[Feature Request] Raise the minimum supported PyJWT version to a patched release #984

MSAL client type: Confidential

Problem statement

MSAL 1.39.0 declares PyJWT[crypto]>=1.0.0,<3, which permits versions affected by several published PyJWT advisories. This also affects applications that depend on MSAL indirectly, for example through Azure Identity. Dependency scanners can flag an existing lockfile even though MSAL permits a patched PyJWT version.

Examples fixed in PyJWT 2.14.0:

• GHSA-p4g4-x82p-q773
• GHSA-ffc3-869f-jxw9
• GHSA-9j54-fg26-wv3r

Proposed solution

Would the maintainers consider raising MSAL's minimum PyJWT version to a currently patched release, such as 2.14.0 or later, or documenting the preferred approach for consumers to keep this transitive dependency patched? A newer minimum would prevent resolvers from selecting older affected versions when no downstream constraint is present.

I recognize that the maintainers previously explained in #473 that MSAL's usage was not susceptible to an older PyJWT decoding vulnerability. This request is about the dependency range and scanner findings; it does not assert that MSAL itself is exploitable. Consumers can already update or constrain PyJWT directly.