Upgrading python-jose 2 to 3
Breaking2.0.2 → 3.5.0Breaking1Security4Platform6Deprecated1New3Changed17Fixed10Other29
BreakingUpgrade verdict
1 breaking change and 6 platform requirement changes and 4 security fixes.
In plain terms
- The option to use PyCrypto for cryptography is gone; use the cryptography backend instead.
- This version no longer runs on Python 3.8, so users on that version must upgrade Python.
- The package now works on the newer Python 3.12 and 3.13 releases.
- The library no longer runs on Python 3.6 or 3.7.
Must act Top 5 of 12 that need code or config changes
Requires Python >=3.9 from 3.5.0 (none stated before).
Adds pyasn1 >=0.5.0, rsa !=4.1.1,!=4.4,<5.0,>=4.0.
Drops future, pycryptodome, six.
What you must change
Breaking1
Removes the PyCrypto backend.
PyCryptoSecurity4
Removes key data (sensitive information) from JWKError exceptions.
JWKErrorFixes CVE-2024-33664 by limiting JWE to 250KiB.
Fixes CVE-2024-33663 by forbidding signing JWTs with a public key.
Critical · CVSS 7.4Uses hmac.compare_digest instead of the custom constant_time_string_compare.
hmac.compare_digestconstant_time_string_comparePlatform6
Removes support for Python 3.8.
Adds support for Python 3.12 and 3.13.
Removes support for Python 3.6 and 3.7.
Adds support for Python 3.10 and 3.11.
Removes support for Python 2.7 and 3.5.
Adds support for Python 3.9.
Deprecations to plan for
Deprecated1
This is the penultimate release supporting Python 2.7, 3.5, and the PyCrypto backend.