{
  "_comment": [
    "Advisories reviewed and accepted, with the reason and the date.",
    "This is a RECORD, not a mute button: an entry says somebody looked at",
    "the advisory and worked out why it does not apply here. Anyone can",
    "re-read the reason and disagree.",
    "",
    "An entry needs an id, a reason that names the precondition that is",
    "absent, who accepted it, and when. 'reviewuntil' is when the reasoning",
    "should be checked again - a reason stops being true when the code that",
    "made it true changes.",
    "",
    "Do NOT add an entry to make a build pass. Upgrading the dependency is",
    "almost always cheaper than defending a decision to skip it."
  ],
  "accepted": [
    {
      "id": "GHSA-xgmm-8j9v-c9wx",
      "component": "pyjwt",
      "reason": "Needs a verifier configured with BOTH symmetric and asymmetric algorithms and a raw JSON JWK passed as key=. Neither is present: auth goes through flask-jwt-extended with no JWT_ALGORITHM or JWT_DECODE_ALGORITHMS override anywhere in the tree, so it is HS256-only, and the key is the JWT_SECRET_KEY string. Upstream rates the attack complexity High for exactly this reason. Upgrade to pyjwt 2.13.0 anyway at the next dependency bump; this entry only says it is not urgent.",
      "acceptedby": "DT team, reference site",
      "accepted": "2026-08-29",
      "reviewuntil": "2026-11-29",
      "invalidatedby": "Setting JWT_ALGORITHM or JWT_DECODE_ALGORITHMS to anything asymmetric, or moving to SSO-issued tokens verified against a JWK."
    }
  ]
}