chore(deps): bump pyjwt from 2.11.0 to 2.12.0 by dependabot[bot] · Pull Request #2448 · OpenHands/software-agent-sdk

dependabot · 2026-03-14T11:36:13Z

Bumps pyjwt from 2.11.0 to 2.12.0.

Release notes

2.12.0

Security

Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in jpadilla/pyjwt#1132

chore(docs): fix docs build by @tamird in jpadilla/pyjwt#1137

Annotate PyJWKSet.keys for pyright by @tamird in jpadilla/pyjwt#1134

fix: close HTTPError to prevent ResourceWarning on Python 3.14 by @veeceey in jpadilla/pyjwt#1133

chore: remove superfluous constants by @tamird in jpadilla/pyjwt#1136

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in jpadilla/pyjwt#1135

chore(tests): enable mypy by @tamird in jpadilla/pyjwt#1138

Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in jpadilla/pyjwt#1142

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in jpadilla/pyjwt#1141

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in jpadilla/pyjwt#1145

fix: do not store reference to algorithms dict on PyJWK by @akx in jpadilla/pyjwt#1143

Use PyJWK algorithm when encoding without explicit algorithm by @jpadilla in jpadilla/pyjwt#1148

New Contributors

@tamird made their first contribution in jpadilla/pyjwt#1137

@veeceey made their first contribution in jpadilla/pyjwt#1133

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

Changelog

Sourced from pyjwt's changelog.

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__

Fixed


- Annotate PyJWKSet.keys for pyright by @tamird in `[#1134](https://github.com/jpadilla/pyjwt/issues/1134) <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `[#1133](https://github.com/jpadilla/pyjwt/issues/1133) <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @akx in `[#1143](https://github.com/jpadilla/pyjwt/issues/1143) <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `[#1148](https://github.com/jpadilla/pyjwt/issues/1148) <https://github.com/jpadilla/pyjwt/pull/1148>`__
Added

Docs: Add PyJWKClient API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

Commits

bd9700c Use PyJWK algorithm when encoding without explicit algorithm (#1148)
051ea34 Merge commit from fork
1451d70 fix: do not store reference to algorithms dict on PyJWK (#1143)
f3ba74c [pre-commit.ci] pre-commit autoupdate (#1145)
0318ffa [pre-commit.ci] pre-commit autoupdate (#1141)
a52753d Bump actions/download-artifact from 7 to 8 (#1142)
b85050f chore(tests): enable mypy (#1138)
1272b26 [pre-commit.ci] pre-commit autoupdate (#1135)
99a8728 chore: remove superfluous constants (#1136)
412cb67 fix: close HTTPError to prevent ResourceWarning on Python 3.14 (#1133)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	`eclipse-temurin:17-jdk`	Link
python	amd64, arm64	`nikolaik/python-nodejs:python3.13-nodejs22`	Link
golang	amd64, arm64	`golang:1.21-bookworm`	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:f1ceed1-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-f1ceed1-python \
  ghcr.io/openhands/agent-server:f1ceed1-python

All tags pushed for this build

ghcr.io/openhands/agent-server:f1ceed1-golang-amd64
ghcr.io/openhands/agent-server:f1ceed1-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:f1ceed1-golang-arm64
ghcr.io/openhands/agent-server:f1ceed1-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:f1ceed1-java-amd64
ghcr.io/openhands/agent-server:f1ceed1-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:f1ceed1-java-arm64
ghcr.io/openhands/agent-server:f1ceed1-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:f1ceed1-python-amd64
ghcr.io/openhands/agent-server:f1ceed1-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-amd64
ghcr.io/openhands/agent-server:f1ceed1-python-arm64
ghcr.io/openhands/agent-server:f1ceed1-nikolaik_s_python-nodejs_tag_python3.13-nodejs22-arm64
ghcr.io/openhands/agent-server:f1ceed1-golang
ghcr.io/openhands/agent-server:f1ceed1-java
ghcr.io/openhands/agent-server:f1ceed1-python

About Multi-Architecture Support

Each variant tag (e.g., f1ceed1-python) is a multi-arch manifest supporting both amd64 and arm64
Docker automatically pulls the correct architecture for your platform
Individual architecture tags (e.g., f1ceed1-python-amd64) are also available if needed

Bumps [pyjwt](https://github.com/jpadilla/pyjwt) from 2.11.0 to 2.12.0. - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.11.0...2.12.0) --- updated-dependencies: - dependency-name: pyjwt dependency-version: 2.12.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-03-14T11:36:39Z

Python API breakage checks — ✅ PASSED

Result: ✅ PASSED

Action log

github-actions · 2026-03-14T11:36:50Z

REST API breakage checks (OpenAPI) — ❌ FAILED

Result: ❌ FAILED

⚠️ Breaking REST API changes or policy violations detected.

Log excerpt (first 1000 characters)

::error title=openhands-agent-server REST API::Breaking REST API change detected without MINOR version bump (1.14.0 -> 1.14.0).

Breaking REST API changes detected compared to baseline release:
- added '#/components/schemas/ACPAgent-Output, #/components/schemas/Agent-Output' to the '/items/anyOf[subschema #1: ConversationInfo]/agent' response property 'oneOf' list for the response status '200'
- the '/items/anyOf[subschema #1: ConversationInfo]/agent' response's property type/format changed from 'object'/'' to ''/'' for status '200'
- removed the required property '/items/anyOf[subschema #1: ConversationInfo]/agent/kind' from the response with the '200' status
- removed the required property '/items/anyOf[subschema #1: ConversationInfo]/agent/llm' from the response with the '200' status
- the 'agent' request property type/format changed from 'object'/'' to ''/''
- added '#/components/schemas/ACPAgent-Output, #/components/schemas/Agent-Output' to the 'agent' response property 'oneOf' li

Action log

github-actions · 2026-03-14T11:47:55Z

Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	21272	5570	73%

report-only-changed-files is enabled. No files were changed during this commit :)

all-hands-bot

Taste Rating: 🟢 Good taste - Clean security maintenance

Verdict: ✅ Worth merging

This is a straightforward dependency update addressing real security issues:

PyJWT 2.12.0 fixes GHSA-752w-5fwx-jx9f (crit header validation)
Rich 14.3.3+ constraint added (likely security/stability fix)

Minor version bumps, backward compatible, no code changes. Standard maintenance work - merge it.

dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 14, 2026

aivong-openhands requested a review from all-hands-bot March 14, 2026 11:56

all-hands-bot approved these changes Mar 14, 2026

View reviewed changes

Merge branch 'main' into dependabot/uv/pyjwt-2.12.0

61e312c

enyst enabled auto-merge (squash) March 15, 2026 15:24

enyst merged commit a604ee3 into main Mar 15, 2026
20 of 21 checks passed

enyst deleted the dependabot/uv/pyjwt-2.12.0 branch March 15, 2026 15:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump pyjwt from 2.11.0 to 2.12.0#2448

chore(deps): bump pyjwt from 2.11.0 to 2.12.0#2448
enyst merged 2 commits intomainfrom
dependabot/uv/pyjwt-2.12.0

dependabot bot commented on behalf of github Mar 14, 2026 •

edited by github-actions bot

Loading

Uh oh!

github-actions bot commented Mar 14, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 14, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 14, 2026 •

edited

Loading

Uh oh!

all-hands-bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot bot commented on behalf of github Mar 14, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.12.0

Security

What's Changed

New Contributors

v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>__

Uh oh!

github-actions bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Python API breakage checks — ✅ PASSED

Uh oh!

github-actions bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

REST API breakage checks (OpenAPI) — ❌ FAILED

Uh oh!

github-actions bot commented Mar 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

all-hands-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Mar 14, 2026 •

edited by github-actions bot

Loading

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__

github-actions bot commented Mar 14, 2026 •

edited

Loading

github-actions bot commented Mar 14, 2026 •

edited

Loading

github-actions bot commented Mar 14, 2026 •

edited

Loading