formachines / errata

Errata / PyPI / oauthlib

RevocationEndpoint removed in oauthlib 4.0.0

In our sandbox runs up to 2026-10-27, gemini-3.8-flash and gpt-6.1-sol wrote enable_jsonp=True, for oauthlib. It fails on 4.0.0 with TypeError (changed between 3.3.1 and 4.0.0). There is no direct replacement in the new version.

What to do
no direct replacement
Output
no replacement — not comparable
Patch
nothing to apply word for word
Auto-apply
not allowed
Seen in
2 models
Worked / failed
4 / 0
Last verified
2026-10-27

What to do

Not for automatic application — format removed: there is no replacement to apply. Show this correction to the user as a lead. enable_jsonp is not available in oauthlib 4.0.0; remove or replace this use. The same code works on oauthlib 3.3.1: pin a version before 4.0.0 if you cannot change the code. Release notes: endpoint = RevocationEndpoint(validator)

Automatic application: not allowed — the fix's output was not compared; the patch gives not_applicable when applied word for word. Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own. The change itself is described by kind (removed); the checks are in proof; neither follows from the other.

How to tell this applies to your code

Old code

enable_jsonp=True,

No direct replacement: the verified example below shows code that works without it.

Error on 4.0.0:

TypeError: RevocationEndpoint.__init__() got an unexpected keyword argument 'enable_jsonp'

Other verified fixes

The fix above passed 1 time. These also passed in the sandbox for the same error; pick the one that matches what your code needs.

Replace the line · passed 3 times · gemini-3.8-flash, gpt-6.1-sol · patch: applies word for word

endpoint = RevocationEndpoint(validator, enable_jsonp=True)
endpoint = RevocationEndpoint(validator)

Not for automatic application — the fix's output differs from the original's. Show this correction to the user as a lead. Review before applying: this fix runs on oauthlib 4.0.0, but its printed output differs from what the original printed on 3.3.1 (observed stdout of one example) — it may do different work. Replace the old line with the new one; the rest of the code can stay.

Alternatives are leads for the user, not for automatic application: Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own.

Sandbox proof
Scriptoauthlib versionResult
Code the models wrote3.3.1works
Code the models wrote4.0.0fails: TypeError
Verified example below4.0.0works
Output of the verified example4.0.0not compared: the API was removed without a replacement, the fix drops that work
Patch applied word for word to the example4.0.0no literal patch to apply (removed or added code, or the old line is not found once) — format removed: there is no replacement to apply

Verified example for oauthlib 4.0.0

from types import SimpleNamespace
from urllib.parse import urlencode
from hmac import compare_digest

from oauthlib.oauth2 import RequestValidator, RevocationEndpoint


class InMemoryValidator(RequestValidator):
    CLIENT_ID = "demo-client"
    CLIENT_SECRET = "demo-secret"

    def __init__(self):
        self.revoked_tokens = set()

    def client_authentication_required(self, request, *args, **kwargs):
        return True

    def authenticate_client(self, request, *args, **kwargs):
        valid = (
            compare_digest(request.client_id or "", self.CLIENT_ID)
            and compare_digest(request.client_secret or "", self.CLIENT_SECRET)
        )
        if valid:
            request.client = SimpleNamespace(client_id=self.CLIENT_ID)
        return valid

    def revoke_token(self, token, token_type_hint, request, *args, **kwargs):
        # Accept any token, including tokens not previously seen.
        self.revoked_tokens.add(token)


def main():
    validator = InMemoryValidator()
    endpoint = RevocationEndpoint(
        validator,
        supported_token_types=["access_token", "refresh_token"],
    )

    body = urlencode({
        "client_id": validator.CLIENT_ID,
        "client_secret": validator.CLIENT_SECRET,
        "token": "arbitrary-demo-token",
        "token_type_hint": "access_token",
        "callback": "handleRevoke",
    })

    headers, response_body, status_code = endpoint.create_revocation_response(
        "https://example.invalid/oauth/revoke",
        http_method="POST",
        body=body,
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )

    print("Status code:", status_code)
    print("Headers:", headers)
    print("Body:", response_body)


if __name__ == "__main__":
    main()

Source

Removed JSONP support from token revocation endpoint (#951)

Release notes · Seen in: gemini-3.8-flash, gpt-6.1-sol · First seen 2026-10-20 · Last verified 2026-10-27 · All corrections for oauthlib

For agents