mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
pip-audit flagged four advisories against 2.12.1, all fixed in 2.13.0. Audited the five behavioural changes in 2.13.0 against our usage; none apply (HMAC empty-key reject can't trigger, OIDC decode uses raw-key path not PyJWK, jwks_uri is HTTPS from discovery, no b64=false usage, enforce_minimum_key_length not opted into). 229 auth/MFA/OIDC integration tests + 78 auth unit tests green on 2.13.0; runtime encode/decode roundtrip verified with the real SECRET_KEY; pip-audit --strict now clean.