From 898d9f83b9ae13453f903f59f95719608771aaac Mon Sep 17 00:00:00 2001
From: Friedrich <jens.wilken@sap.com>
Date: Thu, 1 Oct 2026 17:08:46 +0200
Subject: [PATCH] deps: pin oauthlib>=4.0.0 (CVE-2026-49264, CVE-2026-49265)

---
 requirements.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/requirements.txt b/requirements.txt
index b30649eed7..da3030f2d4 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,6 +6,7 @@ PyYAML>=6.0.3  # MIT
 websocket-client>=0.32.0,!=0.40.0,!=0.41.*,!=0.42.* # LGPLv2+
 requests # Apache-2.0
 requests-oauthlib # ISC
+oauthlib>=4.0.0 # ISC -- CVE-2026-49264, CVE-2026-49265; remove once requests-oauthlib bumps its own lower bound
 typing-extensions>=4.16.0  # PSF
 urllib3>=2.8.0,<3.0.0 # MIT
 durationpy>=0.11 # MIT