From 6612d2f66062392dfe87b9428a8c0c062e372e6c Mon Sep 17 00:00:00 2001
From: Yoshihiro OKUMURA <orrisroot@gmail.com>
Date: Wed, 4 Nov 2026 16:35:59 +0900
Subject: [PATCH] build: bump to 1.3.20 and update dependencies

Raise the dependency floors so a new install cannot pick up a PyJWT
release with a known vulnerability.

- Raise the floors for PyJWT, pydantic, pydantic-settings,
  python-dotenv and validators to their current releases.
- Add the 1.3.20 entry to the changelog.
---
 CHANGELOG.md   |  8 ++++++++
 pyproject.toml | 12 ++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 220a981..6540b21 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.3.20] - 2026-11-04
+
+### Changed
+- Raised the minimum versions of `pydantic`, `pydantic-settings`, `python-dotenv`, `PyJWT` and `validators` to their current releases.
+
+### Security
+- Required `PyJWT` 2.15.1 or later; releases before 2.14.0 have a known vulnerability.
+
 ## [1.3.19] - 2026-09-04
 
 ### Fixed
diff --git a/pyproject.toml b/pyproject.toml
index 7305e29..27821bb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ name = "mdrsclient"
 
 [project]
 name = "mdrs-client-python"
-version = "1.3.19"
+version = "1.3.20"
 description = "The mdrs-client-python is python library and a command-line client for up- and downloading files to and from MDRS based repository."
 authors = [
     { name = "Yoshihiro OKUMURA", email = "yoshihiro.okumura@riken.jp" }
@@ -32,11 +32,11 @@ classifiers = [
 dependencies = [
     "requests>=2.34.2",
     "requests-toolbelt>=1.0.0",
-    "python-dotenv>=1.2.3",
-    "pydantic>=2.13.5",
-    "pydantic-settings>=2.15.0",
-    "PyJWT>=2.13.0",
-    "validators>=0.35.0",
+    "python-dotenv>=1.2.4",
+    "pydantic>=2.14.2",
+    "pydantic-settings>=2.16.2",
+    "PyJWT>=2.15.1",
+    "validators>=0.36.0",
 ]
 
 [project.optional-dependencies]