[Dilshad-Tanvi]

A PyJWT instance built with options={"verify_signature": False} stores verify_exp, verify_aud, verify_iss and the other claim checks as False in self.options, but decode_complete() still verifies the signature unless the call itself disables it, so inst.decode(token, key, algorithms=["HS256"], audience="api", issuer="https://idp") (with options=None or options={"verify_signature": True}) checks the signature and then accepts an expired token whose aud and iss do not match. This is the instance-level counterpart of the per-call options case fixed for GHSA-gvp8-978c-rx2q: _merge_options() now rebuilds the claim defaults from the library defaults plus the options the instance was explicitly constructed with whenever the decode verifies the signature, so claim options set explicitly on the instance still apply and signature-disabled decodes behave as before.