From 6f2bd2c443cfcc77ab4c4c548069660d3ed10e83 Mon Sep 17 00:00:00 2001
From: 3252a8 <3252a8@proton.me>
Date: Tue, 2 Jun 2026 22:34:36 +0300
Subject: [PATCH] deps: patch pyjwt and certifi security advisories

pip-audit flagged 6 advisories: PyJWT 2.12.1 (PYSEC-2026-175/177/178/179,
fixed in 2.13.0) and transitive certifi 2023.11.17 (PYSEC-2024-230, fixed
in 2024.7.4). Bump PyJWT and pin certifi to its latest release to enforce
the resolved version.
---
 backend/requirements.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index b1aacda..8fcd57c 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -9,6 +9,7 @@ email-validator==2.3.0
 sqlalchemy[asyncio]==2.0.49
 asyncpg==0.31.0
 aiocryptopay==0.4.8
-PyJWT[crypto]==2.12.1
+PyJWT[crypto]==2.13.0
 Pillow==12.2.0
 redis==6.4.0
+certifi==2026.5.20