chore(deps): upgrade oxyjwt to >=0.7.0 and drop pyjwt / cryptography

docs/jwt.md

@@ -38,9 +38,9 @@ The handler is **not** executed when:
 
 ## `decode_jwt_hs` (Python, for tests and HS parity)
 
-The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification in Python tests, use your usual stack (e.g. **PyJWT** + `cryptography` with the same PEM keys).
+The native module exports **`decode_jwt_hs(token, key, algorithm_list)`**, re-exported from the top-level `oxyroute` package. It decodes a token and returns claims, **HMAC (HS\*) only**, for golden tests against the [`oxyjwt`](https://pypi.org/project/oxyjwt) package. For **RSA/EC/Ed** verification and token generation in Python tests, use [`oxyjwt`](https://pypi.org/project/oxyjwt) (`EncodingKey.from_*_pem` / `DecodingKey.from_*_pem`).
 
-**Optional dev dependencies:** `oxyjwt`, `pyjwt`, and `cryptography` are in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
+**Optional dev dependencies:** `oxyjwt` is in `oxyroute[dev]` for tests; production only needs the native extension and your `jwt_secret` / `algorithms` configuration.
 
 ## See also
 

perf-test/bench_scenarios.sh

@@ -45,9 +45,9 @@ _jwt_token() {
   "${PYTHON}" - <<'PY'
 import time
 try:
-    import jwt
+    import oxyjwt as jwt
 except ImportError as e:
-    raise SystemExit("PyJWT required for JWT scenario: uv sync --extra bench") from e
+    raise SystemExit("oxyjwt required for JWT scenario: uv sync --extra bench") from e
 print(jwt.encode(
     {"sub": "bench", "exp": int(time.time()) + 3600},
     "bench-secret-key-do-not-use-in-prod",

pyproject.toml

@@ -37,18 +37,16 @@ dev = [
     "granian>=1.0",
     "pytest>=8",
     "httpx>=0.27",
-    "oxyjwt>=0.2",
+    "oxyjwt>=0.7.0",
     "pydantic>=2",
-    "pyjwt>=2.8",
-    "cryptography>=42",
     "ruff>=0.8",
 ]
 # Hello-world RPS compare vs FastAPI (see perf-test/bench_hello.sh); not required for library use.
 bench = [
     "fastapi>=0.100",
     "granian>=1.0",
     "httpx>=0.27",
-    "pyjwt>=2.8",
+    "oxyjwt>=0.7.0",
 ]
 
 [tool.maturin]

tests/test_jwt_rs256.py

@@ -7,7 +7,7 @@
 from pathlib import Path
 
 import httpx
-import jwt
+import oxyjwt
 import pytest
 from oxyroute import App
 from oxyroute.testing import asgi_test_app
@@ -19,9 +19,10 @@
 
 def test_asgi_jwt_rs256_bearer() -> None:
     now = int(time.time())
-    tok = jwt.encode(
+    signing_key = oxyjwt.EncodingKey.from_rsa_pem(_PRIV)
+    tok = oxyjwt.encode(
         {"sub": "u-rs", "exp": now + 3600},
-        _PRIV,
+        signing_key,
         algorithm="RS256",
     )
     assert isinstance(tok, str)