Impact Score: 5/10
Saleor 3.21.59 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: saleor · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Saleor 3.21.59. Source highlight: Upgraded pyjwt to v2.13.0 by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19235 - fixes:
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (2)
- Upgraded pyjwt to v2.13.0 by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19235 - fixes:
- Upgraded idna to v3.15 to fix CVE-2026-45409 - specially crafted inputs to idna.encode() can lead to DoS -
📄 View Raw Release Notes (Original Developer Log)
## What's Changed
- Upgraded pyjwt to v2.13.0 by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19235 - fixes:
- GHSA-xgmm-8j9v-c9wx: JWK JSON accepted as HMAC secret (algorithm confusion)
- GHSA-jq35-7prp-9v3f: Algorithm allow-list bypass with PyJWK / PyJWKClient
- GHSA-w7vc-732c-9m39: DoS via base64 decode of unused payload segment when b64=false
- GHSA-993g-76c3-p5m4: PyJWKClient accepts non-HTTP(S) URIs
- GHSA-fhv5-28vv-h8m8: PyJWKClient cache wiped on fetch error
- Upgraded idna to v3.15 to fix CVE-2026-45409 - specially crafted inputs to idna.encode() can lead to DoS - by @NyanKiyoshi in https://github.com/saleor/saleor/pull/19235
**Full Changelog**: https://github.com/saleor/saleor/compare/3.21.58...3.21.59