should define \ 
the database by themselves.

JOSE Changes

JWS has been renamed to JsonWebSignature
JWE has been renamed to JsonWebEncryption
JWK has been renamed to JsonWebKey
JWT has been renamed to JsonWebToken
The "Key" model has been re-designed, checkout the :ref:`jwk_guide` \ 
for updates.

Added ES256K algorithm for JWS and JWT.

Files:
RevisionActionfile
1.10modifypkgsrc/security/py-authlib/Makefile
1.4modifypkgsrc/security/py-authlib/PLIST
1.10modifypkgsrc/security/py-authlib/distinfo