fix: migrate deprecated authlib.jose import to joserfc in oauth utils (#27310)

backend/open_webui/utils/oauth.py

@@ -16,7 +16,6 @@ from typing import Literal, Optional
 
 import aiohttp
 from authlib.integrations.starlette_client import OAuth
-from authlib.jose.errors import BadSignatureError
 from authlib.oauth2.rfc6749.errors import OAuth2Error
 from authlib.oidc.core import UserInfo
 from cryptography.fernet import Fernet
@@ -24,6 +23,7 @@ from fastapi import (
     HTTPException,
     status,
 )
+from joserfc.errors import BadSignatureError
 from joserfc.jws import JWSRegistry
 from joserfc.registry import HeaderParameter
 from mcp.shared.auth import (

backend/requirements-min.txt

@@ -14,6 +14,7 @@ bcrypt==5.0.0
 argon2-cffi==25.1.0
 PyJWT[crypto]==2.13.0
 authlib==1.7.2
+joserfc==1.7.4
 
 requests==2.34.2
 aiohttp==3.13.5 # do not update to 3.13.3 - broken

backend/requirements.txt

@@ -11,6 +11,7 @@ bcrypt==5.0.0
 argon2-cffi==25.1.0
 PyJWT[crypto]==2.13.0
 authlib==1.7.2
+joserfc==1.7.4
 
 requests==2.34.2
 aiohttp==3.13.5 # do not update to 3.13.3 - broken

pyproject.toml

@@ -19,6 +19,7 @@ dependencies = [
     "argon2-cffi==25.1.0",
     "PyJWT[crypto]==2.13.0",
     "authlib==1.7.2",
+    "joserfc==1.7.4",
 
     "requests==2.34.2",
     "aiohttp==3.13.5", # do not update to 3.13.3 - broken