bagas/tunnel-please-controller
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(deps): update module github.com/lestrrat-go/jwx/v3 to v3.3.0 #58

Merged
Renovate-Clanker merged 1 commits from renovate/github.com-lestrrat-go-jwx-v3-3.x into main 2026-09-08 11:09:11 +07:00
Conversation 0 Commits 1 Files Changed 2
+3 -1
Renovate-Clanker commented 2026-09-08 11:09:10 +07:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
github.com/lestrrat-go/jwx/v3 v3.2.0 → v3.3.0 age confidence

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v3.3.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `v3.2.0` → `v3.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv3/v3.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv3/v3.2.0/v3.3.0?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)</summary> ### [`v3.3.0`](https://github.com/lestrrat-go/jwx/releases/tag/v3.3.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v3.3.0/Changes). #### What's Changed - build(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2280](https://github.com/lestrrat-go/jwx/pull/2280) - build(deps): bump github/codeql-action from 4 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2283](https://github.com/lestrrat-go/jwx/pull/2283) - build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2287](https://github.com/lestrrat-go/jwx/pull/2287) - build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2290](https://github.com/lestrrat-go/jwx/pull/2290) - build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2293](https://github.com/lestrrat-go/jwx/pull/2293) - build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2301](https://github.com/lestrrat-go/jwx/pull/2301) - build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2299](https://github.com/lestrrat-go/jwx/pull/2299) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2306](https://github.com/lestrrat-go/jwx/pull/2306) - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2316](https://github.com/lestrrat-go/jwx/pull/2316) - build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2319](https://github.com/lestrrat-go/jwx/pull/2319) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2321](https://github.com/lestrrat-go/jwx/pull/2321) - \[v3] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2326](https://github.com/lestrrat-go/jwx/pull/2326) - \[v3] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2328](https://github.com/lestrrat-go/jwx/pull/2328) - \[v3] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2330](https://github.com/lestrrat-go/jwx/pull/2330) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2332](https://github.com/lestrrat-go/jwx/pull/2332) - add example for bounded WithWaitReady wait by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2343](https://github.com/lestrrat-go/jwx/pull/2343) - show fetch failure cause via error sink by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2344](https://github.com/lestrrat-go/jwx/pull/2344) - \[v3] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2349](https://github.com/lestrrat-go/jwx/pull/2349) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4yIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Renovate-Clanker added 1 commit 2026-09-08 11:09:10 +07:00
fix(deps): update module github.com/lestrrat-go/jwx/v3 to v3.3.0 b4c9fe5954
Renovate-Clanker scheduled this pull request to auto merge when all checks succeed 2026-09-08 11:09:11 +07:00
Renovate-Clanker merged commit 3a847b7638 into main 2026-09-08 11:09:11 +07:00
Renovate-Clanker deleted branch renovate/github.com-lestrrat-go-jwx-v3-3.x 2026-09-08 11:09:11 +07:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Renovate-Clanker bagas
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bagas/tunnel-please-controller#58