updates:
- [github.com/asottile/pyupgrade: v3.20.0 → v3.21.2](asottile/pyupgrade@v3.20.0...v3.21.2)
- [github.com/psf/black-pre-commit-mirror: 25.9.0 → 26.1.0](psf/black-pre-commit-mirror@25.9.0...26.1.0)
- [github.com/PyCQA/isort: 6.1.0 → 7.0.0](PyCQA/isort@6.1.0...7.0.0)
- [github.com/mgedmin/check-manifest: 0.50 → 0.51](mgedmin/check-manifest@0.50...0.51)
- [github.com/abravalheri/validate-pyproject: v0.24.1 → v0.25](abravalheri/validate-pyproject@v0.24.1...v0.25)
- [github.com/python-jsonschema/check-jsonschema: 0.34.0 → 0.36.1](python-jsonschema/check-jsonschema@0.34.0...0.36.1)
- [github.com/regebro/pyroma: 5.0 → 5.0.1](regebro/pyroma@5.0...5.0.1)
- [github.com/astral-sh/ruff-pre-commit: v0.13.3 → v0.14.14](astral-sh/ruff-pre-commit@v0.13.3...v0.14.14)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: José Padilla <jpadilla@webapplicate.com>

* fix: close HTTPError response to prevent ResourceWarning on Python 3.14

On Python 3.14, urllib.error.HTTPError objects that are not explicitly
closed produce a ResourceWarning during garbage collection. Since
HTTPError is both a URLError subclass and a response-like object
(inheriting from tempfile._TemporaryFileWrapper via addinfourl), it
must be closed to release the underlying resource.

This adds an explicit e.close() call in the except handler of
PyJWKClient.fetch_data() when the caught exception is an HTTPError.

Fixes #1128

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* fix: use BytesIO for HTTPError fp in test to fix Python 3.9 compatibility

On Python 3.9, HTTPError(fp=None).close() triggers a KeyError in
tempfile.SpooledTemporaryFile.__getattr__ because the internal 'file'
dict key doesn't exist. Using io.BytesIO(b"") as the fp argument
provides a valid file-like object that can be closed on all Python
versions.

Also adds CHANGELOG.rst entry for the HTTPError close fix.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* chore: remove superfluous constants

This Py >= 3.10 TODO is doable even on 3.9, so do it.

* chore: tighten no-crypto mypy typing

Scope mypy missing-import suppression to cryptography only, and make
no-crypto key aliases explicit with Never.

updates:
- [github.com/python-jsonschema/check-jsonschema: 0.36.1 → 0.36.2](python-jsonschema/check-jsonschema@0.36.1...0.36.2)
- [github.com/astral-sh/ruff-pre-commit: v0.14.14 → v0.15.1](astral-sh/ruff-pre-commit@v0.14.14...v0.15.1)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

* chore(tests): enable mypy

Add suppressions for all current errors; these will be fixed in
subsequent commits.

* chore(tests): enable `no-untyped-{def,call}`

* chore(tests): enable `unused-ignore`

* chore(tests): enable `arg-type`

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7 to 8.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

updates:
- [github.com/astral-sh/ruff-pre-commit: v0.15.1 → v0.15.2](astral-sh/ruff-pre-commit@v0.15.1...v0.15.2)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

updates:
- [github.com/python-jsonschema/check-jsonschema: 0.36.2 → 0.37.0](python-jsonschema/check-jsonschema@0.36.2...0.37.0)
- [github.com/astral-sh/ruff-pre-commit: v0.15.2 → v0.15.4](astral-sh/ruff-pre-commit@v0.15.2...v0.15.4)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

* fix: do not store reference to algorithms dict on PyJWK

* Update CHANGELOG.rst

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Asif Saif Uddin {"Auvi":"অভি"} <auvipy@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-authored-by: José Padilla <jpadilla@users.noreply.github.com>

* fix: use PyJWK key algorithm when encoding without explicit algorithm (#1147)

When a PyJWK object is passed to jwt.encode() without specifying an
algorithm, the key's embedded algorithm is now used instead of
defaulting to HS256. This is achieved by using a sentinel default value
so the code can distinguish "no algorithm specified" from an explicit
algorithm parameter.

https://claude.ai/code/session_016Ekc2jQzpuiDpBvnMAMnUB

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

* update changelog

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: José Padilla <jpadilla@users.noreply.github.com>