bagas/tunnel-please-controller
1
0
Fork 0
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.5.0 #59

Open
Renovate-Clanker wants to merge 1 commits from renovate/github.com-lestrrat-go-jwx-v4-4.x into main
pull from: renovate/github.com-lestrrat-go-jwx-v4-4.x
merge into: :main
Conversation 1 Commits 1 Files Changed 2
+5 -2
Renovate-Clanker commented 2026-09-08 11:09:22 +07:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
github.com/lestrrat-go/jwx/v4 v4.4.0 → v4.5.0 age confidence

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)

v4.5.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v4](https://github.com/lestrrat-go/jwx) | `v4.4.0` → `v4.5.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.5.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.4.0/v4.5.0?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)</summary> ### [`v4.5.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.5.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.5.0/Changes). #### What's Changed - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2318](https://github.com/lestrrat-go/jwx/pull/2318) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2322](https://github.com/lestrrat-go/jwx/pull/2322) - \[v4] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2325](https://github.com/lestrrat-go/jwx/pull/2325) - \[v4] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2327](https://github.com/lestrrat-go/jwx/pull/2327) - \[v4] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2329](https://github.com/lestrrat-go/jwx/pull/2329) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2333](https://github.com/lestrrat-go/jwx/pull/2333) - fix jwk.ParseKey generic guidance in guide skill by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2335](https://github.com/lestrrat-go/jwx/pull/2335) - fix JWKS algorithm inference claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2336](https://github.com/lestrrat-go/jwx/pull/2336) - document exact alg match rule in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2337](https://github.com/lestrrat-go/jwx/pull/2337) - note RFC 9864 EdDSA deprecation in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2338](https://github.com/lestrrat-go/jwx/pull/2338) - drop nonexistent v3 and v2 plugin pointers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2339](https://github.com/lestrrat-go/jwx/pull/2339) - correct ML-DSA import panic claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2340](https://github.com/lestrrat-go/jwx/pull/2340) - add jwxfilter to guide companion table by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2341](https://github.com/lestrrat-go/jwx/pull/2341) - build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2347](https://github.com/lestrrat-go/jwx/pull/2347) - \[v4] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2348](https://github.com/lestrrat-go/jwx/pull/2348) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zOS4yIiwidXBkYXRlZEluVmVyIjoiNDQuMzkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
Renovate-Clanker commented 2026-09-08 11:09:24 +07:00
Author
Collaborator
Copy Link
Copy Source

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 1 additional dependency was updated

Details:

Package Change
golang.org/x/crypto v0.55.0 -> v0.56.0
### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 1 additional dependency was updated Details: | **Package** | **Change** | | :-------------------- | :--------------------- | | `golang.org/x/crypto` | `v0.55.0` -> `v0.56.0` |
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v4-4.x from 67aac3b116 to 6917f33f83 2026-09-08 12:09:00 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v4-4.x from 6917f33f83 to 1250975895 2026-09-18 01:09:15 +07:00 Compare
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v4-4.x from 1250975895 to e8f5d41b59 2026-09-18 04:09:28 +07:00 Compare
Renovate-Clanker added 1 commit 2026-09-30 22:08:52 +07:00
fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.5.0 2df9c5fce5
Renovate-Clanker force-pushed renovate/github.com-lestrrat-go-jwx-v4-4.x from e8f5d41b59 to 2df9c5fce5 2026-09-30 22:08:52 +07:00 Compare
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/github.com-lestrrat-go-jwx-v4-4.x:renovate/github.com-lestrrat-go-jwx-v4-4.x
git checkout renovate/github.com-lestrrat-go-jwx-v4-4.x
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Renovate-Clanker bagas
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bagas/tunnel-please-controller#59