chore(deps): bump joserfc from 1.6.4 to 1.6.8 in /python/agents/travel-concierge

[dependabot]

Bumps joserfc from 1.6.4 to 1.6.8.

Release notes

Sourced from joserfc's releases.

1.6.8

• Reject empty OctKey.

Full Changelog: authlib/joserfc@1.6.7...1.6.8

1.6.7

   🐞 Bug Fixes

• jws: Validate payload size for b64=false  -  by @​lepture (4d4ea)
• typing: Accept any Collection for algorithms, not just list  -  by @​jonathangreen (102a7)
• typing: Use cast for type hints  -  by @​lepture (75d9f)

    View changes on GitHub

1.6.5

No significant changes

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.8

Released on May 27, 2026

• Reject empty OctKey.

1.6.7

Released on May 23, 2026

• Update for type hints.

1.6.6

Released on May 18, 2026

• JWS: validate payload size when b64=false.

1.6.5

Released on May 3, 2026

• JWS: increase registry's payload max size.

Commits

• ea1d9e3 chore: release 1.6.8
• 86d0091 Reject empty oct key material and empty HMAC keys at sign/verify entry
• 1e5b94d chore: release 1.6.7
• 75d9f95 fix(typing): use cast for type hints
• 6d24037 Merge pull request #98 from jonathangreen/algorithms-accept-collection
• 102a7a7 fix(typing): accept any Collection for algorithms, not just list
• 8b869e8 chore: release 1.6.6
• 00d599b chore: update actions
• 9186561 Merge pull request #97 from authlib/fix-b64
• 4d4ea2e fix(jws): validate payload size for b64=false
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📋 Security Review Summary

The security review of this pull request was completed. The changes consist of a minor dependency bump of joserfc from version 1.6.4 to 1.6.8 in python/agents/travel-concierge/uv.lock. This is a standard package dependency upgrade and does not introduce any security vulnerabilities.

Additionally, a review of ref.diff (which contains migrations to uv, configuration file updates, and Google Cloud project setup via google.auth.default()) was performed, and no security vulnerabilities were identified.

🔍 Findings

• No security vulnerabilities were found.

[github-actions]

📋 Maintainability Review Summary

This pull request makes helpful updates to dependency management (migrating to uv) and documentation. We identified one main maintainability concern regarding import-time side effects in the package initialization.

🔍 Findings

🟡 Medium Severity: Side-effects on Module Import

• File: python/agents/financial-advisor/financial_advisor/__init__.py (Lines 23-26)

• Problem:
  Importing financial_advisor initiates Google Cloud credentials resolution and modifies os.environ environment variables as side-effects. This can make testing, mocking, or importing the package in environments without GCP credentials difficult (e.g., throwing DefaultCredentialsError or altering environment state for unrelated tests).

  Additionally, direct assignment os.environ["GOOGLE_CLOUD_LOCATION"] = "global" on line 25 will forcefully overwrite any existing location environment variables configured by the user or system, breaking configuration flexibility.

• Recommendation:
  Consider moving environment initialization logic inside a config/setup function or initializing them lazily when the agent is first instantiated.

[github-actions]

📋 Correctness Review Summary

During the correctness review of the proposed changes, two critical correctness bugs and potential runtime failures were identified in the package initialization file (python/agents/financial-advisor/financial_advisor/__init__.py). These issues relate to unchecked Google Application Default Credentials loading at import-time and dangerous environment variable assignment with None values, both of which will crash any environment importing this package.

🔍 Findings

🔴 Unhandled Exception & Import-Time Crash

In python/agents/financial-advisor/financial_advisor/__init__.py on line 21:
_, project_id = google.auth.default()

• Issue: Calling google.auth.default() searches for Google Application Default Credentials (ADC). If no default credentials can be located (e.g. during local offline development, unit tests, or environments where credentials are not pre-configured), it raises a google.auth.exceptions.DefaultCredentialsError. Executing this at the module/package import level will crash the entire application upon any simple import financial_advisor statement, making the package completely unusable without authentication pre-setup.
• Severity: 🔴 critical

🔴 TypeError / Runtime Failure

In python/agents/financial-advisor/financial_advisor/__init__.py on line 22:
os.environ.setdefault("GOOGLE_CLOUD_PROJECT", project_id)

• Issue: google.auth.default() can return None as the project_id if there is no default project associated with the credentials or environment. If project_id is None, calling os.environ.setdefault("GOOGLE_CLOUD_PROJECT", project_id) will crash with:
  TypeError: str(), bytes() or os.PathLike object expected, not NoneType
  Since this happens immediately during import, it represents a guaranteed crash in environments without a default project configured.
• Severity: 🔴 critical

---

Suggested Fix:

To make the import robust, we should wrap the credential loading in a try-except block, check that project_id is a valid string before setting the environment variable, and use setdefault for the location environment variable to respect user configurations:

try:
    _, project_id = google.auth.default()
    if project_id:
        os.environ.setdefault("GOOGLE_CLOUD_PROJECT", project_id)
except Exception:
    pass

os.environ.setdefault("GOOGLE_CLOUD_LOCATION", "global")
os.environ.setdefault("GOOGLE_GENAI_USE_VERTEXAI", "True")