A confirmed fix for a known CVE in the `python-jose` dependency, closing out a flagged item from the security-hardening backlog.
`python-jose` handles JWT signing/verification in the affected services — an unpatched CVE there is a real exposure, not a theoretical one, given how central token handling is to auth.
Confirmed against the affected service's own git history rather than taken on faith — the fix commit is present and deployed.
The remaining items on the security-hardening backlog (rotating the old SSH key still sitting in CI secrets, and a broader hardening pass) are still open.