[dependabot]

Bumps joserfc from 1.7.2 to 1.7.6.

Release notes

Sourced from joserfc's releases.

1.7.6

   🐞 Bug Fixes

• Validate compact value size before split  -  by @​lepture (397e0)
• ci: Restrict default workflow token permissions  -  by @​lepture (d060c)
• jwe: Limit additional authenticated data size  -  by @​lepture (25e95)
• jwk: Handle KeySet equality with unrelated types  -  by @​janmrow in authlib/joserfc#106 (27d7c)
• jwt: Report correct claim name for invalid iss  -  by @​janmrow (eec6d)
• jwt: Require string values for jti claims  -  by @​lepture (e93fd)

    View changes on GitHub

1.7.5

   🚀 Features

• Add max_recipients on JWERegistry  -  by @​lepture (d6dc8)

   🐞 Bug Fixes

• Ignore unknown kty in KeySet.import_key_set (RFC 7517 §5)  -  by @​RalphBragg in authlib/joserfc#103 (4dcd3)

    View changes on GitHub

1.7.4

   🐞 Bug Fixes

• Prevent verify_general_json bypass empty signatures  -  by @​lepture (f409f)
• jwe: Raise DecodeError when encrypted_key is None  -  by @​lepture (74be9)

    View changes on GitHub

1.7.3

   🐞 Bug Fixes

• jws: Validate payload size for rfc7797  -  by @​lepture (683ca)
• jwt: Add default claims validation for iss, sub and aud  -  by @​lepture (76ee6)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.7.6

Released on October 19, 2026

• JWE: Limit base64url-encoded additional authenticated data to 65,536 bytes before copying or decoding it in JSON serialization. Configure the limit with JWERegistry(max_aad_length=...).
• JWT: Reject non-string jti claims, including arrays containing an expected token ID, even when no claim options are configured.
• JWT: Report the correct claim name for invalid iss values.
• JWS & JWE: Validate compact token size before splitting it into segments.
• JWK: Handle key set equality comparisons with unrelated types.

1.7.5

Released on August 29, 2026

• JWK: Ignore keys with unknown kty values when importing a key set.
• JWE: Add max_recipients to JWERegistry.

1.7.4

Released on July 13, 2026

• Reject JWS general JSON serialization when signatures is empty.
• Raises DecodeError when encrypted_key is None in JWE.

1.7.3

Released on July 8, 2026

• Add default claims validation for iss, sub and aud.
• Add size validation even for self-provided payload.

Commits

• c54d9cc chore: release 1.7.6
• d060c2e fix(ci): restrict default workflow token permissions
• e93fd2b fix(jwt): require string values for jti claims
• 25e9526 fix(jwe): limit additional authenticated data size
• 27d7c8a fix(jwk): handle KeySet equality with unrelated types (#106)
• 397e04f fix: validate compact value size before split
• 8074dc7 Merge pull request #105 from janmrow/fix/jwt-iss-claim-name
• eec6d5e fix(jwt): report correct claim name for invalid iss
• 357c319 chore: release 1.7.5
• d6dc8df feat: add max_recipients on JWERegistry
• Additional commits viewable in compare view

[Fokko]

@dependabot rebase