[dependabot]

Bumps authlib from 1.8.0 to 1.9.1.

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

• Use scriv to handle the changelog by @​azmeuk in authlib/authlib#954

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

• feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @​BinoyOza-okta in authlib/authlib#898
• Fix empty signatures validation in JWS JSON deserialization by @​loporto in authlib/authlib#938
• fix(jose): reject boolean values for NumericDate claims by @​cpruijsen in authlib/authlib#942
• fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @​cpruijsen in authlib/authlib#943
• OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @​juneja-varun in authlib/authlib#929
• docs: add i18n wrappers in conf.py and templates by @​hwhsu1231 in authlib/authlib#901
• fix(oauth): enforce JOSE key, scope, and audience validation by @​lepture in authlib/authlib#945
• AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @​ckarnell in authlib/authlib#924
• fix(oauth): enforce nonce and JAR request validation by @​lepture in authlib/authlib#949
• fix(oauth): require client authentication for ID-JAG grants by @​lepture in authlib/authlib#955

New Contributors

• @​BinoyOza-okta made their first contribution in authlib/authlib#898
• @​loporto made their first contribution in authlib/authlib#938
• @​cpruijsen made their first contribution in authlib/authlib#942
• @​juneja-varun made their first contribution in authlib/authlib#929
• @​hwhsu1231 made their first contribution in authlib/authlib#901
• @​ckarnell made their first contribution in authlib/authlib#924

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

Commits

• 46b9487 chore: release 1.9.1
• abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
• 1bd2a31 Merge commit from fork
• 311da11 docs: more detailed PKCE instructions
• 873f72c docs: rpinitiated instructions
• 4ff30db Merge commit from fork
• 9a86ff3 docs: rpinitiated sequence chart
• 1c35757 docs: RFC 9101 sequence chart
• a755e28 docs: add a sequence diagram to the token introspection page
• 1996c56 docs: PKCE flow chart illustration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Authlib handles OAuth/JOSE and the jump includes stricter validation behavior, but impact is limited to the test lockfile and transitive MCP client/server deps—not production app code.

Overview
Updates tests/validation_runtime/uv.lock so the resolved authlib package moves from 1.8.0 to 1.9.1 (sdist/wheel URLs and hashes only). There are no changes to application code or direct test dependencies; authlib remains a transitive dependency of the validation runtime environment (via openenv → fastmcp / fastmcp-slim OAuth-related extras).

Reviewers should treat this as a routine Dependabot lock refresh and rely on existing validation runtime tests to catch regressions if MCP/OAuth paths exercise authlib at runtime.

^{Reviewed by Cursor Bugbot for commit a702360. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

Scope

This PR is a Dependabot uv.lock bump for authlib (1.8.0 → 1.9.1) in tests/validation_runtime, a transitive dependency pulled in via openenv's client/server extras (used for MCP OAuth). The diff is 3 lines changed in a single lockfile: version string, sdist hash/URL, wheel hash/URL. No Python source, no pyproject.toml, and no behavior changed.

Automated Checks

• Lint: FAIL (pre-existing, unrelated to this diff) — usort/ruff format currently flag ~47 files across src/, tests/, envs/ on a clean checkout of this branch. None of those files are touched by this PR; the only file in the diff (tests/validation_runtime/uv.lock) is a generated lockfile outside lint's scope. Not a regression introduced here.
• Debug code: CLEAN for this diff — check-debug.sh surfaces pre-existing print()/TODO occurrences in src/openenv/... (CLI/docstring examples, harness code), none of which are part of this change.

Open RFCs Context

• RFC 008 — Environment Auto-Validation (In Review) governs the tests/validation_runtime directory this PR touches. The PR only updates a transitive dependency's pinned version/hash in uv.lock; it does not touch the validation levels, acceptance criteria, toolchain pins (toolchain.json — Python 3.12.13 / uv 0.9.3), or acceptance.json that RFC 008 specifies. No conflict.
• Other Draft/In Review RFCs (e.g. 002-env-spec.md amendment, 014-environment-services.md) are unrelated to this change — authlib isn't referenced by name in any RFC.

Tier 1: Fixes Required

None. The lockfile edit is internally consistent (version, sdist hash+URL, wheel hash+URL all updated together), and this is a minor version bump (1.8.x → 1.9.1) with no requires-dist/dependency-graph changes visible in the diff.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This doesn't touch the Gym-like API, client/server boundary, reward computation, or MCP tool surface — it's a dependency-hash update only.

RFC Conflicts

None identified. See RFC 008 note above — the change is orthogonal to the validation-runtime design it ships inside.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

This is a routine, low-risk transitive dependency bump safe to merge once CI (including the tests/validation_runtime reproduction suite) passes.

  

_{Sent by Cursor Automation: Pre-review}