fix(deps): pin PyJWT to 2.13.0 for CVE-2026-48526

[Jan-Kazlouski-elastic]

Closes https://github.com/elastic/security/issues/12524

(CVE-2026-48526)

Pins transitive PyJWT (via msal / gidgethub) to 2.13.0 so SBOMs resolve past the algorithm-confusion advisory (public-key JWK accepted as HMAC secret when mixed algorithm families are allowed).

Not affected: connectors never calls jwt.decode / mixed-family verification. gidgethub only jwt.encodes GitHub App JWTs (RS256); msal uses jwt.encode for client assertions. Pin is for SBOM hygiene.

Scanner A/B (CVE-2026-48526)

Tool	Before	After
pip-audit	reported	clear
Trivy	reported	clear
Snyk	reported	clear

Checklists

Pre-Review Checklist

• this PR does NOT contain credentials of any kind, such as API keys or username/passwords (double check config.yml.example)
• this PR has a meaningful title
• this PR links to all relevant github issues that it fixes or partially addresses
• this PR has a thorough description
• Covered the changes with automated tests
• Tested the changes locally
• Added a label for each target release version (example: v7.13.2, v7.14.0, v8.0.0)
• For bugfixes: backport safely to all minor branches still receiving patch releases
• Considered corresponding documentation changes
• Contributed any configuration settings changes to the configuration reference
• if you added or changed Rich Configurable Fields for a Native Connector, you made a corresponding PR in Kibana

Changes Requiring Extra Attention

• Security-related changes (encryption, TLS, SSRF, etc)
• New external service dependencies added.

Release Note

Pin PyJWT to 2.13.0 to address CVE-2026-48526 in dependency scans.

Made with Cursor

[github-actions]

💔 Failed to create backport PR(s)

Status	Branch	Result
✅	9.5	#4194
✅	9.3	#4195
✅	9.4	#4196
❌	8.19	Commit could not be cherrypicked due to conflicts

Successful backport PRs will be merged automatically after passing CI.

To backport manually run:
backport --pr 4183 --autoMerge --autoMergeMethod squash