Drops deprecated authlib for joserfc: native algorithm allowlist, enforced claims, uv-based packaging. Python 3.10+.

.github/workflows/python-publish.yml

@@ -0,0 +1,36 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write  # trusted publishing (OIDC)
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - name: Verify tag matches pyproject version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml","rb"))["project"]["version"])')"
+          if [ "$tag" != "$version" ]; then
+            echo "tag $tag does not match pyproject.toml version $version" >&2
+            exit 1
+          fi
+
+      - run: uv sync
+      - name: Run tests
+        env:
+          DJANGO_SETTINGS_MODULE: tests.settings
+        run: uv run python -m django test
+      - run: uv build
+
+      - uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/test.yaml

@@ -1,24 +1,23 @@
 name: Run tests
+
 on:
   pull_request:
   push:
 
 jobs:
-  build:
+  test:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ['3.7', '3.8', '3.9', '3.10']
-
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install tox tox-gh-actions
-    - name: Test with tox
-      run: tox
+      - uses: actions/checkout@v5
+
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+
+      - run: uv sync
+
+      - name: Run tests
+        env:
+          DJANGO_SETTINGS_MODULE: tests.settings
+          PYTHONPATH: ${{ github.workspace }}
+        run: uv run python -m django test

CHANGELOG.md

@@ -1,4 +1,18 @@
 <h1>Changelog</h1>
+<h2>4.0.0</h2>
+This release replaces the deprecated <code>authlib</code> dependency with <code>joserfc</code> directly, and drops Python 3.7-3.9 support (requires Python 3.10 or newer).
+
+JWT signature verification now only accepts tokens whose <code>alg</code> is listed in the new <code>JWT_ALGORITHMS</code> setting (default: <code>RS256</code>). Tokens using other algorithms, including unsigned ones, are rejected before verification. Tokens with a malformed header, or with an unknown <code>kid</code>, are now rejected with a 401 instead of raising a 500. Claim validation (<code>exp</code>, <code>iat</code>, <code>iss</code>, <code>aud</code>) is enforced explicitly and no longer depends on authlib version-specific leeway semantics. The algorithms can be configured with:
+
+```
+'OIDC_AUTH': {
+    ...
+    'JWT_ALGORITHMS': ('RS256',),
+}
+```
+
+Packaging moved to <code>pyproject.toml</code> with a <code>uv.lock</code>, and the package is published to PyPI automatically when a GitHub release is published.
+
 <h2>1.0.0</h2>
 Replace the deprecated `jwkest` library with the maintained `authlib` library. Note that this is not backwards compatible, but this might not be immediately obvious. You have to adjust your settings, i.e. `OIDC_AUDIENCES` is deprecated and replaced by: