feat: migrate to jwtoxide, uptick version

[noahpodgurski]

What's new

• Migrate pyjwt to jwtoxide in _verify_jwt_token. Jwtoxide boosts performance by almost 50%
• Uptick version to 0.8.2, add to changes.txt

[Copilot]

Pull request overview

This PR migrates JWT verification from PyJWT to jwtoxide to improve performance by approximately 50%. The changes include adding jwtoxide as a dependency, updating the JWT token verification logic with a fallback mechanism, and bumping the version to 0.8.2.

• Adds jwtoxide as a new dependency alongside PyJWT
• Implements jwtoxide-based JWT verification with PyJWT fallback
• Updates version to 0.8.2 and documents the migration in CHANGES.txt

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
pyproject.toml	Adds jwtoxide==0.2.0 as a new dependency
fxa/oauth.py	Implements jwtoxide-based JWT verification with PyJWT fallback, updates code formatting
fxa/init.py	Bumps version from 0.8.1 to 0.8.2
CHANGES.txt	Documents the migration to jwtoxide in version 0.8.2

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MagentaManifold]

CI is failing because jwtoxide only supports python 3.9+. I'd say it's unlikely someone is still using 3.8 today, but to ditch this version we will need to update the CI pipeline and maybe bump up the major version since it's technically a breaking change.

Another question is, are you sure jwtoxide is trustworthy? Looks like it's a library with only one star on GitHub maintained by a single person, which hasn't hit its first stable version. This means the package might be abandoned in the future (I can't even tell if it's still maintained right now), and the low popularity means it's less battle-tested in production, so there might be bugs lurking. I suggest against using this package, unless you personally know and trust the maintainer, or if the performance improvement is absolutely necessary for your service (as the saying goes, premature optimization is the root of all evil).

[noahpodgurski]

CI is failing because jwtoxide only supports python 3.9+. I'd say it's unlikely someone is still using 3.8 today, but to ditch this version we will need to update the CI pipeline and maybe bump up the major version since it's technically a breaking change.

Another question is, are you sure jwtoxide is trustworthy? Looks like it's a library with only one star on GitHub maintained by a single person, which hasn't hit its first stable version. This means the package might be abandoned in the future (I can't even tell if it's still maintained right now), and the low popularity means it's less battle-tested in production, so there might be bugs lurking. I suggest against using this package, unless you personally know and trust the maintainer, or if the performance improvement is absolutely necessary for your service (as the saying goes, premature optimization is the root of all evil).

Fair points, I can't speak for the author, but it's been working fine in my testing. I also put it in a try: except block so in case anything fails with it, we rollback to the old way of decoding with pyjwt

[clouserw]

We discussed this in our triage and decided not to land it due to the reasons above and that we'd need some announce time for deprecating Python 3.8. (Which we should probably do at some point!). Noah can implement this on their end for now and we can learn if jwtoxide remains quick/stable/secure before considering adding it here. Thanks again.

[tarekziade]

we'd need some announce time for deprecating Python 3.8.

that seems like an orthogonal issue since it's a drop-in replacement, you could stick with PyJWT on 3.8 and get faster on python 3.9+ for free

[clouserw]

true, that's a good point