[dependabot]

Bumps authlib from 1.7.2 to 1.9.1.

Release notes

Sourced from authlib's releases.

v1.9.1

Changelog: https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1

What's Changed

• Use scriv to handle the changelog by @​azmeuk in authlib/authlib#954

Full Changelog: authlib/authlib@v1.9.0...v1.9.1

v1.9.0

What's Changed

• feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by @​BinoyOza-okta in authlib/authlib#898
• Fix empty signatures validation in JWS JSON deserialization by @​loporto in authlib/authlib#938
• fix(jose): reject boolean values for NumericDate claims by @​cpruijsen in authlib/authlib#942
• fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by @​cpruijsen in authlib/authlib#943
• OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by @​juneja-varun in authlib/authlib#929
• docs: add i18n wrappers in conf.py and templates by @​hwhsu1231 in authlib/authlib#901
• fix(oauth): enforce JOSE key, scope, and audience validation by @​lepture in authlib/authlib#945
• AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by @​ckarnell in authlib/authlib#924
• fix(oauth): enforce nonce and JAR request validation by @​lepture in authlib/authlib#949
• fix(oauth): require client authentication for ID-JAG grants by @​lepture in authlib/authlib#955

New Contributors

• @​BinoyOza-okta made their first contribution in authlib/authlib#898
• @​loporto made their first contribution in authlib/authlib#938
• @​cpruijsen made their first contribution in authlib/authlib#942
• @​juneja-varun made their first contribution in authlib/authlib#929
• @​hwhsu1231 made their first contribution in authlib/authlib#901
• @​ckarnell made their first contribution in authlib/authlib#924

Full Changelog: authlib/authlib@v1.8.0...v1.9.0

v1.8.0

What's Changed

• Prefer id_token_signed_response_alg client metadata to guess algs by @​azmeuk in authlib/authlib#888
• fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @​liudonggalaxy in authlib/authlib#891
• fix: make leeway configurable in JWTBearerTokenValidator by @​mondi04 in authlib/authlib#903
• feat: add default jti claim to sign_jwt_bearer_assertion by @​liudonggalaxy in authlib/authlib#897
• fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @​levinKaus in authlib/authlib#911
• Declare lower bounds for dependencies by @​azmeuk in authlib/authlib#912
• feat(client): use httpx2 instead of httpx by @​levinKaus in authlib/authlib#909
• Fix RFC7523 malformed claims handling by @​azmeuk in authlib/authlib#916
• Fix httpx oauth1 binary form data by @​shc261392 in authlib/authlib#779
• fix(starlette_client): remove default= keyword from config.get calls by @​aliaksei-protchanka in authlib/authlib#770
• Added client_id parameter to AssertionClient by @​vilmar-hillow in authlib/authlib#476
• fix(oauth): save device credential with authenticated client id by @​arpitjain099 in authlib/authlib#908
• fix(oauth1): correct protocol name in InsecureTransportError description by @​RavSinghChandan in authlib/authlib#919
• fix(client): client can be flexible with jwt's header by @​lepture in authlib/authlib#922
• fix(oidc): omit claims when the value is None by @​lepture in authlib/authlib#923

... (truncated)

Commits

• 46b9487 chore: release 1.9.1
• abb3f49 docs: use the issuer identifier as ID-JAG audience and fix broken links
• 1bd2a31 Merge commit from fork
• 311da11 docs: more detailed PKCE instructions
• 873f72c docs: rpinitiated instructions
• 4ff30db Merge commit from fork
• 9a86ff3 docs: rpinitiated sequence chart
• 1c35757 docs: RFC 9101 sequence chart
• a755e28 docs: add a sequence diagram to the token introspection page
• 1996c56 docs: PKCE flow chart illustration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Medium Risk
Authlib is an OAuth/JOSE dependency and the minor jump includes stricter token and request validation that could change runtime auth behavior.

Overview
Updates envs/wildfire_env/uv.lock to pin Authlib 1.9.1 (from 1.7.2), which is pulled in via fastmcp client/server extras. The lock revision moves to 5 and includes the usual uv churn: reordered Python 3.14 resolution-markers and fewer redundant per-dependency Python version markers on packages like contourpy, httpx2, and ipython.

Authlib 1.8–1.9 adds OAuth/OIDC/JOSE fixes and tighter validation (keys, scope, audience, nonce, JAR). Worth a quick pass on any wildfire env flows that use MCP OAuth or JWT handling.

^{Reviewed by Cursor Bugbot for commit c9fb4f5. Bugbot is set up for automated code reviews on this repo. Configure here.}