[ViperJuice]

First item from the 2026-09-01 codebase review (#227), D-01. See #224.

Why this is first, not tenth. The review lists D-01 as "refresh uv.lock", but pip-audit on the shipped lockfile reported nine advisories, and the load-bearing one is PYSEC-2026-176 in PyJWT 2.10.1 — a verifier-side algorithm allow-list bypass in jwt.decode(). That is the exact call at src/pmcp/auth.py:512 (jwt.decode(..., algorithms=list(allowed_algorithms))), and the exact control SECURITY.md promises:

Signatures are only accepted for the operator-configured algorithm allowlist (default RS256/ES256); the token's own alg header is never trusted.

Also closed, all adjacent to this repo's own auth work:

package	advisories	why it matters here
pyjwt 2.10.1 → 2.13.0	PYSEC-2026-175/176/177/178/179, 120	176 = allowlist bypass; 175 = PyJWKClient passes its URI straight to urllib.request.urlopen (next door to #210/#211); 177 = unknown-kid forces a JWKS refetch — this review's own S-07, reachable through the dependency too
cryptography 46.0.3 → 50.0.1	PYSEC-2026-3554, GHSA-537c-gmf6-5ccf	performs the signature verification
aiohttp 3.13.2 → 3.14.3	PYSEC-2026-3546/3547	the JWKS fetch client (the review's S-08)
starlette 0.50.0 → 1.6.0	PYSEC-2026-161/248/249/2280/2281	the HTTP surface. No fix exists inside 0.x
python-multipart, python-dotenv, click, pytest	9 more	—

pip-audit now reports No known vulnerabilities found.

Floors, not just the lock. aiohttp>=3.14.2 and pyjwt>=2.13.0 are declared. A floor that still admits the vulnerable range is not a pin — the same unbounded-dependency class that has bitten this repo before.

Targeted upgrades, deliberately not uv lock --upgrade. The blanket form also pulled ruff 0.14.10 → 0.16.6, whose new default rules failed ~40 pre-existing files under scripts/probes/ — unrelated churn inside a security fix. ruff is held at 0.14.10; only the eight flagged packages moved.

New blocking audit job. pip-audit --strict against the resolved environment (uv.lock is what ships and what advisories are scored against). Blocking rather than advisory because this repo's guard culture is fail-closed (#187, #189, #202, #217) and the whole lesson of D-01 is that an advisory on the auth path went unnoticed until a manual review. The cost — a newly published advisory can redden an unrelated PR — is the decision we want forced.

Its two new remote uses: raise the pinned-ref count guard from 30 to 32. That guard firing was correct: a new remote action is meant to be spelled twice.

Verification (each run in the step it is reported): pip-audit clean; full suite 3199 passed, with failures/errors/skips/deselects identical to main — including across the starlette 0.x→1.x and cryptography 46→50 major bumps (the 107 failed / 106 errors are the documented /tmp/package.json npm-identity host quirk, unrelated); ruff check, ruff format --check, mypy src/, and scripts/check_workflows.py all exit 0; workflow-guard suite 194 passed.

🤖 Generated with Claude Code

https://claude.ai/code/session_018NR2LKqZgn7CXVH2816gaa

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}