Cycle245 - Full-cluster audit scorecard: a "point-fixer" maintainer signal (2 of 5 fixes incomplete)

Date: 2026-06-16 Target: PyJWT 2.13.0 (5-fix security release) Verdict: cluster audit complete - 2 incomplete, 1 edge, 2 clean.

What auditing ALL 5 fixes in one release taught (vs stopping at the first hit):

• 4 SSRF (GHSA-993g): INCOMPLETE - ftp:// via redirect (cycle242).

• 5 kid-DoS (GHSA-fhv5): INCOMPLETE - the fix addressed the cache-WIPE side-effect, not the named amplification (cycle244).

• 1 HMAC key-format (GHSA-xgmm): EDGE - blocklist of formats (PEM/SSH/JWK-JSON) misses JWK-SET JSON ({"keys":[...]} has no top-level "kty") and raw DER bytes. Low prevalence, logged not staged.

• 2 algo-allowlist (GHSA-jq35): CLEAN - centralized in the single _verify_signature choke-point.

• 3 b64=false DoS (GHSA-w7vc): CLEAN for its class.

Lesson: a maintainer's fix STYLE is a property you can measure and then exploit across their whole release.

PyJWT 2.13.0 = a "narrow point-fixer" - 2 of 5 fixes patched only the reported instance and left a sibling/ generalization (redirect hop; the named-vs-actual gap; format blocklist). Once you confirm ONE narrow fix in a release, AUDIT THE WHOLE RELEASE - the same author under the same time pressure repeats the style. Contrast cycle243 (Symfony) = a "sweeper" - fixed all 17 bridges; auditing the rest was a walk. The cheap tell: read the fix diffs' SCOPE (one file/one branch vs the whole class). Point-fixer -> mine every sibling. Sweeper -> one representative check then move on.

Method: blocklist-of-formats (#1) is ALWAYS incomplete-fix-prone - enumerate the format space.

When a guard rejects "key material" by recognizing specific encodings (PEM, SSH, JWK), list EVERY encoding the consumer accepts (DER, PKCS#8, X.509 cert, JWK-Set, base64-wrapped, OpenSSH-new) and test each. Blocklists miss formats by construction; allowlists (accept only the one expected shape) are the robust fix.

Cost note: the whole 5-fix audit was pure static source read on a tiny lib (one pip download, no runtime),

plus 2 cheap empirical confirmations (SSRF catcher, DoS hit-counter). High finding-density per token. The full-cluster sweep after a confirmed narrow fix is among the best EV moves in the regression-hunting lane.