Bump PyJWT to 2.13.0 (#172893)

Co-authored-by: Robert Resch <robert@resch.dev>

homeassistant/auth/__init__.py

@@ -675,7 +675,7 @@ class AuthManager:
             jwt_wrapper.verify_and_decode(
                 token, jwt_key, leeway=10, issuer=issuer, algorithms=["HS256"]
             )
-        except jwt.InvalidTokenError:
+        except jwt.InvalidTokenError, jwt.InvalidKeyError:
             return None
 
         if refresh_token is None or not refresh_token.user.is_active:

homeassistant/components/html5/notify.py

@@ -331,7 +331,10 @@ class HTML5PushCallbackView(HomeAssistantView):
         if target_check.get(ATTR_TARGET) in self.registrations:
             possible_target = self.registrations[target_check[ATTR_TARGET]]
             key = possible_target["subscription"]["keys"]["auth"]
-            with suppress(jwt.exceptions.DecodeError), warnings.catch_warnings():
+            with (
+                suppress(jwt.exceptions.DecodeError, jwt.exceptions.InvalidKeyError),
+                warnings.catch_warnings(),
+            ):
                 warnings.simplefilter("ignore", InsecureKeyLengthWarning)
                 return jwt.decode(token, key, algorithms=["ES256", "HS256"])
 

homeassistant/package_constraints.txt

@@ -53,7 +53,7 @@ paho-mqtt==2.1.0
 Pillow==12.3.0
 propcache==0.5.2
 psutil-home-assistant==0.0.1
-PyJWT==2.12.1
+PyJWT==2.13.0
 pymicro-vad==1.0.1
 PyNaCl==1.6.2
 pyOpenSSL==26.2.0

pyproject.toml

@@ -55,7 +55,7 @@ dependencies = [
   "ifaddr==0.2.0",
   "Jinja2==3.1.6",
   "lru-dict==1.4.1",
-  "PyJWT==2.12.1",
+  "PyJWT==2.13.0",
   # PyJWT has loose dependency. We want the latest one.
   "cryptography==48.0.1",
   "Pillow==12.3.0",

requirements.txt

@@ -39,7 +39,7 @@ packaging>=23.1
 Pillow==12.3.0
 propcache==0.5.2
 psutil-home-assistant==0.0.1
-PyJWT==2.12.1
+PyJWT==2.13.0
 pymicro-vad==1.0.1
 pyOpenSSL==26.2.0
 pyspeex-noise==1.0.2

tests/components/elmax/conftest.py

@@ -82,7 +82,7 @@ def httpx_mock_direct_fixture(base_uri: str) -> Generator[respx.MockRouter]:
         expiration = datetime.now() + timedelta(hours=1)  # pylint: disable=home-assistant-enforce-naive-now
         decoded_jwt["payload"]["exp"] = int(expiration.timestamp())
         jws_string = jwt.encode(
-            payload=decoded_jwt["payload"], algorithm="HS256", key=""
+            payload=decoded_jwt["payload"], algorithm="HS256", key="test"
         )
         login_json["token"] = f"JWT {jws_string}"
         login_route.return_value = Response(200, json=login_json)