chore(deps): bump joserfc from 1.6.5 to 1.6.8 in /python/agents/blog-writer

[dependabot]

Bumps joserfc from 1.6.5 to 1.6.8.

Release notes

Sourced from joserfc's releases.

1.6.8

• Reject empty OctKey.

Full Changelog: authlib/joserfc@1.6.7...1.6.8

1.6.7

   🐞 Bug Fixes

• jws: Validate payload size for b64=false  -  by @​lepture (4d4ea)
• typing: Accept any Collection for algorithms, not just list  -  by @​jonathangreen (102a7)
• typing: Use cast for type hints  -  by @​lepture (75d9f)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.8

Released on May 27, 2026

• Reject empty OctKey.

1.6.7

Released on May 23, 2026

• Update for type hints.

1.6.6

Released on May 18, 2026

• JWS: validate payload size when b64=false.

Commits

• ea1d9e3 chore: release 1.6.8
• 86d0091 Reject empty oct key material and empty HMAC keys at sign/verify entry
• 1e5b94d chore: release 1.6.7
• 75d9f95 fix(typing): use cast for type hints
• 6d24037 Merge pull request #98 from jonathangreen/algorithms-accept-collection
• 102a7a7 fix(typing): accept any Collection for algorithms, not just list
• 8b869e8 chore: release 1.6.6
• 00d599b chore: update actions
• 9186561 Merge pull request #97 from authlib/fix-b64
• 4d4ea2e fix(jws): validate payload size for b64=false
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

📋 Correctness Review Summary

A correctness-focused review of the changes was performed. A severe logic and runtime crash bug was identified in python/agents/financial-advisor/financial_advisor/__init__.py where default credential handling and environment variable initialization can fail.

🔍 Findings

🔴 Critical / High Severity: TypeError and Unhandled DefaultCredentialsError on Startup

• File: python/agents/financial-advisor/financial_advisor/__init__.py
• Issue:
  1. If google.auth.default() returns project_id = None (which occurs if no default project is active in the environment), calling os.environ.setdefault("GOOGLE_CLOUD_PROJECT", project_id) raises TypeError: str expected, not NoneType in Python. Since this logic executes during package import, merely importing the module will crash the application.
  2. If no Google Cloud default credentials can be found in the environment, google.auth.default() raises google.auth.exceptions.DefaultCredentialsError at import time, preventing any basic offline usage or unit testing of the package.
• Suggestion:
  Wrap the default credential lookup in a try-except block, check if project_id is a string before setting os.environ, and handle DefaultCredentialsError gracefully.

import os

import google.auth
from google.auth.exceptions import DefaultCredentialsError

try:
    _, project_id = google.auth.default()
    if project_id:
        os.environ.setdefault("GOOGLE_CLOUD_PROJECT", project_id)
except DefaultCredentialsError:
    pass

os.environ.setdefault("GOOGLE_CLOUD_LOCATION", "global")
os.environ.setdefault("GOOGLE_GENAI_USE_VERTEXAI", "True")

from . import agent

[github-actions]

📋 Security Review Summary

I have conducted a security-focused code review of the changes introduced in this pull request. No security vulnerabilities, hardcoded secrets, injection risks, or unsafe operations were identified.

🔍 Findings

• No security vulnerabilities were found.

[github-actions]

📋 Maintainability Review Summary

I have conducted a comprehensive maintainability review of the changes provided in ref.diff. The review focused on identifying concrete, objective issues such as poor naming, magic numbers, or code duplication. Overall, the modifications are clean and follow established standards, with only minor areas for improvement.

🔍 Findings

• Magic Strings / Hardcoded Values (🟡 Medium):
  In python/agents/financial-advisor/financial_advisor/__init__.py, the environment variables are being set using hardcoded default strings "global" and "True":

  os.environ.setdefault("GOOGLE_CLOUD_LOCATION", "global")
  os.environ.setdefault("GOOGLE_GENAI_USE_VERTEXAI", "True")

  Recommendation: These configuration defaults should be extracted into named constants at the top of the file to improve maintainability and avoid inline magic strings. E.g.:

  GOOGLE_CLOUD_LOCATION_DEFAULT = "global"
  GOOGLE_GENAI_USE_VERTEXAI_DEFAULT = "True"

• Import Ordering Side Effects (🟢 Low):
  In python/agents/financial-advisor/financial_advisor/__init__.py, the import from . import agent is correctly moved after the environment variable configuration block. This is an excellent maintainability improvement, as it prevents potential initialization errors or race conditions where sub-modules are imported before the required environment variables are set.
• No other maintainability issues were identified in the other changed files (agent.py, pyproject.toml, README.md).