From 9554f6170791c70433f9973b1838737de8d76d87 Mon Sep 17 00:00:00 2001
From: nerdytyphanie <nerdytyphanie@icloud.com>
Date: Fri, 21 Aug 2026 02:31:21 -0500
Subject: [PATCH] Reject max age for untimed serializers

---
 src/itsdangerous/serializer.py             | 4 +---
 tests/test_itsdangerous/test_serializer.py | 7 +++++++
 tests/test_itsdangerous/test_url_safe.py   | 7 +++++++
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/itsdangerous/serializer.py b/src/itsdangerous/serializer.py
index 5ed949ca..c083fb31 100644
--- a/src/itsdangerous/serializer.py
+++ b/src/itsdangerous/serializer.py
@@ -325,9 +325,7 @@ def dump(self, obj: t.Any, f: t.IO[t.Any], salt: str | bytes | None = None) -> N
         """
         f.write(self.dumps(obj, salt))
 
-    def loads(
-        self, s: str | bytes, salt: str | bytes | None = None, **kwargs: t.Any
-    ) -> t.Any:
+    def loads(self, s: str | bytes, salt: str | bytes | None = None) -> t.Any:
         """Reverse of :meth:`dumps`. Raises :exc:`.BadSignature` if the
         signature validation fails.
         """
diff --git a/tests/test_itsdangerous/test_serializer.py b/tests/test_itsdangerous/test_serializer.py
index 737b5046..0426843a 100644
--- a/tests/test_itsdangerous/test_serializer.py
+++ b/tests/test_itsdangerous/test_serializer.py
@@ -51,6 +51,13 @@ def value(self):
     def test_serializer(self, serializer: Serializer, value: Any):
         assert serializer.loads(serializer.dumps(value)) == value
 
+    def test_loads_rejects_max_age(self):
+        serializer = Serializer("secret_key")
+        signed = serializer.dumps("value")
+
+        with pytest.raises(TypeError):
+            serializer.loads(signed, max_age=-1)  # type: ignore[call-arg]
+
     @pytest.mark.parametrize(
         "transform",
         (
diff --git a/tests/test_itsdangerous/test_url_safe.py b/tests/test_itsdangerous/test_url_safe.py
index 37e48123..ec5f5461 100644
--- a/tests/test_itsdangerous/test_url_safe.py
+++ b/tests/test_itsdangerous/test_url_safe.py
@@ -17,6 +17,13 @@ def serializer_factory(self):
     def value(self, request):
         return request.param
 
+    def test_loads_rejects_max_age(self):
+        serializer = URLSafeSerializer("secret-key")
+        signed = serializer.dumps("value")
+
+        with pytest.raises(TypeError):
+            serializer.loads(signed, max_age=-1)  # type: ignore[call-arg]
+
 
 class TestURLSafeTimedSerializer(TestURLSafeSerializer, TestTimedSerializer):
     @pytest.fixture()