Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/16197
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 8/1/2025
**Status:** ✅ Merged
**Merged:** 8/2/2025
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `dependabot/pip/backend/dev/authlib-1.6.1`
---
### 📝 Commits (1)
- [`293cdb8`](https://github.com/open-webui/open-webui/commit/293cdb810e2efaa776c17f730f237f58624e97e7) chore(deps): bump authlib from 1.4.1 to 1.6.1 in /backend
### 📊 Changes
**1 file changed** (+1 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/requirements.txt` (+1 -1)
</details>
### 📄 Description
Bumps [authlib](https://github.com/authlib/authlib) from 1.4.1 to 1.6.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p>
<blockquote>
<h2>Version 1.6.1</h2>
<ul>
<li>Filter key set with additional "alg" and "use" parameters.</li>
</ul>
<h2>Version 1.6.0</h2>
<ul>
<li>Fix issue when <a href="https://datatracker.ietf.org/doc/html/rfc9207.html">RFC9207</a> is enabled and the authorization endpoint response is not a redirection. [pull request <a href="https://redirect.github.com/authlib/authlib/issues/733">#733</a>](<a href="https://redirect.github.com/authlib/authlib/pull/733">authlib/authlib#733</a>)</li>
<li>Fix missing state parameter in authorization error responses. [issue <a href="https://redirect.github.com/authlib/authlib/issues/525">#525</a>](<a href="https://redirect.github.com/authlib/authlib/issues/525">authlib/authlib#525</a>)</li>
<li>Support for acr and amr claims in id_token. [issue <a href="https://redirect.github.com/authlib/authlib/issues/734">#734</a>](<a href="https://redirect.github.com/authlib/authlib/issues/734">authlib/authlib#734</a>)</li>
<li>Support for the none JWS algorithm.</li>
<li>Fix response_types strict order during dynamic client registration. [issue <a href="https://redirect.github.com/authlib/authlib/issues/760">#760</a>](<a href="https://redirect.github.com/authlib/authlib/issues/760">authlib/authlib#760</a>)</li>
<li>Implement <a href="https://datatracker.ietf.org/doc/html/rfc9101.html">RFC9101 The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)</a>. [issue <a href="https://redirect.github.com/authlib/authlib/issues/723">#723</a>](<a href="https://redirect.github.com/authlib/authlib/issues/723">authlib/authlib#723</a>)</li>
<li>OIDC <a href="https://docs.authlib.org/en/latest/specs/oidc.html#authlib.oidc.core.UserInfoEndpoint">UserInfo endpoint</a> support. [issue <a href="https://redirect.github.com/authlib/authlib/issues/459">#459</a>](<a href="https://redirect.github.com/authlib/authlib/issues/459">authlib/authlib#459</a>)</li>
</ul>
<h2>Version 1.5.2</h2>
<p>Released on Apr 1, 2025</p>
<ul>
<li>Forbid fragments in redirect_uris. <a href="https://redirect.github.com/authlib/authlib/issues/714">#714</a></li>
<li>Fix invalid characters in error_description. <a href="https://redirect.github.com/authlib/authlib/issues/720">#720</a></li>
<li>Add <code>claims_cls</code> parameter for client's parse_id_token method. <a href="https://redirect.github.com/authlib/authlib/issues/725">#725</a></li>
</ul>
<h2>Version 1.5.1</h2>
<p>Released on Feb 28, 2025</p>
<ul>
<li>Fix RFC9207 iss parameter. <a href="https://redirect.github.com/authlib/authlib/issues/715">#715</a></li>
</ul>
<h2>Version 1.5.0</h2>
<ul>
<li>Fix token introspection auth method for clients. <a href="https://redirect.github.com/lepture/authlib/pull/662">#662</a></li>
<li>Optional typ claim in JWT tokens. <a href="https://redirect.github.com/lepture/authlib/pull/696">#696</a></li>
<li>JWT validation leeway. <a href="https://redirect.github.com/lepture/authlib/pull/689">#689</a></li>
<li>Implement server-side <a href="https://datatracker.ietf.org/doc/html/rfc9207.html">RFC9207</a>. <a href="https://redirect.github.com/lepture/authlib/issues/700">#700</a> <a href="https://redirect.github.com/lepture/authlib/pull/701">#701</a></li>
<li>generate_id_token can take a kid parameter. <a href="https://redirect.github.com/lepture/authlib/pull/702">#702</a></li>
<li>More detailed InvalidClientError. <a href="https://redirect.github.com/lepture/authlib/pull/706">#706</a></li>
<li>OpenID Connect Dynamic Client Registration implementation. <a href="https://redirect.github.com/lepture/authlib/pull/707">#707</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/authlib/authlib/blob/main/docs/changelog.rst">authlib's changelog</a>.</em></p>
<blockquote>
<h2>Version 1.6.1</h2>
<p><strong>Released on Jul 20, 2025</strong></p>
<ul>
<li>Filter key set with additional "alg" and "use" parameters.</li>
</ul>
<h2>Version 1.6.0</h2>
<p><strong>Released on May 22, 2025</strong></p>
<ul>
<li>Fix issue when :rfc:<code>RFC9207 <9207></code> is enabled and the authorization endpoint response is not a redirection. :pr:<code>733</code></li>
<li>Fix missing <code>state</code> parameter in authorization error responses. :issue:<code>525</code></li>
<li>Support for <code>acr</code> and <code>amr</code> claims in <code>id_token</code>. :issue:<code>734</code></li>
<li>Support for the <code>none</code> JWS algorithm.</li>
<li>Fix <code>response_types</code> strict order during dynamic client registration. :issue:<code>760</code></li>
<li>Implement :rfc:<code>RFC9101 The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR) <9101></code>. :issue:<code>723</code></li>
<li>OIDC :class:<code>UserInfo endpoint <authlib.oidc.core.userinfo.UserInfoEndpoint></code> support. :issue:<code>459</code></li>
</ul>
<h2>Version 1.5.2</h2>
<p><strong>Released on Apr 1, 2025</strong></p>
<ul>
<li>Forbid fragments in <code>redirect_uris</code>. :issue:<code>714</code></li>
<li>Fix invalid characters in <code>error_description</code>. :issue:<code>720</code></li>
<li>Add <code>claims_cls</code> parameter for client's <code>parse_id_token</code> method. :issue:<code>725</code></li>
</ul>
<h2>Version 1.5.1</h2>
<p><strong>Released on Feb 28, 2025</strong></p>
<ul>
<li>Fix RFC9207 <code>iss</code> parameter. :pr:<code>715</code></li>
</ul>
<h2>Version 1.5.0</h2>
<p><strong>Released on Feb 25, 2025</strong></p>
<ul>
<li>Fix token introspection auth method for clients. :pr:<code>662</code></li>
<li>Optional <code>typ</code> claim in JWT tokens. :pr:<code>696</code></li>
<li>JWT validation leeway. :pr:<code>689</code></li>
<li>Implement server-side :rfc:<code>RFC9207 <9207></code>. :issue:<code>700</code> :pr:<code>701</code></li>
<li><code>generate_id_token</code> can take a <code>kid</code> parameter. :pr:<code>702</code></li>
<li>More detailed <code>InvalidClientError</code>. :pr:<code>706</code></li>
<li>OpenID Connect Dynamic Client Registration implementation. :pr:<code>707</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/authlib/authlib/commit/ef3d5733198570b8cff7a0b4f41988cfe9cf2b69"><code>ef3d573</code></a> chore: release 1.6.1</li>
<li><a href="https://github.com/authlib/authlib/commit/9366b4e6d5e26b798fa4d7daa17c02b67a7677c6"><code>9366b4e</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/782">#782</a> from authlib/fix-771</li>
<li><a href="https://github.com/authlib/authlib/commit/b57ccce2cf34fa245e7f44828f5ea90823e2909b"><code>b57ccce</code></a> test: add tests for KeySet.find_by_kid</li>
<li><a href="https://github.com/authlib/authlib/commit/386c7644c0242eceb4417bbabed8b43df5e5b9ef"><code>386c764</code></a> fix: find a key from key set with use and alg parameters</li>
<li><a href="https://github.com/authlib/authlib/commit/772a7149adc6192ae3d3e7d0f3a02d6edaf385a8"><code>772a714</code></a> chore: update setup-uv GHA</li>
<li><a href="https://github.com/authlib/authlib/commit/17f72f9fb12be96660b3284bd6fb9cb77adbd3a8"><code>17f72f9</code></a> chore: build the documentation in the CI</li>
<li><a href="https://github.com/authlib/authlib/commit/b55a0991c407a3190402ed3c8f131829b1fdaec3"><code>b55a099</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/776">#776</a> from azmeuk/475-license</li>
<li><a href="https://github.com/authlib/authlib/commit/e47a3788badb8676603b55481b80171bb85c379a"><code>e47a378</code></a> doc: make clear that any project can use the BSD license</li>
<li><a href="https://github.com/authlib/authlib/commit/03420a1fcd24ab89016e0ad2853311560f9661dd"><code>03420a1</code></a> docs: update license docs</li>
<li><a href="https://github.com/authlib/authlib/commit/9e91aaf30717751351d6404b9e670a0d167f2e62"><code>9e91aaf</code></a> chore: update readme about license issue, <a href="https://redirect.github.com/authlib/authlib/issues/475">#475</a></li>
<li>Additional commits viewable in <a href="https://github.com/authlib/authlib/compare/v1.4.1...v1.6.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/16197
Author: @dependabot[bot]
Created: 8/1/2025
Status: ✅ Merged
Merged: 8/2/2025
Merged by: @tjbck
Base:
dev← Head:dependabot/pip/backend/dev/authlib-1.6.1📝 Commits (1)
293cdb8chore(deps): bump authlib from 1.4.1 to 1.6.1 in /backend📊 Changes
1 file changed (+1 additions, -1 deletions)
View changed files
📝
backend/requirements.txt(+1 -1)📄 Description
Bumps authlib from 1.4.1 to 1.6.1.
Release notes
Sourced from authlib's releases.
Changelog
Sourced from authlib's changelog.
Commits
ef3d573chore: release 1.6.19366b4eMerge pull request #782 from authlib/fix-771b57cccetest: add tests for KeySet.find_by_kid386c764fix: find a key from key set with use and alg parameters772a714chore: update setup-uv GHA17f72f9chore: build the documentation in the CIb55a099Merge pull request #776 from azmeuk/475-licensee47a378doc: make clear that any project can use the BSD license03420a1docs: update license docs9e91aafchore: update readme about license issue, #475Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.