Merge pull request #3118 from ASFHyP3/develop

Release v10.14.1

Author: asjohnston-asf

.github/workflows/changelog.yml

@@ -13,4 +13,6 @@ on:
 
 jobs:
   call-changelog-check-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-changelog-check.yml@v0.21.1
+    permissions:
+      contents: read

.github/workflows/create-jira-issue.yml

@@ -6,10 +6,12 @@ on:
 
 jobs:
   call-create-jira-issue-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-create-jira-issue.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-create-jira-issue.yml@v0.21.1
     secrets:
       JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
       JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
       JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
       JIRA_PROJECT: ${{ secrets.JIRA_PROJECT }}
       JIRA_FIELDS: ${{ secrets.JIRA_FIELDS }}
+    permissions:
+      issues: write

.github/workflows/labeled-pr.yml

@@ -12,4 +12,6 @@ on:
 
 jobs:
   call-labeled-pr-check-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-labeled-pr-check.yml@v0.21.1
+    permissions:
+      contents: read

.github/workflows/release-template-comment.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   call-release-checklist-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-release-checklist-comment.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-release-checklist-comment.yml@v0.21.1
     permissions:
       pull-requests: write
     with:

.github/workflows/release.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   call-release-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-release.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-release.yml@v0.21.1
+    permissions: {}
     with:
       release_prefix: HyP3
     secrets:

.github/workflows/static-analysis.yml

@@ -17,10 +17,10 @@ env:
 jobs:
   call-ruff-workflow:
     # Docs: https://github.com/ASFHyP3/actions
-    uses: ASFHyP3/actions/.github/workflows/reusable-ruff.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-ruff.yml@v0.21.1
 
   call-mypy-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-mypy.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-mypy.yml@v0.21.1
 
   cfn-lint:
     runs-on: ubuntu-latest
@@ -95,4 +95,4 @@ jobs:
           snyk iac test --severity-threshold=high
 
   call-secrets-analysis-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-secrets-analysis.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-secrets-analysis.yml@v0.21.1

.github/workflows/tag-version.yml

@@ -7,6 +7,7 @@ on:
 
 jobs:
   call-bump-version-workflow:
-    uses: ASFHyP3/actions/.github/workflows/reusable-bump-version.yml@v0.21.0
+    uses: ASFHyP3/actions/.github/workflows/reusable-bump-version.yml@v0.21.1
+    permissions: {}
     secrets:
       USER_TOKEN: ${{ secrets.TOOLS_BOT_PAK }}

CHANGELOG.md

@@ -97,6 +97,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `OperaRtcS1EndDate` stack parameter
   - `check_opera_rtc_s1_bounds` and `check_opera_rtc_s1_date` validators and associated tests
 
+## [10.14.2]
+
+### Changed
+- Upgraded PyJWT to 2.13.0; resolves CVE-2026-48526.
+
 ## [10.14.1]
 
 ### Changed

requirements-all.txt

@@ -5,16 +5,16 @@
 -r requirements-apps-disable-private-dns.txt
 -r requirements-apps-search-archive.txt
 -r requirements-apps-update-db.txt
-boto3==1.42.97
+boto3==1.43.18
 jinja2==3.1.6
-moto[dynamodb]==5.1.22
+moto[dynamodb]==5.2.1
 pytest==9.0.3
 PyYAML==6.0.3
-responses==0.26.0
-ruff==0.15.12
-mypy==1.20.2
+responses==0.26.1
+ruff==0.15.15
+mypy==2.1.0
 setuptools==82.0.1
 setuptools_scm==10.0.5
 jsonschema==4.26.0
 openapi-spec-validator==0.8.5
-cfn-lint==1.50.0
+cfn-lint==1.51.2

requirements-apps-api-binary.txt

@@ -1 +1 @@
-cryptography==47.0.0
+cryptography==48.0.0