[Edwardvaneechoud]

Replace python-jose (no fixed release; pulls unfixable ecdsa) with PyJWT.
Bump fsspec via s3fs/gcsfs, filelock (py>=3.11), aiohttp, certifi,
gitpython, opentelemetry-api, setuptools and pytest. Update the kernel
lock (pillow, certifi, opentelemetry-api) and bump the kernel to 0.6.3
so the fix ships. Fix two worker log calls with a stray format arg.
cryptography stays <49 for Intel macOS wheels.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01Kzn6V5vUWgWkgjcEVvTUDu

[netlify]

✅ Deploy Preview for flowfile-wasm canceled.

Name	Link
🔨 Latest commit	b625a00
🔍 Latest deploy log	https://app.netlify.com/projects/flowfile-wasm/deploys/6add0ef26d265f521893efea

[claude]

Claude finished @Edwardvaneechoud's task in 23s —— View job

---

Review of PR #853: Fix backend dependency vulnerabilities

I read the diff and the JWT call sites. I didn't run the tests.

Verdict: looks good. I found no blocking issues.

python-jose → PyJWT

• Every encode/decode call uses an explicit algorithms=[ALGORITHM] (HS256), so there's no algorithm-confusion risk.
• Naive datetime.utcnow() values in exp are encoded as UTC by PyJWT, the same as jose did.
• The sub claim is always a string (username or "local_user"). PyJWT 2.10 rejects a non-string sub on decode, so this is fine.
• PyJWTError covers expiry, invalid signature and decode errors, so the except JWTError blocks still work.
• jwt.decode(id_token, options={"verify_signature": False}) is the right replacement for get_unverified_claims. The email is used only for display, not for authorization, so this is acceptable.
• PyJWT 2.10 may emit an InsecureKeyLengthWarning if JWT_SECRET_KEY is shorter than 32 bytes. That's a warning only, but check that the secret generated in get_jwt_secret is long enough.

Nits

• flowfile_core/tests/test_auth.py:8: the alias import jwt as jose_jwt is now misleading. Rename it to jwt. The import is also out of isort order, so ruff will flag it if tests were linted.
• If the Tauri/PyInstaller specs or build_backends listed jose as a hidden import, they would need updating. A grep found no jose references outside the code changed here.

Worker logging fix

• The two flowfile_logger.error("error", e) calls had a stray format arg, which would raise a logging formatting error. Replacing them with f-strings is correct.

Kernel

• Bumping kernel_runtime to 0.6.3 is the right way to ship the lock changes.
• The images.py pins and the regenerated manifest are consistent.
• Please confirm make check_kernel_manifest and tools/check_kernel_release_needed.py are green in CI.

Dependencies

• The filelock split on python markers is correct for a project that supports >=3.10.
• Python 3.10 users stay on filelock 3.x, which is documented in the comment.
• s3fs/gcsfs >=2026.6.0 raise the fsspec floor. Check that s3fs and gcsfs resolve to the same fsspec version in the lock, since they pin it tightly, and that the PyInstaller builds still work with them.
• cryptography<49 is kept for Intel macOS wheels, as the comment says.