molo/backend
Watch
1
Fork
You've already forked backend
 0
Code Issues 1 Pull requests Packages 2 Activity Actions

fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4 #18

Closed
renovate-bot wants to merge 1 commit from renovate/github.com-lestrrat-go-jwx-v3-4.x into master
pull from: renovate/github.com-lestrrat-go-jwx-v3-4.x
merge into: molo:master
Conversation 2 Commits 1 Files changed 2 +3 -1
renovate-bot commented 2026-10-25 11:01:49 +01:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
github.com/lestrrat-go/jwx/v3 v3.4.0 → v4.6.0 age confidence

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.6.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

New Contributors

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.5.0...v4.6.0

v4.5.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0

v4.4.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0

v4.3.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

New Contributors

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION.md

v4.0.0 - 19 Apr 2026

  • Initial v4 release. Major features:
    • Lighter: Core / Companion module separation. Less dependencies in core.
    • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
    • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
  • See Changes-v4.md for a full set of Changes since v3.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

  • Branch creation
    • Between 09:00 AM and 10:59 PM (* 9-22 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `v3.4.0` → `v4.6.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv3/v4.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv3/v3.4.0/v4.6.0?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)</summary> ### [`v4.6.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.6.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.5.0...v4.6.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.6.0/Changes). #### What's Changed - build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2354](https://github.com/lestrrat-go/jwx/pull/2354) - build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2353](https://github.com/lestrrat-go/jwx/pull/2353) - update jwx v4 guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2355](https://github.com/lestrrat-go/jwx/pull/2355) - require guide skill tests after API changes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2356](https://github.com/lestrrat-go/jwx/pull/2356) - build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2359](https://github.com/lestrrat-go/jwx/pull/2359) - build(deps): bump github/codeql-action from 4.38.1 to 4.38.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2362](https://github.com/lestrrat-go/jwx/pull/2362) - jwt: reject overflowing NumericDate values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2368](https://github.com/lestrrat-go/jwx/pull/2368) - jwt: require numbers for pedantic NumericDate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2369](https://github.com/lestrrat-go/jwx/pull/2369) - jws: support strict ECDSA curve checking during verification by [@&#8203;skarm](https://github.com/skarm) in [#&#8203;2367](https://github.com/lestrrat-go/jwx/pull/2367) - \[v4] replace fastjson header probes with jsontext by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2379](https://github.com/lestrrat-go/jwx/pull/2379) - \[v4] allow jwk set mutation during iteration by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2380](https://github.com/lestrrat-go/jwx/pull/2380) - \[v4] fix jwt.Parse fast path with multiple keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2382](https://github.com/lestrrat-go/jwx/pull/2382) - \[v4] fix jwt.Equal for map claims and member order by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2383](https://github.com/lestrrat-go/jwx/pull/2383) - \[v4] keep trying jwe key providers after errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2384](https://github.com/lestrrat-go/jwx/pull/2384) - \[v4] allow empty jwe ciphertext in JSON form by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2386](https://github.com/lestrrat-go/jwx/pull/2386) - \[v4] write jwe unprotected header as JSON object by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2388](https://github.com/lestrrat-go/jwx/pull/2388) - handle shrinking JWK sets in verify and decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2394](https://github.com/lestrrat-go/jwx/pull/2394) - \[v4] jwsbb: size SignBuffer per encoded part by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2400](https://github.com/lestrrat-go/jwx/pull/2400) - \[v4] docs: fix wrong names and links in jwe/jwt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2403](https://github.com/lestrrat-go/jwx/pull/2403) - \[v4] guide: add nested JWT section by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2404](https://github.com/lestrrat-go/jwx/pull/2404) - \[v4] jwt: honor NumericDate format precision by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2409](https://github.com/lestrrat-go/jwx/pull/2409) - \[v4] jwt: parse negative NumericDate values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2411](https://github.com/lestrrat-go/jwx/pull/2411) - \[v4] jwt: parse decimal NumericDate values exactly by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2413](https://github.com/lestrrat-go/jwx/pull/2413) - build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2421](https://github.com/lestrrat-go/jwx/pull/2421) - build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2420](https://github.com/lestrrat-go/jwx/pull/2420) - \[v4] jws: sign only the protected header in JSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2415](https://github.com/lestrrat-go/jwx/pull/2415) - \[v4] jwt: retry missing alg through jws.Verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2422](https://github.com/lestrrat-go/jwx/pull/2422) - Fix typo in migration documentation link by [@&#8203;frostmar](https://github.com/frostmar) in [#&#8203;2425](https://github.com/lestrrat-go/jwx/pull/2425) - build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2428](https://github.com/lestrrat-go/jwx/pull/2428) - use crypto/pbkdf2 and drop x/crypto by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2430](https://github.com/lestrrat-go/jwx/pull/2430) - require latest go patch release by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2432](https://github.com/lestrrat-go/jwx/pull/2432) - use shields.io for the deepwiki badge by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2433](https://github.com/lestrrat-go/jwx/pull/2433) - \[v4] jws: add WithVerifiedSignature verify option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2434](https://github.com/lestrrat-go/jwx/pull/2434) - \[v4] jwe: add WithDecryptedRecipient decrypt option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2438](https://github.com/lestrrat-go/jwx/pull/2438) - \[v4] jws: fix crit and multi-signature docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2435](https://github.com/lestrrat-go/jwx/pull/2435) - \[v4] jwe: document per-recipient headers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2439](https://github.com/lestrrat-go/jwx/pull/2439) - \[v4] ci: run autodoc only for develop/v4 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2446](https://github.com/lestrrat-go/jwx/pull/2446) - \[v4] release v4.6.0 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2448](https://github.com/lestrrat-go/jwx/pull/2448) #### New Contributors - [@&#8203;skarm](https://github.com/skarm) made their first contribution in [#&#8203;2367](https://github.com/lestrrat-go/jwx/pull/2367) - [@&#8203;frostmar](https://github.com/frostmar) made their first contribution in [#&#8203;2425](https://github.com/lestrrat-go/jwx/pull/2425) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.5.0...v4.6.0> ### [`v4.5.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.5.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.5.0/Changes). #### What's Changed - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2318](https://github.com/lestrrat-go/jwx/pull/2318) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2322](https://github.com/lestrrat-go/jwx/pull/2322) - \[v4] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2325](https://github.com/lestrrat-go/jwx/pull/2325) - \[v4] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2327](https://github.com/lestrrat-go/jwx/pull/2327) - \[v4] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2329](https://github.com/lestrrat-go/jwx/pull/2329) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2333](https://github.com/lestrrat-go/jwx/pull/2333) - fix jwk.ParseKey generic guidance in guide skill by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2335](https://github.com/lestrrat-go/jwx/pull/2335) - fix JWKS algorithm inference claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2336](https://github.com/lestrrat-go/jwx/pull/2336) - document exact alg match rule in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2337](https://github.com/lestrrat-go/jwx/pull/2337) - note RFC 9864 EdDSA deprecation in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2338](https://github.com/lestrrat-go/jwx/pull/2338) - drop nonexistent v3 and v2 plugin pointers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2339](https://github.com/lestrrat-go/jwx/pull/2339) - correct ML-DSA import panic claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2340](https://github.com/lestrrat-go/jwx/pull/2340) - add jwxfilter to guide companion table by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2341](https://github.com/lestrrat-go/jwx/pull/2341) - build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2347](https://github.com/lestrrat-go/jwx/pull/2347) - \[v4] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2348](https://github.com/lestrrat-go/jwx/pull/2348) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0> ### [`v4.4.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.4.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.4.0/Changes). #### What's Changed - implement ML-DSA natively on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2309](https://github.com/lestrrat-go/jwx/pull/2309) - use released Go 1.27 in CI by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2308](https://github.com/lestrrat-go/jwx/pull/2308) - move ML-DSA primitives to dsig by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2310](https://github.com/lestrrat-go/jwx/pull/2310) - generate ML-DSA from jwa/objects.yml by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2311](https://github.com/lestrrat-go/jwx/pull/2311) - show both ML-DSA paths in the extensions doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2312](https://github.com/lestrrat-go/jwx/pull/2312) - make GOEXPERIMENT conditional on Go 1.26 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2313](https://github.com/lestrrat-go/jwx/pull/2313) - point ML-DSA doc cache at generated jwa file by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2314](https://github.com/lestrrat-go/jwx/pull/2314) - strip inherited jsonv2 on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2315](https://github.com/lestrrat-go/jwx/pull/2315) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0> ### [`v4.3.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.3.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.3.0/Changes). #### What's Changed - jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by [@&#8203;sueun-dev](https://github.com/sueun-dev) in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) - add JWE authenticated data option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2277](https://github.com/lestrrat-go/jwx/pull/2277) - build(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2281](https://github.com/lestrrat-go/jwx/pull/2281) - build(deps): bump github/codeql-action from 4 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2284](https://github.com/lestrrat-go/jwx/pull/2284) - build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2286](https://github.com/lestrrat-go/jwx/pull/2286) - build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2291](https://github.com/lestrrat-go/jwx/pull/2291) - build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2294](https://github.com/lestrrat-go/jwx/pull/2294) - fuzz every package, not just the module root by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2295](https://github.com/lestrrat-go/jwx/pull/2295) - retry a fuzz target that fails with no crasher by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2296](https://github.com/lestrrat-go/jwx/pull/2296) - build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2303](https://github.com/lestrrat-go/jwx/pull/2303) - build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2302](https://github.com/lestrrat-go/jwx/pull/2302) - fix build under Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2304](https://github.com/lestrrat-go/jwx/pull/2304) #### New Contributors - [@&#8203;sueun-dev](https://github.com/sueun-dev) made their first contribution in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0> ### [`v4.2.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.2.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.2.0/Changes). #### What's Changed - docs: point jwkcache references to jwkfetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2245](https://github.com/lestrrat-go/jwx/pull/2245) - chore: bump golangci-lint-action to 9.3.0 + sync action versions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2246](https://github.com/lestrrat-go/jwx/pull/2246) - fix misspellings in code comments by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2248](https://github.com/lestrrat-go/jwx/pull/2248) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2256](https://github.com/lestrrat-go/jwx/pull/2256) - build(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2255](https://github.com/lestrrat-go/jwx/pull/2255) - build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2252](https://github.com/lestrrat-go/jwx/pull/2252) - build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2259](https://github.com/lestrrat-go/jwx/pull/2259) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2262](https://github.com/lestrrat-go/jwx/pull/2262) - \[v4] retain unparseable JWKS entries as UnsupportedKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2264](https://github.com/lestrrat-go/jwx/pull/2264) - fix CodeQL autobuild for encoding/json/v2 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2268](https://github.com/lestrrat-go/jwx/pull/2268) - \[v4] let per-call WithRejectDuplicateKID override global by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2269](https://github.com/lestrrat-go/jwx/pull/2269) - \[v4] test jwe rejects UnsupportedKey placeholders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2271](https://github.com/lestrrat-go/jwx/pull/2271) - \[v4] doc: warn that global strict JWK set parsing breaks on PQC keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2273](https://github.com/lestrrat-go/jwx/pull/2273) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0> ### [`v4.1.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.1.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.1.0/Changes). #### What's Changed - docs: refresh CONTRIBUTING examples link and branch example by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2156](https://github.com/lestrrat-go/jwx/pull/2156) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2157](https://github.com/lestrrat-go/jwx/pull/2157) - add dependabot updates for develop/v4 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2160](https://github.com/lestrrat-go/jwx/pull/2160) - build(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2161](https://github.com/lestrrat-go/jwx/pull/2161) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2162](https://github.com/lestrrat-go/jwx/pull/2162) - build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2163](https://github.com/lestrrat-go/jwx/pull/2163) - docs: drop dead jwt error helper references by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2164](https://github.com/lestrrat-go/jwx/pull/2164) - add claude code plugin and supporting docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2165](https://github.com/lestrrat-go/jwx/pull/2165) - tighten companion-bulk skill rules by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2166](https://github.com/lestrrat-go/jwx/pull/2166) - docs: add claude code skill install instructions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2167](https://github.com/lestrrat-go/jwx/pull/2167) - docs: add DeepWiki badge to README by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2168](https://github.com/lestrrat-go/jwx/pull/2168) - ci: make v4 fuzz workflow actually run by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2169](https://github.com/lestrrat-go/jwx/pull/2169) - ci: rotate companion fuzz cache via per-run key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2170](https://github.com/lestrrat-go/jwx/pull/2170) - docs: explain fuzz template skip-list by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2171](https://github.com/lestrrat-go/jwx/pull/2171) - build(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2175](https://github.com/lestrrat-go/jwx/pull/2175) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2181](https://github.com/lestrrat-go/jwx/pull/2181) - build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2182](https://github.com/lestrrat-go/jwx/pull/2182) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2185](https://github.com/lestrrat-go/jwx/pull/2185) - build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2186](https://github.com/lestrrat-go/jwx/pull/2186) - docs: warn about anchoring RegexpWhitelist patterns by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2187](https://github.com/lestrrat-go/jwx/pull/2187) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2188](https://github.com/lestrrat-go/jwx/pull/2188) - build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2193](https://github.com/lestrrat-go/jwx/pull/2193) - build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2194](https://github.com/lestrrat-go/jwx/pull/2194) - clear pooled error slice before reuse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2195](https://github.com/lestrrat-go/jwx/pull/2195) - avoid full-string rune alloc in alg error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2196](https://github.com/lestrrat-go/jwx/pull/2196) - release json registry lock before decoder call by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2197](https://github.com/lestrrat-go/jwx/pull/2197) - compute cbc-hmac aad bit length in uint64 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2198](https://github.com/lestrrat-go/jwx/pull/2198) - error on nil curve and oversized d at import by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2199](https://github.com/lestrrat-go/jwx/pull/2199) - error on unavailable thumbprint hash by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2200](https://github.com/lestrrat-go/jwx/pull/2200) - handle nil clock and validator in validate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2202](https://github.com/lestrrat-go/jwx/pull/2202) - reset private claims on token unmarshal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2203](https://github.com/lestrrat-go/jwx/pull/2203) - apply jwt settings only when supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2204](https://github.com/lestrrat-go/jwx/pull/2204) - validate use field at jwk parse time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2205](https://github.com/lestrrat-go/jwx/pull/2205) - document intentional ecdsa high-s acceptance by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2213](https://github.com/lestrrat-go/jwx/pull/2213) - read jwe zip only from protected header by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2206](https://github.com/lestrrat-go/jwx/pull/2206) - enforce aead wire tag and iv length on decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2207](https://github.com/lestrrat-go/jwx/pull/2207) - require 8-octet minimum pbes2 salt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2208](https://github.com/lestrrat-go/jwx/pull/2208) - require empty encrypted\_key for direct cek by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2209](https://github.com/lestrrat-go/jwx/pull/2209) - error on wrong-length [`ed25519`](https://github.com/lestrrat-go/jwx/commit/ed25519) key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2201](https://github.com/lestrrat-go/jwx/pull/2201) - enforce protected alg match in jws verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2212](https://github.com/lestrrat-go/jwx/pull/2212) - document intentional lenient base64 in verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2214](https://github.com/lestrrat-go/jwx/pull/2214) - reject detached payload when payload present by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2211](https://github.com/lestrrat-go/jwx/pull/2211) - document jwk alg is informational, not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2215](https://github.com/lestrrat-go/jwx/pull/2215) - document symmetric key length not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2216](https://github.com/lestrrat-go/jwx/pull/2216) - document rsa private params not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2217](https://github.com/lestrrat-go/jwx/pull/2217) - note AlgorithmsForKey does not validate key length by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2222](https://github.com/lestrrat-go/jwx/pull/2222) - document okp public key not bound to scalar by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2219](https://github.com/lestrrat-go/jwx/pull/2219) - document Chain.Get returns aliased read-only slice by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2220](https://github.com/lestrrat-go/jwx/pull/2220) - fix WithPedantic doc: typ is not checked by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2221](https://github.com/lestrrat-go/jwx/pull/2221) - document ec private scalar not bound to point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2218](https://github.com/lestrrat-go/jwx/pull/2218) - extend direct-mode empty key guard to ml-kem by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2223](https://github.com/lestrrat-go/jwx/pull/2223) - add bazel test target for internal/json by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2224](https://github.com/lestrrat-go/jwx/pull/2224) - build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2227](https://github.com/lestrrat-go/jwx/pull/2227) - build(deps): bump actions/cache from 5.0.5 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2232](https://github.com/lestrrat-go/jwx/pull/2232) - build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2233](https://github.com/lestrrat-go/jwx/pull/2233) - fix: reject duplicate JOSE headers on fast path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2236](https://github.com/lestrrat-go/jwx/pull/2236) - build(deps): bump actions/cache from 6.0.0 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2239](https://github.com/lestrrat-go/jwx/pull/2239) - docs: add unreleased Changes entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2240](https://github.com/lestrrat-go/jwx/pull/2240) - chore: run jwkfetch in companion test sweep by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2244](https://github.com/lestrrat-go/jwx/pull/2244) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0> ### [`v4.0.2`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.2) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.0.2/Changes). #### What's Changed - ci: print coverage summary in GitHub Actions run summary by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2078](https://github.com/lestrrat-go/jwx/pull/2078) - ci: also run on push to target branches by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2079](https://github.com/lestrrat-go/jwx/pull/2079) - jws: refuse "b64" header in VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2080](https://github.com/lestrrat-go/jwx/pull/2080) - jws: VerifyCompactFast refusals match jws.VerifyError() class by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2082](https://github.com/lestrrat-go/jwx/pull/2082) - jws: name loose keySet options in fan-out verify error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2084](https://github.com/lestrrat-go/jwx/pull/2084) - jws: honor RFC 7797 b64=false in Message.MarshalJSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2086](https://github.com/lestrrat-go/jwx/pull/2086) - jws: reject literal-JSON "protected" in general-form JWS by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2088](https://github.com/lestrrat-go/jwx/pull/2088) - jwt: ParseRequest: don't skip form body on chunked transfer by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2090](https://github.com/lestrrat-go/jwx/pull/2090) - jwt: Settings rejects out-of-range NumericDate precision by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2092](https://github.com/lestrrat-go/jwx/pull/2092) - jwt: pedantic mode enforces cty=JWT nested-envelope shape by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2093](https://github.com/lestrrat-go/jwx/pull/2093) - jwt: reshape base64-corruption hint as diagnosis-first by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2095](https://github.com/lestrrat-go/jwx/pull/2095) - jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2098](https://github.com/lestrrat-go/jwx/pull/2098) - jwt: ParseInsecure: parse loop-local payload, not original input by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2096](https://github.com/lestrrat-go/jwx/pull/2096) - jwt: align Validate fast/slow paths to same iat,exp,nbf check order by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2100](https://github.com/lestrrat-go/jwx/pull/2100) - jws: Verify rejects b64=false without "b64" listed in "crit" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2101](https://github.com/lestrrat-go/jwx/pull/2101) - jws: Sign auto-declares "b64" in "crit" when emitting b64=false by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2103](https://github.com/lestrrat-go/jwx/pull/2103) - jws: declare "b64" as typed bool header field by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2105](https://github.com/lestrrat-go/jwx/pull/2105) - jws: reject general-form JWS with top-level "header" sibling of "signatures" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2107](https://github.com/lestrrat-go/jwx/pull/2107) - jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2109](https://github.com/lestrrat-go/jwx/pull/2109) - jws: VerifyMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2111](https://github.com/lestrrat-go/jwx/pull/2111) - jws: cleanup follow-ups from recent review (low-severity batch) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2113](https://github.com/lestrrat-go/jwx/pull/2113) - jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2115](https://github.com/lestrrat-go/jwx/pull/2115) - jwe: DecryptMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2116](https://github.com/lestrrat-go/jwx/pull/2116) - jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2118](https://github.com/lestrrat-go/jwx/pull/2118) - jwe: WithKey validates alg-vs-key shape at option-time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2120](https://github.com/lestrrat-go/jwx/pull/2120) - jwe: compression cap error names "decompressed" payload, the option, and the size by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2122](https://github.com/lestrrat-go/jwx/pull/2122) - jwe: bound joined-error count and drop redundant outer Decrypt prefix by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2124](https://github.com/lestrrat-go/jwx/pull/2124) - jwe: keySetProvider surfaces per-key errors via errors.Join by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2126](https://github.com/lestrrat-go/jwx/pull/2126) - jwe: add WithDisabledKeyAlgorithms global policy hook by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2128](https://github.com/lestrrat-go/jwx/pull/2128) - jwe: document WithMaxDecompressBufferSize behavior at non-positive values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2130](https://github.com/lestrrat-go/jwx/pull/2130) - jwk: stop duplicating JWK fields at JWKS top level on parse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2132](https://github.com/lestrrat-go/jwx/pull/2132) - jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2134](https://github.com/lestrrat-go/jwx/pull/2134) - jwk: stream the keys array with cap-before-allocate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2136](https://github.com/lestrrat-go/jwx/pull/2136) - jwk: probe tolerates duplicate JSON field names by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2138](https://github.com/lestrrat-go/jwx/pull/2138) - jwk: treat nil key from custom KeyParser as continue, not success by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2139](https://github.com/lestrrat-go/jwx/pull/2139) - jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2141](https://github.com/lestrrat-go/jwx/pull/2141) - jwk: add UnknownKeyTypeError typed error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2143](https://github.com/lestrrat-go/jwx/pull/2143) - jwk: document AKP-specific Thumbprint canonicalization on public methods by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2144](https://github.com/lestrrat-go/jwx/pull/2144) - docs/jwk: use jwk.WithX509(true) in PEM section prose by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2145](https://github.com/lestrrat-go/jwx/pull/2145) - docs/jwk: document EncodePEM emit-to-PEM path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2146](https://github.com/lestrrat-go/jwx/pull/2146) - MIGRATION: document PublicSetOf default-reject for symmetric keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2147](https://github.com/lestrrat-go/jwx/pull/2147) - jwk: clarify that any value <= 0 disables the RSA strength floor by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2148](https://github.com/lestrrat-go/jwx/pull/2148) - jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2149](https://github.com/lestrrat-go/jwx/pull/2149) - jwk: correct Import godoc for crypto/ecdh dispatch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2150](https://github.com/lestrrat-go/jwx/pull/2150) - jwk: surface Export type mismatch as KeyTypeMismatchError by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2151](https://github.com/lestrrat-go/jwx/pull/2151) - jwk: RegisterKeyImporter takes KeyImporter, not a typed function by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2152](https://github.com/lestrrat-go/jwx/pull/2152) - Changes: draft v4.0.2 release notes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2154](https://github.com/lestrrat-go/jwx/pull/2154) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2> ### [`v4.0.1`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.1) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1) #### What's Changed - docs: add jwxfilter to extension modules doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2041](https://github.com/lestrrat-go/jwx/pull/2041) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2042](https://github.com/lestrrat-go/jwx/pull/2042) - docs: fix broken v3-to-v4.yaml link in Changes-v4.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2048](https://github.com/lestrrat-go/jwx/pull/2048) - guard ecdsa coordinates against oversized big.Int by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2049](https://github.com/lestrrat-go/jwx/pull/2049) - reject jwe with conflicting alg in protected vs per-recipient by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2051](https://github.com/lestrrat-go/jwx/pull/2051) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2053](https://github.com/lestrrat-go/jwx/pull/2053) - docs: document PrivateClaims concurrency contract by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2055](https://github.com/lestrrat-go/jwx/pull/2055) - fix AddressClaim.MarshalJSON for non-printable bytes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2054](https://github.com/lestrrat-go/jwx/pull/2054) - jwt: only call ParseForm when WithFormKey is supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2057](https://github.com/lestrrat-go/jwx/pull/2057) - jws: jkuProvider rejects fetched keys marked use=enc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2059](https://github.com/lestrrat-go/jwx/pull/2059) - jwk: refuse RegisterKeyImporter for built-in raw key types by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2061](https://github.com/lestrrat-go/jwx/pull/2061) - jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2062](https://github.com/lestrrat-go/jwx/pull/2062) - docs: jwkbb X509 registry is a privileged extension point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2067](https://github.com/lestrrat-go/jwx/pull/2067) - docs(internals): record Settings unknown-option handling as design intent by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2068](https://github.com/lestrrat-go/jwx/pull/2068) - cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2070](https://github.com/lestrrat-go/jwx/pull/2070) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2069](https://github.com/lestrrat-go/jwx/pull/2069) - fix jwxmigrate install path in MIGRATION.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2076](https://github.com/lestrrat-go/jwx/pull/2076) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1> ### [`v4.0.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.4.0...v4.0.0) # Changes v4 has many incompatibilities with v3. To see the full list of differences between v3 and v4, please read the [Changes-v4.md file](./Changes-v4.md). Coding Agents should read [MIGRATION.md](./MIGRATION.md) v4.0.0 - 19 Apr 2026 - Initial v4 release. Major features: - Lighter: Core / Companion module separation. Less dependencies in core. - Faster: Use of generics and other optimizations make v4 2x\~3x faster than before. - Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules. - See Changes-v4.md for a full set of Changes since v3. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Warsaw) - Branch creation - Between 09:00 AM and 10:59 PM (`* 9-22 * * *`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44MS4wIiwidXBkYXRlZEluVmVyIjoiNDQuODEuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
/ test (push) Successful in 49s
Details
/ build (push) Successful in 37s
Details
/ test (pull_request) Successful in 47s
Details
/ build (pull_request) Successful in 37s
Details
/ push-backend (push) Has been skipped
Details
/ push-migration (push) Has been skipped
Details
/ push-backend (pull_request) Has been skipped
Details
/ push-migration (pull_request) Has been skipped
Details
f90005305f
roshless commented 2026-10-25 11:09:24 +01:00
Owner
Copy link

Blocked by https://github.com/go-chi/jwtauth

Blocked by https://github.com/go-chi/jwtauth
roshless closed this pull request 2026-10-25 11:09:24 +01:00
renovate-bot commented 2026-10-25 12:01:27 +01:00
Author
Collaborator
Copy link

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for *any* future `4.x` releases. But if you manually upgrade to `4.x` then Renovate will re-enable `minor` and `patch` updates automatically. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Details
/ test (push) Successful in 49s
Details
/ build (push) Successful in 37s
Details
/ test (pull_request) Successful in 47s
Details
/ build (pull_request) Successful in 37s
Details
/ push-backend (push) Has been skipped
Details
/ push-migration (push) Has been skipped
Details
/ push-backend (pull_request) Has been skipped
Details
/ push-migration (pull_request) Has been skipped
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
molo/backend!18
No description provided.