chore: bump python-jose[cryptography] from 3.3.0 to 3.5.0

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps python-jose[cryptography] from 3.3.0 to 3.5.0.

Release notes

Sourced from python-jose[cryptography]'s releases.

3.5.0

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

https://pypi.org/project/python-jose/3.5.0/

3.4.0

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Changelog

Sourced from python-jose[cryptography]'s changelog.

3.5.0 -- 2025-05-28

News

• Remove support for Python 3.8
• Added support for Python 3.12 & 3.13
• Upgrade to pyasn1 0.5.1+
• Upgrade to pytest and other dependencies
• Add RTD config file to silence emailed deprecation warnings

Bug fixes and Improvements

• Remove get_random_bytes from cryptography backend
• Do not use utc_now on module level
• Remove key data (sensitive information) from JWKError exceptions
• Added possibility to call jwk.construct() with a private RSA key

3.4.0 -- 2025-02-14

News

• Remove support for Python 3.6 and 3.7
• Added support for Python 3.10 and 3.11

Bug fixes and Improvements

• Updating CryptographyAESKey::encrypt to generate 96 bit IVs for GCM block cipher mode
• Fix for PEM key comparisons caused by line lengths and new lines
• Fix for CVE-2024-33664 - JWE limited to 250KiB
• Fix for CVE-2024-33663 - signing JWT with public key is now forbidden
• Replace usage of deprecated datetime.utcnow() with datetime.now(UTC)

Housekeeping

• Updated Github Actions Workflows
• Updated to use tox 4.x
• Revise codecov integration
• Fixed DeprecationWarnings

Commits

• 018b310 Prepare release 3.5.0 (#388)
• 393c374 Improve jwt.decode key doc (#198)
• 50d4390 utils.py: fix types in docstrings for base64url_encode/decode (#269)
• 8fd0b63 Add RTD config file to silence emailed deprecation warnings (#333)
• 6f03385 Added possibility to call jwk.construct() with a private key (#295)
• 2f0aca6 Add python_requires arg to setup.cfg (#273)
• 895777e Updated pyasn version to match latest (#338)
• 45bd124 Update jwk.py (#328)
• 1f0ae0a docs: Fix a few typos (#299)
• ceaac36 Do not use utc_now on module level (#372)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: python. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.