rp_python_sdk 1.3.1__tar.gz → 1.4.1__tar.gz

{rp_python_sdk-1.3.1 → rp_python_sdk-1.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rp_python_sdk
-Version: 1.3.1
+Version: 1.4.1
 Summary: Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem
 License: Proprietary
 Author: Erik Pragt
@@ -11,12 +11,12 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: authlib (>=1.6.6,<2.0.0)
+Requires-Dist: authlib (>=1.7.2,<2.0.0)
 Requires-Dist: cffi (>=2.0.0,<3.0.0)
-Requires-Dist: cryptography (>=46.0.5,<47.0.0)
-Requires-Dist: joserfc (>=1.6.3,<2.0.0)
-Requires-Dist: requests (>=2.32.5,<3.0.0)
-Requires-Dist: urllib3 (>=2.6.3,<3.0.0)
+Requires-Dist: cryptography (>=50.0.0)
+Requires-Dist: joserfc (>=1.6.8,<2.0.0)
+Requires-Dist: requests (>=2.34.2,<3.0.0)
+Requires-Dist: urllib3 (>=2.7.0,<3.0.0)
 Description-Content-Type: text/markdown
 
 # Python SDK for Relying Parties
@@ -451,6 +451,14 @@ poetry publish
 
 ## Release Notes
 
+### 1.4.1 (Aug 4, 2026)
+- Security: require cryptography 50.0.0 or newer to address CVE-2026-69247 and CVE-2026-69249
+- Removed the cryptography major-version ceiling so consumers can adopt future security releases without waiting for an SDK release
+
+### 1.4.0 (May 27, 2026)
+- Fixed key selection bug: JWKs with missing `use` field are now accepted (per RFC 7517)
+- Updated dependencies: authlib 1.7.2, cryptography 48, joserfc 1.6.8, requests 2.34.2, urllib3 2.7.0, black 26.5.1, mypy 2
+
 ### 1.3.1 (May 4, 2026)
 - Updated dependencies
 

{rp_python_sdk-1.3.1 → rp_python_sdk-1.4.1}/README.md

@@ -430,6 +430,14 @@ poetry publish
 
 ## Release Notes
 
+### 1.4.1 (Aug 4, 2026)
+- Security: require cryptography 50.0.0 or newer to address CVE-2026-69247 and CVE-2026-69249
+- Removed the cryptography major-version ceiling so consumers can adopt future security releases without waiting for an SDK release
+
+### 1.4.0 (May 27, 2026)
+- Fixed key selection bug: JWKs with missing `use` field are now accepted (per RFC 7517)
+- Updated dependencies: authlib 1.7.2, cryptography 48, joserfc 1.6.8, requests 2.34.2, urllib3 2.7.0, black 26.5.1, mypy 2
+
 ### 1.3.1 (May 4, 2026)
 - Updated dependencies
 

{rp_python_sdk-1.3.1 → rp_python_sdk-1.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rp_python_sdk"
-version = "1.3.1"
+version = "1.4.1"
 description = "Python SDK for Relying Parties to enable simple integration with the Digital Identity ecosystem"
 authors = ["Erik Pragt <erik.pragt@connectid.com.au>"]
 license = "Proprietary"
@@ -8,12 +8,12 @@ readme = "README.md"
 
 [tool.poetry.dependencies]
 python = "^3.12"
-requests = "^2.32.5"
-authlib = "^1.6.6"
-cryptography = "^46.0.5"
-joserfc = "^1.6.3"
+requests = "^2.34.2"
+authlib = "^1.7.2"
+cryptography = ">=50.0.0"
+joserfc = "^1.6.8"
 cffi = "^2.0.0"
-urllib3 = "^2.6.3"
+urllib3 = "^2.7.0"
 
 [tool.poetry.group.test.dependencies]
 pytest = "^9.0.0"
@@ -21,9 +21,9 @@ httpx = "^0.28.1"
 toml = "^0.10.2"
 
 [tool.poetry.group.dev.dependencies]
-black = "^26.3.1"
+black = "^26.5.1"
 pre-commit = "^4.5.1"
-mypy = "^1.19.1"
+mypy = "^2.0.0"
 requests-mock = "^1.12.1"
 freezegun = "^1.4.0"
 flake8 = "^7.3.0"

{rp_python_sdk-1.3.1 → rp_python_sdk-1.4.1}/rp_python_sdk/endpoints/retrieve_tokens.py

@@ -265,7 +265,8 @@ def _validate_signature(issuer: str, audience: str, allowed_alg: list, id_token:
 
 
 def _matching_use(key_element: dict) -> bool:
-    return key_element.get('use') == "sig"
+    use = key_element.get('use')
+    return use is None or use == "sig"
 
 
 def _matching_kid(kid: str, key_element: dict) -> bool:

rp_python_sdk-1.4.1/rp_python_sdk/endpoints/util/version_info.py

@@ -0,0 +1,2 @@
+def get_version_info() -> str:
+    return "1.4.1"  # Version number

rp_python_sdk-1.3.1/rp_python_sdk/endpoints/util/version_info.py

@@ -1,2 +0,0 @@
-def get_version_info() -> str:
-    return "1.3.1"  # Version number