[rpms/fence-agents] eln: - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526

[rpms/fence-agents] eln: - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526

[Oyvind Albrigtsen]

          A new commit has been pushed.

          Repo   : rpms/fence-agents
          Branch : eln
          Commit : c2db37bea7c75c6f562b39987d4dffea1ebd07e8
          Author : Oyvind Albrigtsen <oalbrigt@redhat.com>
          Date   : 2026-06-21T19:20:38-04:00
          Stats  : +11/-7 in 2 file(s)
          URL    : https://src.fedoraproject.org/rpms/fence-agents/c/c2db37bea7c75c6f562b39987d4dffea1ebd07e8?branch=eln

          Log:
          - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526
Resolves: RHEL-182312

---
diff --git a/fence-agents.spec b/fence-agents.spec
index 352cc00..8d0688e 100644
--- a/fence-agents.spec
+++ b/fence-agents.spec
@@ -13,7 +13,7 @@
 Name: fence-agents
 Summary: Set of unified programs capable of host isolation ("fencing")
 Version: 4.16.0
-Release: 26%{?alphatag:.%{alphatag}}%{?dist}
+Release: 27%{?alphatag:.%{alphatag}}%{?dist}
 License: GPL-2.0-or-later AND LGPL-2.0-or-later
 URL: https://github.com/ClusterLabs/fence-agents
 Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@@ -54,7 +54,7 @@ Source1302: azure_mgmt_core-1.6.0.tar.gz
 Source1303: azure_mgmt_compute-35.0.0.tar.gz
 Source1304: azure_mgmt_network-29.0.0.tar.gz
 Source1305: azure_identity-1.24.0.tar.gz
-Source1306: msal-1.33.0.tar.gz
+Source1306: msal-1.37.0.tar.gz
 Source1307: msal_extensions-1.3.1.tar.gz
 Source1308: msrest-0.7.1.zip
 Source1309: msrestazure-0.6.4.post1.tar.gz
@@ -62,7 +62,7 @@ Source1310: adal-1.2.7.tar.gz
 Source1311: certifi-2025.8.3.tar.gz
 Source1312: isodate-0.6.1.tar.gz
 Source1313: portalocker-2.10.1.tar.gz
-Source1314: pyjwt-2.12.1.tar.gz
+Source1314: pyjwt-2.13.0.tar.gz
 ## azure buildreq
 Source1315: setuptools-82.0.1.tar.gz
 # google
@@ -441,7 +441,7 @@ Provides: bundled(python3-azure-mgmt-core) = 1.6.0
 Provides: bundled(python3-azure-mgmt-compute) = 35.0.0
 Provides: bundled(python3-azure-mgmt-network) = 29.0.0
 Provides: bundled(python3-azure-identity) = 1.24.0
-Provides: bundled(python3-msal) = 1.33.0
+Provides: bundled(python3-msal) = 1.37.0
 Provides: bundled(python3-msal-extensions) = 1.3.1
 Provides: bundled(python3-msrest) = 0.7.1
 Provides: bundled(python3-msrestazure) = 0.6.4.post1
@@ -449,7 +449,7 @@ Provides: bundled(python3-adal) = 1.2.7
 Provides: bundled(python3-certifi) = 2025.8.3
 Provides: bundled(python3-isodate) = 0.6.1
 Provides: bundled(python3-portalocker) = 2.10.1
-Provides: bundled(python3-PyJWT) = 2.12.1
+Provides: bundled(python3-PyJWT) = 2.13.0
 # google
 Provides: bundled(python3-google-api-python-client) = 1.12.8
 Provides: bundled(python3-chardet) = 3.0.4
@@ -1226,6 +1226,10 @@ are located on corosync cluster nodes.
 %endif
 
 %changelog
+* Mon Jun  8 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.16.0-27
+- bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526
+  Resolves: RHEL-182312
+
 * Thu May 21 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.16.0-26
 - fence_kubevirt: report Succeeded and Failed as OFF
   Resolves: RHEL-81658

diff --git a/sources b/sources
index f2bdd6c..06b5cb0 100644
--- a/sources
+++ b/sources
@@ -21,7 +21,7 @@ SHA512 (azure_mgmt_core-1.6.0.tar.gz) = 760a4ec84f561da44bb9f088e2dde80f69552526
 SHA512 (azure_mgmt_compute-35.0.0.tar.gz) = 7e70437590f823f4b874d61596992210e6981d61acc9928f885a47e5775fd2ebd6886c80ee6e964b691dfb1b58c92fc4b4424d7fe2c27d3aef95dd146d2d5ef8
 SHA512 (azure_mgmt_network-29.0.0.tar.gz) = 9790af57b37816a99a36aac283b0033649589a0bcb90e50b616d347fdc48995a27fbb21c3612177605a80d6453d32945fc262c8024cc88a966b4742e9eea4809
 SHA512 (azure_identity-1.24.0.tar.gz) = 3ee92026fb03d6b507a9c77ed2d556b2e814ea516068bd548ce3f71c31bb5abbb54f0cba9d5db84fe2b1dce5415e71998e7efdc8609d962c0c86a7dcf1a178d4
-SHA512 (msal-1.33.0.tar.gz) = 4372cbabcd0cf1e67c5f218067fdc9fd0eef36e73e3a5455fa6a84daea4a7d26d50df0b914347796484b92b16b707aede85bf4c99769be9e2c1386cf27b910c8
+SHA512 (msal-1.37.0.tar.gz) = 49778ca29b5f43304994a2dd13da399154efd3277df0acd6c7e589dc59b6cec1ff06284530a40efcfc8d468c53c1771bb03c42aebac8d6aaaf7ede8ec3af83a4
 SHA512 (msal_extensions-1.3.1.tar.gz) = ea0409a7ff3e3a885203b35efbbdd674a08baadfdf2f80e96d849a4949197ef9702a6f051595c1346eab5c8f178254b79fe60180e17888fbc8bb73e8d4c93589
 SHA512 (msrest-0.7.1.zip) = 430e982adf89c79356e59182587c62ecb935e983f2e339738b54c48d0cd3cfa66ab48aad52d342b3efe5938d5e02693f24d603a4d637e3e5818bac6d03cc19db
 SHA512 (msrestazure-0.6.4.post1.tar.gz) = 8fc4eba2520cecae612e9f1ab279662a1b531c73da3ee9af5abf59bc478b4edbf7ce0ea17d4491ff498d17269c31a82a9327eea4d1f1c704a4a7f434ef284acb
@@ -29,7 +29,7 @@ SHA512 (adal-1.2.7.tar.gz) = b46dd3ebb72123e9c2d2eb75eae17b1175f09908b4443013125
 SHA512 (certifi-2025.8.3.tar.gz) = 9df35fc7e82ce1e0622d26bfc780d86a429b3224df49191863706ee3f0a73df18f810ce573ffbd4ca44889fd7e7f3440618793ea259875ffca5021120aa16ab6
 SHA512 (isodate-0.6.1.tar.gz) = 437e420ec7ee68dedded825f30d3289eeb0da526208443e5a8e50fe70f12309515e1285b21132d26e6d4c1683f90dfa1d401582042b5e4381fe7ab0e34af26b6
 SHA512 (portalocker-2.10.1.tar.gz) = 417d2b59c3cde6968b583d3e86153b85048354c9eb02fbd329a4d79b17abb47f3a07fe88af6b290d50111bb8534c8b2997633a93914e602c9312d4395af7407c
-SHA512 (pyjwt-2.12.1.tar.gz) = ad1e925b9aa39017bd83863233b39de06a919daed664d5835e58def47f6fb4435fab057a37a5fa8a7543f691f5fc9f82e6d879ef0ad60960f982a214b305078a
+SHA512 (pyjwt-2.13.0.tar.gz) = e12fcc5171e48ef74f4384287c05d94367b7add4844066b650abd6c82534e557959f59ffce9bd6d4dc6970b99b7357be5bb652d0546937b3a64dfd329b63b561
 SHA512 (setuptools-82.0.1.tar.gz) = 5d70e9efd818245fb8119a4eed64d776078469ed884facc188f141ea491efd9fde5c10c928d3236ea5e2e431b16616f18ed14870b867f95e6320251707332395
 SHA512 (google-api-python-client-1.12.8.tar.gz) = e6aafb165d12c0f38b26326320f6f4dfebd4eef8401cda0a915fbf04bfff91e39cc4572979324808a71b863711b4fab2a9b397da9f933fb12867e8453e17354f
 SHA512 (chardet-3.0.4.tar.gz) = 61a03b23447a2bfe52ceed4dd1b9afdb5784da1933a623776883ee9f297e341f633e27f0ce0230bd5fdc5fdb5382105ab42736a74a417ddeb9f83af57455dba5