From cf8dc80428d307fcd4fc7a92b698ff29f2b5c55d Mon Sep 17 00:00:00 2001
From: npeter83 <npeter83+claude@gmail.com>
Date: Fri, 30 Oct 2026 22:28:39 +0100
Subject: [PATCH] fix(deps): joserfc 1.7.4 -> 1.7.6 for CVE-2026-119283 and
 CVE-2026-119284

One pin bumped in place (Authlib's dependency); pip check passes and pip-audit finds nothing.
---
 backend/requirements.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/requirements.lock b/backend/requirements.lock
index c1150acc..b69add52 100644
--- a/backend/requirements.lock
+++ b/backend/requirements.lock
@@ -7,7 +7,7 @@
 # `pip install -r requirements.lock && pip check` must pass. In place so far: urllib3 2.7.0 -> 2.8.0 (PYSEC-2026-4175/4176/4177); yt-dlp 2026.7.4 -> 2026.8.19
 # (it marks the clients that need a stream PO token, so the downloader stops fetching into a 403);
 # certifi 2026.7.22 -> 2026.10.19 (GHSA-6q48-6c7w-9gw2); brotli 1.2.0 -> 1.2.1 (PYSEC-2026-4322);
-# Authlib 1.7.2 -> 1.9.1 (CVE-2026-96760, CVE-2026-114616).
+# Authlib 1.7.2 -> 1.9.1 (CVE-2026-96760, CVE-2026-114616); joserfc 1.7.4 -> 1.7.6 (CVE-2026-119283, CVE-2026-119284).
 APScheduler==3.11.3
 Authlib==1.9.1
 Mako==1.4.1
@@ -39,7 +39,7 @@ httptools==0.8.0
 httpx==0.28.1
 idna==3.18
 itsdangerous==2.2.0
-joserfc==1.7.4
+joserfc==1.7.6
 markdown-it-py==4.2.0
 mdurl==0.1.2
 mutagen==1.48.1