[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
oauthlib (changelog)	4.0.0 → 4.0.1

---

Release Notes

oauthlib/oauthlib (oauthlib)

v4.0.1: 4.0.1

Compare Source

Security

• CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the device_code parameter. A request with a known client_id and a bogus device_code could obtain a bearer token. DeviceCodeGrant.validate_token_request now calls DeviceCodeGrant.validate_device_code(), which rejects missing or unknown device codes (invalid_request / invalid_grant) and delegates the code's authorization status to the new RequestValidator.validate_device_code() hook, per RFC 8628 Section 3.5. (cherry-picked from #​954)

Upgrade note for device flow integrators

Custom RequestValidator implementations using the device flow must now implement validate_device_code(client_id, code, request). Return one of the DeviceCodeGrant.DEVICE_CODE_* statuses for known codes, or None for an unknown code. When returning AUTHORIZED, the validator must also populate request.user and request.scopes from the stored authorization.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.