rjd15372 · Oct 29, 2026 · Oct 29, 2026
diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service b/root/ppg/common/deps/pgadmin/python3-authlib/obs/_service
@@ -1,5 +1,5 @@
 <services>
   <service name="download_url">
-    <param name="url">https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.6.12.tar.gz</param>
+    <param name="url">https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.9.1.tar.gz</param>
   </service>
 </services>
diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml b/root/ppg/common/deps/pgadmin/python3-authlib/package.yaml
@@ -1,4 +1,4 @@
-title: Authlib 1.6.12 for Python 3.12
+title: Authlib 1.9.1 for Python 3.12
 description: |
   The ultimate Python library in building OAuth and OpenID Connect servers and clients. RPM-only python3.12-* build from the PyPI sdist,
   consumed by pgAdmin 4 (percona-pgadmin4). Bump by editing obs/_service (sdist URL) and

diff --git a/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec b/root/ppg/common/deps/pgadmin/python3-authlib/rpm/python3-authlib.spec
@@ -13,12 +13,12 @@
 %global python3_sitelib %(%{__ospython} -Esc "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '/usr', 'base': '%{_prefix}'}))")
 
 Name:           %{python3_pkgprefix}-authlib
-Version:        1.6.12
+Version:        1.9.1
 Release:        1%{?dist}
 Summary:        The ultimate Python library in building OAuth and OpenID Connect servers and clients
 License:        BSD-3-Clause
 URL:            https://github.com/authlib/authlib
-Source0:        https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.6.12.tar.gz
+Source0:        https://files.pythonhosted.org/packages/source/A/Authlib/authlib-1.9.1.tar.gz
 BuildArch:      noarch
 Vendor:         Percona, LLC
 Packager:       Percona Development Team <https://jira.percona.com>
@@ -30,8 +30,11 @@ BuildRequires:  python%{python3_buildversion}-setuptools
 BuildRequires:  python%{python3_buildversion}-wheel
 # runtime dependencies, also needed by the %check import test
 BuildRequires:  python3.12-cryptography
+BuildRequires:  python3.12-joserfc
 
 Requires:       python3.12-cryptography
+# authlib 1.7+ delegates JOSE (JWS/JWE/JWK/JWT) to joserfc
+Requires:       python3.12-joserfc
 # authlib.integrations.flask_client imports ..requests_client unconditionally,
 # which needs requests (RHEL 9 package). Found by the Task 5 smoke test.
 Requires:       python3.12-requests
@@ -42,7 +45,7 @@ The ultimate Python library in building OAuth and OpenID Connect servers and cli
 Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmin4) dependency stack.
 
 %prep
-%autosetup -p1 -n authlib-1.6.12
+%autosetup -p1 -n authlib-1.9.1
 
 %build
 %{__ospython} -m pip wheel --no-deps --no-build-isolation --no-index --wheel-dir dist .
@@ -51,11 +54,15 @@ Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmi
 %{__ospython} -m pip install --no-deps --no-index --root %{buildroot} --prefix %{_prefix} dist/*.whl
 
 %check
-PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import authlib"
+PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import authlib, authlib.oidc.core"
 
 %files
 %{python3_sitelib}/*
 
 %changelog
+* Thu Oct 29 2026 Percona Development Team <info@percona.com> - 1.9.1-1
+- Update to Authlib 1.9.1 (CVE-2026-96760, CVE-2026-114615, CVE-2026-114616)
+- Require python3.12-joserfc (new runtime dependency since 1.7)
+
 * Thu Aug 27 2026 Percona Development Team <info@percona.com> - 1.6.12-1
 - Package Authlib 1.6.12 for Python 3.12 (pgAdmin 4 dependency stack)
diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service b/root/ppg/common/deps/pgadmin/python3-joserfc/obs/_service
@@ -0,0 +1,5 @@
+<services>
+  <service name="download_url">
+    <param name="url">https://files.pythonhosted.org/packages/source/j/joserfc/joserfc-1.7.7.tar.gz</param>
+  </service>
+</services>
diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml b/root/ppg/common/deps/pgadmin/python3-joserfc/package.yaml
@@ -0,0 +1,5 @@
+title: joserfc 1.7.7 for Python 3.12
+description: |
+  The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT. RPM-only python3.12-* build from the PyPI sdist,
+  consumed by pgAdmin 4 (percona-pgadmin4) through python3-authlib. Bump by editing obs/_service (sdist URL) and
+  rpm/*.spec (Version + changelog).
diff --git a/root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec b/root/ppg/common/deps/pgadmin/python3-joserfc/rpm/python3-joserfc.spec
@@ -0,0 +1,57 @@
+%global debug_package %{nil}
+%if 0%{?rhel} && 0%{?rhel} >= 8
+%global __ospython        %{_bindir}/python3.12
+%global python3_pkgprefix python3.12
+%global python3_buildversion 3.12
+%global __requires_exclude ^python3\\.12dist
+%else
+%global __ospython        %{_bindir}/python3
+%global python3_pkgprefix python3
+%global python3_buildversion 3
+%endif
+%{expand: %%global py3ver %(echo `%{__ospython} -P -c "import sys; print(f'{sys.version_info[0]}.{sys.version_info[1]}')" `)}
+%global python3_sitelib %(%{__ospython} -Esc "import sysconfig; print(sysconfig.get_path('purelib', vars={'platbase': '/usr', 'base': '%{_prefix}'}))")
+
+Name:           %{python3_pkgprefix}-joserfc
+Version:        1.7.7
+Release:        1%{?dist}
+Summary:        The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT
+License:        BSD-3-Clause
+URL:            https://github.com/authlib/joserfc
+Source0:        https://files.pythonhosted.org/packages/source/j/joserfc/joserfc-1.7.7.tar.gz
+BuildArch:      noarch
+Vendor:         Percona, LLC
+Packager:       Percona Development Team <https://jira.percona.com>
+
+BuildRequires:  python%{python3_buildversion}-devel
+BuildRequires:  python%{python3_buildversion}-pip
+BuildRequires:  python%{python3_buildversion}-setuptools
+BuildRequires:  python%{python3_buildversion}-wheel
+# runtime dependency, also needed by the %check import test
+BuildRequires:  python3.12-cryptography
+
+Requires:       python3.12-cryptography
+
+%description
+The ultimate Python library for JOSE RFCs, including JWS, JWE, JWK, JWA, JWT.
+
+Built for Python 3.12 from the PyPI sdist; part of the pgAdmin 4 (percona-pgadmin4) dependency stack.
+
+%prep
+%autosetup -p1 -n joserfc-1.7.7
+
+%build
+%{__ospython} -m pip wheel --no-deps --no-build-isolation --no-index --wheel-dir dist .
+
+%install
+%{__ospython} -m pip install --no-deps --no-index --root %{buildroot} --prefix %{_prefix} dist/*.whl
+
+%check
+PYTHONPATH=%{buildroot}%{python3_sitelib} %{__ospython} -P -c "import joserfc.jwt"
+
+%files
+%{python3_sitelib}/*
+
+%changelog
+* Thu Oct 29 2026 Percona Development Team <info@percona.com> - 1.7.7-1
+- Package joserfc 1.7.7 for Python 3.12 (Authlib 1.7+ dependency, pgAdmin 4 stack)