fix(deps): update dependency authlib to v1.7.2

[kognic-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
authlib	1.6.12 → 1.7.2

---

Release Notes

authlib/authlib (authlib)

v1.7.2

Compare Source

What's Changed

• Fix the readme links by @​azmeuk in #​886
• Allow non-recommended algorithms in ClientSecretJWT and PrivateKey by @​azmeuk in #​887
• Validate BCP47 language tags with a regex by @​azmeuk in #​873
• Fix RFC7523 signing with non RSA keys by @​azmeuk in #​884

Full Changelog: authlib/authlib@v1.7.1...v1.7.2

v1.7.1

Compare Source

What's Changed

• Fix authlib.jose deprecation warning poping from _joserfc_helpers by @​azmeuk in #​881
• Fix redirecting to unvalidated redirect_uri on InvalidScopeError in OpenIDImplicitGrant and OpenIDHybridGrant.

Full Changelog: authlib/authlib@v1.7.0...v1.7.1

v1.7.0

Compare Source

What's Changed

• Authorization and token endpoints request empty scope parameter management by @​azmeuk in #​847
• Support from Python 3.10 to 3.14 by @​azmeuk in #​850
• Allow composition of AuthorizationServerMetadata by @​azmeuk in #​853
• Make require_oauth parenthesis optional by @​azmeuk in #​855
• Fix expires_at behavior when its value is 0 by @​azmeuk in #​854
• Migration to joserfc by @​lepture in #​852
• RP-initiated logout by @​frohrlich in #​849
• Fix get_jwt_config by @​lepture in #​858
• chore(ci): Update PyPy version from 3.10 to 3.11 by @​cclauss in #​863
• fix: remove "none" from default authlib.jose.jwt algorithms by @​lepture in #​860
• fix: normalize resolve_client_public_key method by @​lepture in #​861
• Implement rfc9700 PKCE downgrade countermeasure by @​azmeuk in #​864
• Use correct syntax for tox.requires in tox.ini by @​alex-ball in #​868
• Set client session User-Agent when fetching server metadata and JWKs by @​alex-ball in #​867
• fix: use the real application object for Flask by @​nblock in #​869
• Accept the issuer URL as a valid audience by @​azmeuk in #​865
• Don't nest InvalidTokenError extra attribute by @​azmeuk in #​872
• Documentation overhaul by @​azmeuk in #​875
• Update README.md docs.authlib.org/en/latest => docs.authlib.org/en/stable by @​guillett in #​876
• Merge release/1.6 branch by @​lepture in #​877

New Contributors

• @​frohrlich made their first contribution in #​849
• @​cclauss made their first contribution in #​863
• @​alex-ball made their first contribution in #​868
• @​nblock made their first contribution in #​869
• @​guillett made their first contribution in #​876

Full Changelog: authlib/authlib@v1.6.10...v1.7.0

---

Configuration

📅 Schedule: (in timezone Europe/Stockholm)

• Branch creation
  • "after 09:00 and before 15:00 on monday, tuesday, wednesday and thursday,after 09:00 and before 13:00 on friday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[kognic-github-app]

✅ Agent review approved this PR.

authlib 1.6.12→1.7.2: No upstream chatter hits. Release notes show bug fixes and improvements: security fix removing "none" from default JWT algorithms, fix for unvalidated redirect_uri on InvalidScopeError, PKCE downgrade countermeasure (RFC9700), and an internal migration to joserfc. No breaking changes declared. Package is well-established (5,398 stars, BSD-3-Clause). The new joserfc entry in the lockfile is a transitive dependency of authlib, not a new direct dep — out of scope.

Sources:

• https://github.com/authlib/authlib/releases/tag/v1.7.2
• authlib/authlib@1.6.12...v1.7.2

Package	Ecosystem	Source repo	Verification
authlib	pypi	github.com/authlib/authlib	chatter+changelog

[kognic-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.