release: OxyJWT 0.5.0 - #89
Merged
Merged
Conversation
Avoid parsing the protected header on every verified decode; only inspect when the compact JWT payload segment is empty (detached JWS form).
Use one jws_parse_compact call for verify_signature=False instead of get_unverified_header, jws_parse_compact, and decode_unverified.
Reject oversized RFC 7797 external payloads before copy/JSON parse, matching the compact JWT size limit.
perf(decode): gate RFC 7797 header peek on empty payload (#57)
perf(decode): single-parse unverified decode path (#58)
…ytes security(api): cap detached_payload size (RFC 7797) (#59)
Preflight decode and decode_unverified with split_compact_segments; align extract_signature_bytes with the same strict parser.
Extend workflow push branches to include dev; document in GITFLOW.md.
Call reusable CI workflow before wheel builds; document in RELEASING.md.
security(rust): unify compact JWT segment validation (#60)
ci: run full CI on pushes to dev (#62)
ci: gate PyPI release workflow on tests (#61)
Avoid orjson.dumps plus encode_json re-parse on the default encode path; keep encode_json for sort_headers or json_encoder.
perf(encode): avoid encode_json round-trip (#63)
Run jwt_decode and signature extraction in one GIL-free block; dedupe DecodingKey algorithm validation in keys.rs.
When whole-second leeway and standard compact JWT, defer aud/iss/sub to Rust if call-time audience/issuer/subject were set; keep strict_aud in Python.
perf(rust): combine detach in decode_verified_complete (#64)
perf(api): skip redundant Python aud/iss/sub checks (#65)
Apply jsonwebtoken-style claim checks after detached signature verify; skip redundant Python exp/nbf when leeway is whole seconds.
Align issuer validation with expected API parity; add tests for missing iss and bytes issuer rejection.
Rust claim validation does not cover a missing iss claim when issuer is provided; keep Python issuer validation on that path.
Guard JWKS fetch and kid LRU with an RLock; add concurrent access test.
Store raw JWK dicts until kid lookup or .keys access; keep _by_kid compat.
perf(rust): RFC 7797 verified path — claims in Rust (#66)
fix(api): align missing iss error with PyJWT (#69)
fix(jwks): thread-safe PyJWKClient cache (#67)
perf(jwks): lazy PyJWK materialization (#68)
Add strict segments, issuer bytes, and require_https cases; refresh module docstring.
Use 3 rounds and median ops/s for PyJWT ratio gates; drop absolute 500 ops/s floor. Document optional extended benchmark in RELEASING.md.
Clarify benchmark fairness in README and script help; upload cached-mode weekly benchmark artifact alongside default pem run.
…pand test: expand security regression contract (#72)
ci(bench): stabilize HS256 smoke benchmark (#71)
docs(bench): document fair asymmetric key comparison (#70)
Bump Python/Rust package version to 0.5.0, add changelog and release notes, and update security/support docs for the 0.5.x line.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merge
devintomainfor OxyJWT 0.5.0 — performance and hardening after 0.4.0.detached_payloadcap, strict compact JWT segments, thread-safePyJWKClient, expanded security regression suiteissuer=→InvalidIssuerErrorwhenissis missing (PyJWT parity)devpushes, release workflow gated on CI, stabilized HS256 bench smoke (median, 3 rounds), benchmark methodology docs0.5.0, changelog,RELEASE_NOTES_v0.5.0.md,SECURITY.md/ README / versioning updatesCloses #57, #58, #59, #60, #61, #62, #63, #64, #65, #66, #67, #68, #69, #70, #71, #72
After merge
main:git tag -a v0.5.0 -m "Release 0.5.0" && git push origin v0.5.0.github/RELEASE_NOTES_v0.5.0.md)Test plan
cargo test --manifest-path rust/Cargo.tomlpytest(139 passed, 1 skipped)pip install oxyjwt==0.5.0smoke on clean venv