On September 28, 2026, PyJWT 2.14.0 shipped with fixes for several signature verification bypasses, including CVE-2026-102272, where a public JWK with a UTF-8 byte-order mark could be treated as an HMAC secret. That release is the test of any dependency update policy: your tooling should hold back routine bumps for a few days and still put this one in front of a human at once.
Dependabot supports both halves of that. Here is how to configure it, from GitHub's options reference.
What's affected
PyJWT 2.13.0 up to, but not including, 2.14.0 is affected in a mixed-algorithm verification path. Any project pinned there needs the update. The policy question is how it reaches you.
Dependabot has two update kinds with different rules:
- Version updates follow your
dependabot.ymlschedule. They are where cooldown and most grouping apply. - Security updates open when an advisory matches a dependency. GitHub's docs state that
cooldownis only for version updates, so a vulnerability fix is not delayed by it.
How to check if you're exposed
pip show pyjwt | grep -i '^version'
grep -rn "pyjwt" requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null
Then check your policy file: cat .github/dependabot.yml. If it has no cooldown block, GitHub's reference says a default 3 day cooldown applies to version updates.
What to do now
- Upgrade PyJWT to 2.14.0 or later where you use it.
- Set an explicit cooldown, longer for major versions than patches.
- Group routine updates so a weekly run opens a few pull requests, not forty.
- Keep security updates in their own group, and keep them out of the cooldown.
- Exempt packages you control or must track closely, with
exclude.
A policy that does this:
version: 2
updates:
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 5
semver-major-days: 30
semver-minor-days: 14
semver-patch-days: 3
exclude:
- "our-internal-*"
groups:
routine:
applies-to: version-updates
patterns:
- "*"
update-types:
- "minor"
- "patch"
security:
applies-to: security-updates
patterns:
- "*"
Per the reference, exclude wins over include, an update type without its own day count falls back to default-days, and a dependency that matches several groups lands in the first one. Major updates stay as individual pull requests here because they are not in the routine group, which keeps breaking changes reviewable.
How this could have been avoided
A cooldown is a control against a different failure: a compromised or broken release that is yanked within days. It would not have helped with PyJWT, where the new release is the fix. The risk to avoid is a policy that blurs the two.
- Separate the paths. Version updates wait. Security updates do not.
- Alert on the advisory, not on the release. A matching advisory should page a person.
- Review the group, not each line. Grouped minor and patch updates still run CI on the combined change.
- Pin by lockfile and hash, so a cooldown on new versions is not undone by a floating range at install time.
Why it matters
Update policy is where supply chain caution and patch speed pull against each other. Delay raises your odds of skipping a bad release, and the same delay raises your exposure to a real vulnerability if it applies to fixes.
The configuration above resolves it by kind rather than by compromise: routine work waits and batches, and advisory work goes through immediately. Write that rule down in the repository, next to the YAML, so the next person who edits it knows why.
Try it yourself
Take one repository, add the cooldown and groups blocks, and let one weekly run complete. Count the pull requests before and after. Then look for a pending security update and confirm it is not grouped with, or held by, the routine rules.
Click through it at your own pace, or open it full screen.
Quick check
Does a Dependabot cooldown delay security updates?
No. GitHub's documentation says the cooldown option applies only to version updates, not security updates.
What happens if you configure no cooldown at all?
GitHub's reference says Dependabot applies a 3 day cooldown to version updates by default.
