refactor(auth): JWT ライブラリを python-jose から PyJWT へ移行し ecdsa 脆弱性を解消 by yusuke0610 · Pull Request #481 · yusuke0610/devforge

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

yusuke0610 · 2026-07-08T11:52:53Z

背景

python-jose[cryptography] の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性PYSEC-2026-1325（Minerva タイミング攻撃・P-256、CVSS 7.4）が存在し、CI の pip-audit が 全オープン PR・main 共通で fail していた。メンテナが「サイドチャネルは対象外」として修正しない方針のため requirements.txt の「バージョン引き上げ」運用が使えない。

対応

DevForge の JWT は RS256 のみ（app/core/security/auth.py）で python-jose は cryptography バックエンドを使い、ecdsa 経路（ecdsa.SigningKey.sign_digest()）は一切通らない。そのため脆弱性は実質非該当だが、依存ツリーから消すのが最もクリーンと判断し PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。

auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変）
requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0
THIRD_PARTY_LICENSES.md を make licenses で再生成
README.md / .claude/rules/backend/auth-security.md の JWT ライブラリ表記を更新

検証

pip-audit -r requirements.txt → No known vulnerabilities found（ecdsa がツリーから消失）
auth / security テスト 150 件 pass（HS256→RS256 拒否テスト含む）
make ci full green

影響範囲

このマージ後、blocker が解消されるため滞留中の Renovate PR（#466 / #467 / #468 / #470）も緑化してマージ可能になる。

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated the app’s authentication implementation to use a different JWT library, with no expected change to login or token behavior.
- Refreshed related dependency and license listings to match the current setup.
Documentation
- Aligned the README and internal guidance with the updated authentication stack.

python-jose の推移的依存 ecdsa 0.19.2 に修正版の出ない脆弱性 (PYSEC-2026-1325 / Minerva タイミング攻撃・P-256)があり、pip-audit が全 PR・main 共通で fail していた。DevForge の JWT は RS256 のみで cryptography バックエンドを使い ecdsa 経路は未使用のため、PyJWT[crypto] へ移行して ecdsa 依存自体を除去する。 - auth.py: jose.JWTError → jwt.PyJWTError（RS256 の署名・検証挙動は不変） - requirements.txt: python-jose[cryptography]==3.5.0 → PyJWT[crypto]==2.13.0 - THIRD_PARTY_LICENSES.md を make licenses で再生成 - README / auth-security.md の JWT ライブラリ表記を更新 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

coderabbitai · 2026-07-08T11:53:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a381b839-65b5-48d7-b1ce-a1bc15633d12

📥 Commits

Reviewing files that changed from the base of the PR and between 114f801 and a42100c.

📒 Files selected for processing (6)

.claude/rules/backend/auth-security.md
README.md
THIRD_PARTY_LICENSES.md
backend/app/core/security/auth.py
backend/requirements.txt
backend/tests/auth/test_token_manager.py

📝 Walkthrough

Walkthrough

The JWT library dependency is migrated from python-jose to PyJWT throughout the backend. The auth module's import and exception handling are updated to use jwt.PyJWTError, tests are adjusted, and requirements.txt, README, third-party license list, and internal rules documentation are updated accordingly.

Changes

JWT Library Migration

Layer / File(s)	Summary
Core auth logic switched to PyJWT `backend/app/core/security/auth.py`	Import changed from jose's jwt to direct `import jwt`; exception handling updated from `JWTError` to `jwt.PyJWTError` in key pair validation and token decoding, preserving the same 401 failure path.
Test suite updated for PyJWT import `backend/tests/auth/test_token_manager.py`	JWT import switched from `from jose import jwt` to `import jwt`, so encode/decode calls now target PyJWT.
Dependency manifest and documentation updates `backend/requirements.txt`, `README.md`, `THIRD_PARTY_LICENSES.md`, `.claude/rules/backend/auth-security.md`	`python-jose[cryptography]` replaced with `PyJWT[crypto]==2.13.0` in requirements; README, license list, and rules doc updated to reflect PyJWT usage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

yusuke0610/devforge#464: Both PRs modify backend/tests/auth/test_token_manager.py, updating JWT handling/imports and consolidating JWT claim assertions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: migrating JWT auth from python-jose to PyJWT to address the ecdsa vulnerability.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor/replace-python-jose-with-pyjwt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}