fix: close HTTPError to prevent ResourceWarning on Python 3.14 (#1133)

veeceey · claude · web-flow · commit 412cb67a9336 · 2026-02-16T14:48:57.000+06:00
* fix: close HTTPError response to prevent ResourceWarning on Python 3.14 On Python 3.14, urllib.error.HTTPError objects that are not explicitly closed produce a ResourceWarning during garbage collection. Since HTTPError is both a URLError subclass and a response-like object (inheriting from tempfile._TemporaryFileWrapper via addinfourl), it must be closed to release the underlying resource. This adds an explicit e.close() call in the except handler of PyJWKClient.fetch_data() when the caught exception is an HTTPError. Fixes #1128 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * fix: use BytesIO for HTTPError fp in test to fix Python 3.9 compatibility On Python 3.9, HTTPError(fp=None).close() triggers a KeyError in tempfile.SpooledTemporaryFile.__getattr__ because the internal 'file' dict key doesn't exist. Using io.BytesIO(b"") as the fp argument provides a valid file-like object that can be closed on all Python versions. Also adds CHANGELOG.rst entry for the HTTPError close fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -11,6 +11,7 @@ Fixed
 ~~~~~
 
 - Annotate PyJWKSet.keys for pyright by @tamird in `#1134 <https://github.com/jpadilla/pyjwt/pull/1134>`__
+- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `#1133 <https://github.com/jpadilla/pyjwt/pull/1133>`__
 
 Added
 ~~~~~
diff --git a/jwt/jwks_client.py b/jwt/jwks_client.py
@@ -5,7 +5,7 @@
 from functools import lru_cache
 from ssl import SSLContext
 from typing import Any
-from urllib.error import URLError
+from urllib.error import HTTPError, URLError
 
 from .api_jwk import PyJWK, PyJWKSet
 from .api_jwt import decode_complete as decode_token
@@ -110,6 +110,8 @@ def fetch_data(self) -> Any:
             ) as response:
                 jwk_set = json.load(response)
         except (URLError, TimeoutError) as e:
+            if isinstance(e, HTTPError):
+                e.close()
             raise PyJWKClientConnectionError(
                 f'Fail to fetch data from the url, err: "{e}"'
             ) from e
diff --git a/tests/test_jwks_client.py b/tests/test_jwks_client.py
@@ -1,9 +1,10 @@
 import contextlib
+import io
 import json
 import ssl
 import time
 from unittest import mock
-from urllib.error import URLError
+from urllib.error import HTTPError, URLError
 
 import pytest
 
@@ -86,6 +87,20 @@ def mocked_timeout():
         yield urlopen_mock
 
 
+@contextlib.contextmanager
+def mocked_http_error_response():
+    with mock.patch("urllib.request.urlopen") as urlopen_mock:
+        http_error = HTTPError(
+            url="https://example.com",
+            code=401,
+            msg="Unauthorized",
+            hdrs=None,
+            fp=io.BytesIO(b""),
+        )
+        urlopen_mock.side_effect = http_error
+        yield urlopen_mock, http_error
+
+
 @crypto_required
 class TestPyJWKClient:
     def test_fetch_data_forwards_headers_to_correct_url(self):
@@ -361,3 +376,13 @@ def test_get_jwt_set_sslcontext_no_ca(self):
             )
             with pytest.raises(PyJWKClientError):
                 jwks_client.get_jwk_set()
+
+    def test_http_error_is_closed_on_connection_failure(self):
+        url = "https://dev-87evx9ru.auth0.com/.well-known/jwks.json"
+        jwks_client = PyJWKClient(url)
+
+        with mocked_http_error_response() as (_, http_error):
+            with pytest.raises(PyJWKClientConnectionError):
+                jwks_client.get_jwk_set()
+
+            assert http_error.closed
