[Security] Bump pyjwt and rand for remaining GHSAs (#59427)
Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Juan Pérez de Algaba committed
Sep 30, 2026 at 16:26 UTC
eef8b15d7c34019880b5ad8c811f60652aa4a6a7
6 files changed
+16
-16
requirements/test/cuda.in
+1
-1
@@ -86,7 +86,7 @@ plotly # required for perf comparison html report
86
# Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp.
87
urllib3>=2.7.0
88
cryptography>=50.0.0
89
-pyjwt>=2.13.0
89
+pyjwt>=2.14.0
90
pyasn1>=0.6.4
91
python-multipart>=0.0.31
92
anyio>=4.14.2
requirements/test/rocm.in
+1
-1
@@ -84,7 +84,7 @@ plotly # required for perf comparison html report
84
# Skipped (no patched release yet): sqlitedict, accelerate, lmcache, nltk GHSA-8mgp-746c-j5xp.
85
urllib3>=2.7.0
86
cryptography>=50.0.0
87
-pyjwt>=2.13.0
87
+pyjwt>=2.14.0
88
pyasn1>=0.6.4
89
python-multipart>=0.0.31
90
anyio>=4.14.2
requirements/test/xpu.in
+1
-1
@@ -65,7 +65,7 @@ cohere>=7.0.0 # required for cohere chat v2 api tests (protocol/serving import c
65
# Dependabot GHSA floors for transitive test deps (excl. dependabot.yml ignores).
66
urllib3>=2.7.0
67
cryptography>=50.0.0
68
-pyjwt>=2.13.0
68
+pyjwt>=2.14.0
69
pyasn1>=0.6.4
70
python-multipart>=0.0.31
71
anyio>=4.14.2
requirements/test/xpu.txt
+1
-1
@@ -809,7 +809,7 @@ pygments==2.21.0
809
# -r requirements/test/xpu.in
810
# pytest
811
# rich
812
-pyjwt==2.13.0
812
+pyjwt==2.15.1
813
# via
814
# -r requirements/test/xpu.in
815
# mcp
rust/Cargo.lock
+11
-11
@@ -197,7 +197,7 @@ dependencies = [
197
"getrandom 0.3.4",
198
"hex",
199
"hmac",
200
- "rand 0.9.2",
200
+ "rand 0.9.5",
201
"reqwest 0.12.28",
202
"reqwest-eventsource",
203
"secrecy",
@@ -1727,7 +1727,7 @@ dependencies = [
1727
"log",
1728
"native-tls",
1729
"num_cpus",
1730
- "rand 0.9.2",
1730
+ "rand 0.9.5",
1731
"reqwest 0.12.28",
1732
"serde",
1733
"serde_json",
@@ -2843,7 +2843,7 @@ checksum = "7b8d41ed865b7a26b6b2d2a519b774460e5ddc50eeeb4ac2a2409c8817ec2de9"
2843
dependencies = [
2844
"bitflags",
2845
"chrono",
2846
- "rand 0.9.2",
2846
+ "rand 0.9.5",
2847
"schemars 0.8.22",
2848
"serde",
2849
"serde_json",
@@ -3511,9 +3511,9 @@ dependencies = [
3511
3512
[[package]]
3513
name = "rand"
3514
-version = "0.9.2"
3514
+version = "0.9.5"
3515
source = "registry+https://github.com/rust-lang/crates.io-index"
3516
-checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
3516
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
3517
dependencies = [
3518
"rand_chacha 0.9.0",
3519
"rand_core 0.9.5",
@@ -3564,7 +3564,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
3564
checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
3565
dependencies = [
3566
"num-traits",
3567
- "rand 0.9.2",
3567
+ "rand 0.9.5",
3568
]
3569
3570
[[package]]
@@ -5042,7 +5042,7 @@ dependencies = [
5042
"monostate",
5043
"onig",
5044
"paste",
5045
- "rand 0.9.2",
5045
+ "rand 0.9.5",
5046
"rayon",
5047
"rayon-cond",
5048
"regex",
@@ -5443,7 +5443,7 @@ checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
5443
dependencies = [
5444
"bytes",
5445
"log",
5446
- "rand 0.9.2",
5446
+ "rand 0.9.5",
5447
"thiserror 2.0.18",
5448
"utf-8",
5449
]
@@ -5750,7 +5750,7 @@ dependencies = [
5750
"indicatif",
5751
"mimalloc",
5752
"parquet",
5753
- "rand 0.9.2",
5753
+ "rand 0.9.5",
5754
"rand_distr",
5755
"rayon",
5756
"reqwest 0.12.28",
@@ -5949,7 +5949,7 @@ dependencies = [
5949
"asynk-strim-attr",
5950
"clap",
5951
"futures",
5952
- "rand 0.9.2",
5952
+ "rand 0.9.5",
5953
"rmpv",
5954
"serde",
5955
"tokio",
@@ -6734,7 +6734,7 @@ dependencies = [
6734
"num-traits",
6735
"once_cell",
6736
"parking_lot",
6737
- "rand 0.9.2",
6737
+ "rand 0.9.5",
6738
"regex",
6739
"scc 3.6.9",
6740
"thiserror 1.0.69",
rust/Cargo.toml
+1
-1
@@ -80,7 +80,7 @@ prost-types = "0.14.3"
80
protox = "0.9.1"
81
pyo3 = "0.29.0"
82
pythonize = "0.29.0"
83
-rand = "0.9.2"
83
+rand = "0.9.3"
84
rand_distr = "0.5.1"
85
rayon = "1.11.0"
86
reasoning-parser = "1.2.2"