[etserend]

Summary

Raises the pyjwt floor from 2.13.0 to 2.15.0 and updates the lockfile (2.13.0 -> 2.15.1) to fix CVE-2026-102267.

In PyJWT before 2.14.0, PyJWKClient does not revalidate redirect destinations against the JWKS trust boundary. If a configured, trusted JWKS endpoint returns an attacker-influenced redirect, the client follows it and uses the redirected response as key material. Forwarded credentials may be disclosed, or verification keys may be substituted. The scanner's remediation version is 2.15.0.

Exposure in this repository

• src/ has no direct PyJWT use.
• No other package installed in the development environment (including mcp, galileo-core and crewai) references PyJWKClient.
• The fix still matters for users who combine splunk-ao with other libraries that use PyJWKClient, so the published package should not allow an affected version.

Changes

• Example manifests: examples/logging-samples/openai-responses/requirements.txt and examples/agent/startup-simulator-3000/requirements.txt now pin pyjwt==2.15.1, and examples/agent/langgraph-fsi-agent/before/poetry.lock locks pyjwt 2.15.1 (lock refresh only, no other package changes; its dependent allows >=2.8.0,<3.0.0). These were the only other tracked files pinning an affected version. Earlier vulnerability fixes (fix(deps): bump python-dotenv to 1.2.2 for VULN-88817 #151, fix(deps): bump requests to 2.33.0 for VULN-88819 #152, fix(deps): require aiohttp >=3.14.1 for VULN-88795 #123) updated example pins in the same PR.
• pyproject.toml: pyjwt = ">=2.13.0,<3.0.0" -> ">=2.15.0,<3.0.0". This raises an existing direct dependency's floor; nothing new is added.
• poetry.lock: pyjwt 2.13.0 -> 2.15.1, plus the content-hash. No other package changes.
• The packages that depend on pyjwt allow the new version: crewai >=2.9.0, galileo-core >=2.8.0,<3.0.0, mcp >=2.10.1.

Test plan

• poetry check --lock: passes
• tests/test_deployment.py: 32 passed (pyjwt 2.15.1 installed in the test environment)
• Full unit suite: 24 failed, 6 errors, 2211 passed. The failing test IDs are identical to the baseline on main, so the change adds and fixes none of them.
• invoke type-check: no issues in 118 source files
• Every tracked manifest (poetry.lock, uv.lock, requirements*.txt) scanned: none pins pyjwt below 2.15.0
• pip install --dry-run -r examples/agent/startup-simulator-3000/requirements.txt resolves with the new pin
• poetry update pyjwt --lock on a copy of the langgraph-fsi-agent example changes only pyjwt (6 lines, content-hash unchanged)
• CI

Limits: examples/logging-samples/openai-responses/requirements.txt does not resolve with pip install -r on main either, because it pins galileo-core==3.84.0 while the unpinned splunk-ao requires >=4.4.0. That conflict exists before this change and is unrelated to pyjwt, so it is not addressed here. Also: no test exercises PyJWKClient or its redirect handling, so the tests show nothing broke at 2.15.1 but do not demonstrate the vulnerable path itself. ruff check src tests reports existing findings in files this PR does not touch.

This PR and the anyio upgrade PR (#281) both change the content-hash line in poetry.lock. Whichever merges second needs a one-line poetry lock refresh.

🤖 Generated with Claude Code

[etserend]

🤖 This review was generated by the Astra agent (claude-opus-5-5). It may contain mistakes.

Verdict: approve — The PyJWT floor, the root lock and all three example manifests now exclude the affected versions. The lock diff changes only pyjwt.

Addressed before this review

• The vulnerable pyjwt==2.13.0 stayed pinned in the openai-responses and startup-simulator-3000 requirements files, and in the langgraph-fsi-agent/before/poetry.lock file. Fixed in 4ad8640: all three now resolve to 2.15.1.