chore(deps): Bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the /mcp/flight_tool directory: playwright, authlib, protobuf and pyjwt.

Updates playwright from 1.61.0 to 1.62.0

Release notes

Sourced from playwright's releases.

v1.62.0

🖼️ WebP screenshots

page.screenshot() and locator.screenshot() can now capture screenshots in the WebP format. Playwright infers the format from a .webp file extension, or you can set the type explicitly. Quality 100 (the default) is lossless, while lower values use lossy compression:

page.screenshot(path="homepage.webp", quality=50)

New APIs

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scrolling into view.
• New locator.wait_for_function() waits until a function called with the matching element returns a truthy value.
• New apiResponse.timing() returns resource timing information for an API response.

Announcements

• 📋 The clipboard is now isolated from the operating system in headless mode, so tests that use navigator.clipboard no longer read or overwrite the clipboard of the machine running them.
• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

Commits

• 3b7c24c chore: roll Playwright to 1.62.0 (#3161)
• 1db079f build(deps): bump typing-extensions from 4.15.0 to 4.16.0 (#3162)
• 8335307 build(deps): bump greenlet from 3.5.3 to 3.5.4 (#3163)
• 5c71b2b build(deps): bump mypy from 2.1.0 to 2.3.0 (#3150)
• d0c8d03 build(deps-dev): bump setuptools-scm from 9.2.2 to 10.2.1 (#3151)
• ca0319c build(deps): bump build from 1.4.4 to 1.5.0 (#3152)
• 53802fe build(deps): bump requests from 2.33.0 to 2.34.2 (#3153)
• 9bc998f build(deps): bump actions/setup-python from 6 to 7 in the actions group (#3154)
• 9a10128 perf: speed up Python stack capture (#3147)
• c3eff76 fix: show not_ prefix in call log when negative assertions fail (#3033)
• Additional commits viewable in compare view

Updates authlib from 1.7.2 to 1.8.0

Release notes

Sourced from authlib's releases.

v1.8.0

What's Changed

• Prefer id_token_signed_response_alg client metadata to guess algs by @​azmeuk in authlib/authlib#888
• fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by @​liudonggalaxy in authlib/authlib#891
• fix: make leeway configurable in JWTBearerTokenValidator by @​mondi04 in authlib/authlib#903
• feat: add default jti claim to sign_jwt_bearer_assertion by @​liudonggalaxy in authlib/authlib#897
• fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by @​levinKaus in authlib/authlib#911
• Declare lower bounds for dependencies by @​azmeuk in authlib/authlib#912
• feat(client): use httpx2 instead of httpx by @​levinKaus in authlib/authlib#909
• Fix RFC7523 malformed claims handling by @​azmeuk in authlib/authlib#916
• Fix httpx oauth1 binary form data by @​shc261392 in authlib/authlib#779
• fix(starlette_client): remove default= keyword from config.get calls by @​aliaksei-protchanka in authlib/authlib#770
• Added client_id parameter to AssertionClient by @​vilmar-hillow in authlib/authlib#476
• fix(oauth): save device credential with authenticated client id by @​arpitjain099 in authlib/authlib#908
• fix(oauth1): correct protocol name in InsecureTransportError description by @​RavSinghChandan in authlib/authlib#919
• fix(client): client can be flexible with jwt's header by @​lepture in authlib/authlib#922
• fix(oidc): omit claims when the value is None by @​lepture in authlib/authlib#923

New Contributors

• @​mondi04 made their first contribution in authlib/authlib#903
• @​levinKaus made their first contribution in authlib/authlib#911
• @​aliaksei-protchanka made their first contribution in authlib/authlib#770
• @​vilmar-hillow made their first contribution in authlib/authlib#476
• @​arpitjain099 made their first contribution in authlib/authlib#908
• @​RavSinghChandan made their first contribution in authlib/authlib#919

Full Changelog: authlib/authlib@v1.7.2...v1.8.0

Commits

• 1a86748 chore: release 1.8.0
• e4fb941 Merge pull request #923 from authlib/fix-921
• 9f2cd2e Merge pull request #922 from authlib/fix-902
• 5d53239 fix(oidc): omit claims when the value is None
• 772bc72 Merge pull request #919 from RavSinghChandan/fix-oauth1-insecure-transport-de...
• 11794b0 Merge pull request #908 from arpitjain099/chore/device-cred-authenticated-cli...
• 13f2eb0 fix(client): Added client_id parameter to AssertionClient (#476)
• dde5b7a fix(client): rollback
• e4aec8c fix(client): remove default= keyword from starlette client config.get calls (...
• 62f41cc fix(client): httpx oauth1 binary form data (#779)
• Additional commits viewable in compare view

Updates protobuf from 7.35.1 to 7.36.1

Commits

• See full diff in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions