bagas/tunnel-please-controller
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4 #49

Open
Renovate-Clanker wants to merge 1 commits from renovate/github.com-lestrrat-go-jwx-v3-4.x into main
pull from: renovate/github.com-lestrrat-go-jwx-v3-4.x
merge into: :main
Conversation 1 Commits 1 Files Changed 2
+5 -2
Renovate-Clanker commented 2026-08-17 17:09:33 +07:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
github.com/lestrrat-go/jwx/v3 v3.3.0 → v4.5.0 age confidence

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.5.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0

v4.4.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0

v4.3.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

New Contributors

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION.md

v4.0.0 - 19 Apr 2026

  • Initial v4 release. Major features:
    • Lighter: Core / Companion module separation. Less dependencies in core.
    • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
    • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
  • See Changes-v4.md for a full set of Changes since v3.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) | `v3.3.0` → `v4.5.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv3/v4.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv3/v3.3.0/v4.5.0?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)</summary> ### [`v4.5.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.5.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.5.0/Changes). #### What's Changed - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2318](https://github.com/lestrrat-go/jwx/pull/2318) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2322](https://github.com/lestrrat-go/jwx/pull/2322) - \[v4] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2325](https://github.com/lestrrat-go/jwx/pull/2325) - \[v4] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2327](https://github.com/lestrrat-go/jwx/pull/2327) - \[v4] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2329](https://github.com/lestrrat-go/jwx/pull/2329) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2333](https://github.com/lestrrat-go/jwx/pull/2333) - fix jwk.ParseKey generic guidance in guide skill by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2335](https://github.com/lestrrat-go/jwx/pull/2335) - fix JWKS algorithm inference claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2336](https://github.com/lestrrat-go/jwx/pull/2336) - document exact alg match rule in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2337](https://github.com/lestrrat-go/jwx/pull/2337) - note RFC 9864 EdDSA deprecation in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2338](https://github.com/lestrrat-go/jwx/pull/2338) - drop nonexistent v3 and v2 plugin pointers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2339](https://github.com/lestrrat-go/jwx/pull/2339) - correct ML-DSA import panic claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2340](https://github.com/lestrrat-go/jwx/pull/2340) - add jwxfilter to guide companion table by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2341](https://github.com/lestrrat-go/jwx/pull/2341) - build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2347](https://github.com/lestrrat-go/jwx/pull/2347) - \[v4] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2348](https://github.com/lestrrat-go/jwx/pull/2348) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0> ### [`v4.4.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.4.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.4.0/Changes). #### What's Changed - implement ML-DSA natively on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2309](https://github.com/lestrrat-go/jwx/pull/2309) - use released Go 1.27 in CI by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2308](https://github.com/lestrrat-go/jwx/pull/2308) - move ML-DSA primitives to dsig by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2310](https://github.com/lestrrat-go/jwx/pull/2310) - generate ML-DSA from jwa/objects.yml by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2311](https://github.com/lestrrat-go/jwx/pull/2311) - show both ML-DSA paths in the extensions doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2312](https://github.com/lestrrat-go/jwx/pull/2312) - make GOEXPERIMENT conditional on Go 1.26 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2313](https://github.com/lestrrat-go/jwx/pull/2313) - point ML-DSA doc cache at generated jwa file by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2314](https://github.com/lestrrat-go/jwx/pull/2314) - strip inherited jsonv2 on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2315](https://github.com/lestrrat-go/jwx/pull/2315) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0> ### [`v4.3.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.3.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.3.0/Changes). #### What's Changed - jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by [@&#8203;sueun-dev](https://github.com/sueun-dev) in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) - add JWE authenticated data option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2277](https://github.com/lestrrat-go/jwx/pull/2277) - build(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2281](https://github.com/lestrrat-go/jwx/pull/2281) - build(deps): bump github/codeql-action from 4 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2284](https://github.com/lestrrat-go/jwx/pull/2284) - build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2286](https://github.com/lestrrat-go/jwx/pull/2286) - build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2291](https://github.com/lestrrat-go/jwx/pull/2291) - build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2294](https://github.com/lestrrat-go/jwx/pull/2294) - fuzz every package, not just the module root by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2295](https://github.com/lestrrat-go/jwx/pull/2295) - retry a fuzz target that fails with no crasher by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2296](https://github.com/lestrrat-go/jwx/pull/2296) - build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2303](https://github.com/lestrrat-go/jwx/pull/2303) - build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2302](https://github.com/lestrrat-go/jwx/pull/2302) - fix build under Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2304](https://github.com/lestrrat-go/jwx/pull/2304) #### New Contributors - [@&#8203;sueun-dev](https://github.com/sueun-dev) made their first contribution in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0> ### [`v4.2.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.2.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.2.0/Changes). #### What's Changed - docs: point jwkcache references to jwkfetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2245](https://github.com/lestrrat-go/jwx/pull/2245) - chore: bump golangci-lint-action to 9.3.0 + sync action versions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2246](https://github.com/lestrrat-go/jwx/pull/2246) - fix misspellings in code comments by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2248](https://github.com/lestrrat-go/jwx/pull/2248) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2256](https://github.com/lestrrat-go/jwx/pull/2256) - build(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2255](https://github.com/lestrrat-go/jwx/pull/2255) - build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2252](https://github.com/lestrrat-go/jwx/pull/2252) - build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2259](https://github.com/lestrrat-go/jwx/pull/2259) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2262](https://github.com/lestrrat-go/jwx/pull/2262) - \[v4] retain unparseable JWKS entries as UnsupportedKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2264](https://github.com/lestrrat-go/jwx/pull/2264) - fix CodeQL autobuild for encoding/json/v2 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2268](https://github.com/lestrrat-go/jwx/pull/2268) - \[v4] let per-call WithRejectDuplicateKID override global by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2269](https://github.com/lestrrat-go/jwx/pull/2269) - \[v4] test jwe rejects UnsupportedKey placeholders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2271](https://github.com/lestrrat-go/jwx/pull/2271) - \[v4] doc: warn that global strict JWK set parsing breaks on PQC keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2273](https://github.com/lestrrat-go/jwx/pull/2273) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0> ### [`v4.1.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.1.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.1.0/Changes). #### What's Changed - docs: refresh CONTRIBUTING examples link and branch example by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2156](https://github.com/lestrrat-go/jwx/pull/2156) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2157](https://github.com/lestrrat-go/jwx/pull/2157) - add dependabot updates for develop/v4 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2160](https://github.com/lestrrat-go/jwx/pull/2160) - build(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2161](https://github.com/lestrrat-go/jwx/pull/2161) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2162](https://github.com/lestrrat-go/jwx/pull/2162) - build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2163](https://github.com/lestrrat-go/jwx/pull/2163) - docs: drop dead jwt error helper references by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2164](https://github.com/lestrrat-go/jwx/pull/2164) - add claude code plugin and supporting docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2165](https://github.com/lestrrat-go/jwx/pull/2165) - tighten companion-bulk skill rules by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2166](https://github.com/lestrrat-go/jwx/pull/2166) - docs: add claude code skill install instructions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2167](https://github.com/lestrrat-go/jwx/pull/2167) - docs: add DeepWiki badge to README by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2168](https://github.com/lestrrat-go/jwx/pull/2168) - ci: make v4 fuzz workflow actually run by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2169](https://github.com/lestrrat-go/jwx/pull/2169) - ci: rotate companion fuzz cache via per-run key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2170](https://github.com/lestrrat-go/jwx/pull/2170) - docs: explain fuzz template skip-list by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2171](https://github.com/lestrrat-go/jwx/pull/2171) - build(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2175](https://github.com/lestrrat-go/jwx/pull/2175) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2181](https://github.com/lestrrat-go/jwx/pull/2181) - build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2182](https://github.com/lestrrat-go/jwx/pull/2182) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2185](https://github.com/lestrrat-go/jwx/pull/2185) - build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2186](https://github.com/lestrrat-go/jwx/pull/2186) - docs: warn about anchoring RegexpWhitelist patterns by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2187](https://github.com/lestrrat-go/jwx/pull/2187) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2188](https://github.com/lestrrat-go/jwx/pull/2188) - build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2193](https://github.com/lestrrat-go/jwx/pull/2193) - build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2194](https://github.com/lestrrat-go/jwx/pull/2194) - clear pooled error slice before reuse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2195](https://github.com/lestrrat-go/jwx/pull/2195) - avoid full-string rune alloc in alg error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2196](https://github.com/lestrrat-go/jwx/pull/2196) - release json registry lock before decoder call by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2197](https://github.com/lestrrat-go/jwx/pull/2197) - compute cbc-hmac aad bit length in uint64 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2198](https://github.com/lestrrat-go/jwx/pull/2198) - error on nil curve and oversized d at import by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2199](https://github.com/lestrrat-go/jwx/pull/2199) - error on unavailable thumbprint hash by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2200](https://github.com/lestrrat-go/jwx/pull/2200) - handle nil clock and validator in validate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2202](https://github.com/lestrrat-go/jwx/pull/2202) - reset private claims on token unmarshal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2203](https://github.com/lestrrat-go/jwx/pull/2203) - apply jwt settings only when supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2204](https://github.com/lestrrat-go/jwx/pull/2204) - validate use field at jwk parse time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2205](https://github.com/lestrrat-go/jwx/pull/2205) - document intentional ecdsa high-s acceptance by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2213](https://github.com/lestrrat-go/jwx/pull/2213) - read jwe zip only from protected header by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2206](https://github.com/lestrrat-go/jwx/pull/2206) - enforce aead wire tag and iv length on decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2207](https://github.com/lestrrat-go/jwx/pull/2207) - require 8-octet minimum pbes2 salt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2208](https://github.com/lestrrat-go/jwx/pull/2208) - require empty encrypted\_key for direct cek by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2209](https://github.com/lestrrat-go/jwx/pull/2209) - error on wrong-length [`ed25519`](https://github.com/lestrrat-go/jwx/commit/ed25519) key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2201](https://github.com/lestrrat-go/jwx/pull/2201) - enforce protected alg match in jws verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2212](https://github.com/lestrrat-go/jwx/pull/2212) - document intentional lenient base64 in verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2214](https://github.com/lestrrat-go/jwx/pull/2214) - reject detached payload when payload present by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2211](https://github.com/lestrrat-go/jwx/pull/2211) - document jwk alg is informational, not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2215](https://github.com/lestrrat-go/jwx/pull/2215) - document symmetric key length not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2216](https://github.com/lestrrat-go/jwx/pull/2216) - document rsa private params not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2217](https://github.com/lestrrat-go/jwx/pull/2217) - note AlgorithmsForKey does not validate key length by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2222](https://github.com/lestrrat-go/jwx/pull/2222) - document okp public key not bound to scalar by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2219](https://github.com/lestrrat-go/jwx/pull/2219) - document Chain.Get returns aliased read-only slice by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2220](https://github.com/lestrrat-go/jwx/pull/2220) - fix WithPedantic doc: typ is not checked by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2221](https://github.com/lestrrat-go/jwx/pull/2221) - document ec private scalar not bound to point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2218](https://github.com/lestrrat-go/jwx/pull/2218) - extend direct-mode empty key guard to ml-kem by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2223](https://github.com/lestrrat-go/jwx/pull/2223) - add bazel test target for internal/json by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2224](https://github.com/lestrrat-go/jwx/pull/2224) - build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2227](https://github.com/lestrrat-go/jwx/pull/2227) - build(deps): bump actions/cache from 5.0.5 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2232](https://github.com/lestrrat-go/jwx/pull/2232) - build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2233](https://github.com/lestrrat-go/jwx/pull/2233) - fix: reject duplicate JOSE headers on fast path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2236](https://github.com/lestrrat-go/jwx/pull/2236) - build(deps): bump actions/cache from 6.0.0 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2239](https://github.com/lestrrat-go/jwx/pull/2239) - docs: add unreleased Changes entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2240](https://github.com/lestrrat-go/jwx/pull/2240) - chore: run jwkfetch in companion test sweep by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2244](https://github.com/lestrrat-go/jwx/pull/2244) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0> ### [`v4.0.2`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.2) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.0.2/Changes). #### What's Changed - ci: print coverage summary in GitHub Actions run summary by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2078](https://github.com/lestrrat-go/jwx/pull/2078) - ci: also run on push to target branches by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2079](https://github.com/lestrrat-go/jwx/pull/2079) - jws: refuse "b64" header in VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2080](https://github.com/lestrrat-go/jwx/pull/2080) - jws: VerifyCompactFast refusals match jws.VerifyError() class by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2082](https://github.com/lestrrat-go/jwx/pull/2082) - jws: name loose keySet options in fan-out verify error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2084](https://github.com/lestrrat-go/jwx/pull/2084) - jws: honor RFC 7797 b64=false in Message.MarshalJSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2086](https://github.com/lestrrat-go/jwx/pull/2086) - jws: reject literal-JSON "protected" in general-form JWS by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2088](https://github.com/lestrrat-go/jwx/pull/2088) - jwt: ParseRequest: don't skip form body on chunked transfer by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2090](https://github.com/lestrrat-go/jwx/pull/2090) - jwt: Settings rejects out-of-range NumericDate precision by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2092](https://github.com/lestrrat-go/jwx/pull/2092) - jwt: pedantic mode enforces cty=JWT nested-envelope shape by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2093](https://github.com/lestrrat-go/jwx/pull/2093) - jwt: reshape base64-corruption hint as diagnosis-first by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2095](https://github.com/lestrrat-go/jwx/pull/2095) - jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2098](https://github.com/lestrrat-go/jwx/pull/2098) - jwt: ParseInsecure: parse loop-local payload, not original input by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2096](https://github.com/lestrrat-go/jwx/pull/2096) - jwt: align Validate fast/slow paths to same iat,exp,nbf check order by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2100](https://github.com/lestrrat-go/jwx/pull/2100) - jws: Verify rejects b64=false without "b64" listed in "crit" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2101](https://github.com/lestrrat-go/jwx/pull/2101) - jws: Sign auto-declares "b64" in "crit" when emitting b64=false by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2103](https://github.com/lestrrat-go/jwx/pull/2103) - jws: declare "b64" as typed bool header field by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2105](https://github.com/lestrrat-go/jwx/pull/2105) - jws: reject general-form JWS with top-level "header" sibling of "signatures" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2107](https://github.com/lestrrat-go/jwx/pull/2107) - jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2109](https://github.com/lestrrat-go/jwx/pull/2109) - jws: VerifyMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2111](https://github.com/lestrrat-go/jwx/pull/2111) - jws: cleanup follow-ups from recent review (low-severity batch) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2113](https://github.com/lestrrat-go/jwx/pull/2113) - jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2115](https://github.com/lestrrat-go/jwx/pull/2115) - jwe: DecryptMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2116](https://github.com/lestrrat-go/jwx/pull/2116) - jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2118](https://github.com/lestrrat-go/jwx/pull/2118) - jwe: WithKey validates alg-vs-key shape at option-time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2120](https://github.com/lestrrat-go/jwx/pull/2120) - jwe: compression cap error names "decompressed" payload, the option, and the size by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2122](https://github.com/lestrrat-go/jwx/pull/2122) - jwe: bound joined-error count and drop redundant outer Decrypt prefix by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2124](https://github.com/lestrrat-go/jwx/pull/2124) - jwe: keySetProvider surfaces per-key errors via errors.Join by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2126](https://github.com/lestrrat-go/jwx/pull/2126) - jwe: add WithDisabledKeyAlgorithms global policy hook by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2128](https://github.com/lestrrat-go/jwx/pull/2128) - jwe: document WithMaxDecompressBufferSize behavior at non-positive values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2130](https://github.com/lestrrat-go/jwx/pull/2130) - jwk: stop duplicating JWK fields at JWKS top level on parse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2132](https://github.com/lestrrat-go/jwx/pull/2132) - jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2134](https://github.com/lestrrat-go/jwx/pull/2134) - jwk: stream the keys array with cap-before-allocate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2136](https://github.com/lestrrat-go/jwx/pull/2136) - jwk: probe tolerates duplicate JSON field names by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2138](https://github.com/lestrrat-go/jwx/pull/2138) - jwk: treat nil key from custom KeyParser as continue, not success by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2139](https://github.com/lestrrat-go/jwx/pull/2139) - jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2141](https://github.com/lestrrat-go/jwx/pull/2141) - jwk: add UnknownKeyTypeError typed error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2143](https://github.com/lestrrat-go/jwx/pull/2143) - jwk: document AKP-specific Thumbprint canonicalization on public methods by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2144](https://github.com/lestrrat-go/jwx/pull/2144) - docs/jwk: use jwk.WithX509(true) in PEM section prose by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2145](https://github.com/lestrrat-go/jwx/pull/2145) - docs/jwk: document EncodePEM emit-to-PEM path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2146](https://github.com/lestrrat-go/jwx/pull/2146) - MIGRATION: document PublicSetOf default-reject for symmetric keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2147](https://github.com/lestrrat-go/jwx/pull/2147) - jwk: clarify that any value <= 0 disables the RSA strength floor by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2148](https://github.com/lestrrat-go/jwx/pull/2148) - jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2149](https://github.com/lestrrat-go/jwx/pull/2149) - jwk: correct Import godoc for crypto/ecdh dispatch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2150](https://github.com/lestrrat-go/jwx/pull/2150) - jwk: surface Export type mismatch as KeyTypeMismatchError by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2151](https://github.com/lestrrat-go/jwx/pull/2151) - jwk: RegisterKeyImporter takes KeyImporter, not a typed function by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2152](https://github.com/lestrrat-go/jwx/pull/2152) - Changes: draft v4.0.2 release notes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2154](https://github.com/lestrrat-go/jwx/pull/2154) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2> ### [`v4.0.1`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.1) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1) #### What's Changed - docs: add jwxfilter to extension modules doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2041](https://github.com/lestrrat-go/jwx/pull/2041) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2042](https://github.com/lestrrat-go/jwx/pull/2042) - docs: fix broken v3-to-v4.yaml link in Changes-v4.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2048](https://github.com/lestrrat-go/jwx/pull/2048) - guard ecdsa coordinates against oversized big.Int by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2049](https://github.com/lestrrat-go/jwx/pull/2049) - reject jwe with conflicting alg in protected vs per-recipient by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2051](https://github.com/lestrrat-go/jwx/pull/2051) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2053](https://github.com/lestrrat-go/jwx/pull/2053) - docs: document PrivateClaims concurrency contract by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2055](https://github.com/lestrrat-go/jwx/pull/2055) - fix AddressClaim.MarshalJSON for non-printable bytes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2054](https://github.com/lestrrat-go/jwx/pull/2054) - jwt: only call ParseForm when WithFormKey is supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2057](https://github.com/lestrrat-go/jwx/pull/2057) - jws: jkuProvider rejects fetched keys marked use=enc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2059](https://github.com/lestrrat-go/jwx/pull/2059) - jwk: refuse RegisterKeyImporter for built-in raw key types by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2061](https://github.com/lestrrat-go/jwx/pull/2061) - jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2062](https://github.com/lestrrat-go/jwx/pull/2062) - docs: jwkbb X509 registry is a privileged extension point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2067](https://github.com/lestrrat-go/jwx/pull/2067) - docs(internals): record Settings unknown-option handling as design intent by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2068](https://github.com/lestrrat-go/jwx/pull/2068) - cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2070](https://github.com/lestrrat-go/jwx/pull/2070) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2069](https://github.com/lestrrat-go/jwx/pull/2069) - fix jwxmigrate install path in MIGRATION.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2076](https://github.com/lestrrat-go/jwx/pull/2076) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1> ### [`v4.0.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.3.0...v4.0.0) # Changes v4 has many incompatibilities with v3. To see the full list of differences between v3 and v4, please read the [Changes-v4.md file](./Changes-v4.md). Coding Agents should read [MIGRATION.md](./MIGRATION.md) v4.0.0 - 19 Apr 2026 - Initial v4 release. Major features: - Lighter: Core / Companion module separation. Less dependencies in core. - Faster: Use of generics and other optimizations make v4 2x\~3x faster than before. - Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules. - See Changes-v4.md for a full set of Changes since v3. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNC4xMiIsInVwZGF0ZWRJblZlciI6IjQ0LjM5LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 23c9b9a67c to 93e1990acd 2026-08-18 14:10:45 +07:00 Compare
Renovate-Clanker commented 2026-08-18 14:10:49 +07:00
Author
Collaborator
Copy Link
Copy Source

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
golang.org/x/crypto v0.55.0 -> v0.56.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 1 additional dependency was updated Details: | **Package** | **Change** | | :-------------------- | :--------------------- | | `golang.org/x/crypto` | `v0.55.0` -> `v0.56.0` |
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 93e1990acd to 5067a6f00b 2026-08-18 15:08:38 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 5067a6f00b to f8aecea2c1 2026-08-20 21:09:12 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from f8aecea2c1 to 5f5d6ab6bb 2026-08-20 22:09:03 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 5f5d6ab6bb to d48b1898f5 2026-09-08 11:09:38 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from d48b1898f5 to 800b7d7d4f 2026-09-08 12:09:19 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 800b7d7d4f to c178cef027 2026-09-18 01:09:34 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from c178cef027 to 5f7d89e9f6 2026-09-18 04:09:47 +07:00 Compare
Renovate-Clanker added 1 commit 2026-09-30 22:09:11 +07:00
fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4 4a2a3142c5
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v3-4.x from 5f7d89e9f6 to 4a2a3142c5 2026-09-30 22:09:11 +07:00 Compare
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/github.com-lestrrat-go-jwx-v3-4.x:renovate/github.com-lestrrat-go-jwx-v3-4.x
git checkout renovate/github.com-lestrrat-go-jwx-v3-4.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Renovate-Clanker bagas
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bagas/tunnel-please-controller#49