chore(deps): update module github.com/lestrrat-go/jwx/v2 to v4 #10

Open

svc-renovate wants to merge 1 commit from renovate/github.com-lestrrat-go-jwx-v2-4.x into main

pull from: renovate/github.com-lestrrat-go-jwx-v2-4.x

merge into: sophie:main

sophie:main

sophie:renovate/dependencies

Conversation 0 Commits 1 Files changed 1 +1 -1

svc-renovate commented 2026-10-01 23:03:13 +10:00

Collaborator

Copy link

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v2	v2.1.7 → v4.5.0

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v4.5.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​2318
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​2322
• [v4] deprecate AlgorithmsForKey, move to internal by @​lestrrat in #​2325
• [v4] add jws.WithStrictECDSA sign option by @​lestrrat in #​2327
• [v4] fix curve inference claim in docs by @​lestrrat in #​2329
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​2333
• fix jwk.ParseKey generic guidance in guide skill by @​lestrrat in #​2335
• fix JWKS algorithm inference claim in guide by @​lestrrat in #​2336
• document exact alg match rule in guide by @​lestrrat in #​2337
• note RFC 9864 EdDSA deprecation in guide by @​lestrrat in #​2338
• drop nonexistent v3 and v2 plugin pointers by @​lestrrat in #​2339
• correct ML-DSA import panic claim in guide by @​lestrrat in #​2340
• add jwxfilter to guide companion table by @​lestrrat in #​2341
• build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @​dependabot[bot] in #​2347
• [v4] escape JSON object member names on output by @​lestrrat in #​2348

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0

v4.4.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• implement ML-DSA natively on Go 1.27 by @​lestrrat in #​2309
• use released Go 1.27 in CI by @​lestrrat in #​2308
• move ML-DSA primitives to dsig by @​lestrrat in #​2310
• generate ML-DSA from jwa/objects.yml by @​lestrrat in #​2311
• show both ML-DSA paths in the extensions doc by @​lestrrat in #​2312
• make GOEXPERIMENT conditional on Go 1.26 by @​lestrrat in #​2313
• point ML-DSA doc cache at generated jwa file by @​lestrrat in #​2314
• strip inherited jsonv2 on Go 1.27 by @​lestrrat in #​2315

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0

v4.3.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by @​sueun-dev in #​2275
• add JWE authenticated data option by @​lestrrat in #​2277
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2281
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2284
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2286
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2291
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2294
• fuzz every package, not just the module root by @​lestrrat in #​2295
• retry a fuzz target that fails with no crasher by @​lestrrat in #​2296
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2303
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2302
• fix build under Go 1.27 by @​lestrrat in #​2304

New Contributors

• @​sueun-dev made their first contribution in #​2275

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: point jwkcache references to jwkfetch by @​lestrrat in #​2245
• chore: bump golangci-lint-action to 9.3.0 + sync action versions by @​lestrrat in #​2246
• fix misspellings in code comments by @​lestrrat in #​2248
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by @​dependabot[bot] in #​2256
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2255
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2252
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2259
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2262
• [v4] retain unparseable JWKS entries as UnsupportedKey by @​lestrrat in #​2264
• fix CodeQL autobuild for encoding/json/v2 by @​lestrrat in #​2268
• [v4] let per-call WithRejectDuplicateKID override global by @​lestrrat in #​2269
• [v4] test jwe rejects UnsupportedKey placeholders by @​lestrrat in #​2271
• [v4] doc: warn that global strict JWK set parsing breaks on PQC keys by @​lestrrat in #​2273

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: refresh CONTRIBUTING examples link and branch example by @​lestrrat in #​2156
• autodoc updates by @​github-actions[bot] in #​2157
• add dependabot updates for develop/v4 by @​lestrrat in #​2160
• build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​2161
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​2162
• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by @​dependabot[bot] in #​2163
• docs: drop dead jwt error helper references by @​lestrrat in #​2164
• add claude code plugin and supporting docs by @​lestrrat in #​2165
• tighten companion-bulk skill rules by @​lestrrat in #​2166
• docs: add claude code skill install instructions by @​lestrrat in #​2167
• docs: add DeepWiki badge to README by @​lestrrat in #​2168
• ci: make v4 fuzz workflow actually run by @​lestrrat in #​2169
• ci: rotate companion fuzz cache via per-run key by @​lestrrat in #​2170
• docs: explain fuzz template skip-list by @​lestrrat in #​2171
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2175
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2181
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2182
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2185
• build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by @​dependabot[bot] in #​2186
• docs: warn about anchoring RegexpWhitelist patterns by @​lestrrat in #​2187
• autodoc updates by @​github-actions[bot] in #​2188
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2193
• build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​2194
• clear pooled error slice before reuse by @​lestrrat in #​2195
• avoid full-string rune alloc in alg error by @​lestrrat in #​2196
• release json registry lock before decoder call by @​lestrrat in #​2197
• compute cbc-hmac aad bit length in uint64 by @​lestrrat in #​2198
• error on nil curve and oversized d at import by @​lestrrat in #​2199
• error on unavailable thumbprint hash by @​lestrrat in #​2200
• handle nil clock and validator in validate by @​lestrrat in #​2202
• reset private claims on token unmarshal by @​lestrrat in #​2203
• apply jwt settings only when supplied by @​lestrrat in #​2204
• validate use field at jwk parse time by @​lestrrat in #​2205
• document intentional ecdsa high-s acceptance by @​lestrrat in #​2213
• read jwe zip only from protected header by @​lestrrat in #​2206
• enforce aead wire tag and iv length on decrypt by @​lestrrat in #​2207
• require 8-octet minimum pbes2 salt by @​lestrrat in #​2208
• require empty encrypted_key for direct cek by @​lestrrat in #​2209
• error on wrong-length ed25519 key by @​lestrrat in #​2201
• enforce protected alg match in jws verify by @​lestrrat in #​2212
• document intentional lenient base64 in verify by @​lestrrat in #​2214
• reject detached payload when payload present by @​lestrrat in #​2211
• document jwk alg is informational, not validated by @​lestrrat in #​2215
• document symmetric key length not validated by @​lestrrat in #​2216
• document rsa private params not validated by @​lestrrat in #​2217
• note AlgorithmsForKey does not validate key length by @​lestrrat in #​2222
• document okp public key not bound to scalar by @​lestrrat in #​2219
• document Chain.Get returns aliased read-only slice by @​lestrrat in #​2220
• fix WithPedantic doc: typ is not checked by @​lestrrat in #​2221
• document ec private scalar not bound to point by @​lestrrat in #​2218
• extend direct-mode empty key guard to ml-kem by @​lestrrat in #​2223
• add bazel test target for internal/json by @​lestrrat in #​2224
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2227
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2232
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2233
• fix: reject duplicate JOSE headers on fast path by @​lestrrat in #​2236
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2239
• docs: add unreleased Changes entries by @​lestrrat in #​2240
• chore: run jwkfetch in companion test sweep by @​lestrrat in #​2244

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

• ci: print coverage summary in GitHub Actions run summary by @​lestrrat in #​2078
• ci: also run on push to target branches by @​lestrrat in #​2079
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2080
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2082
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2084
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2086
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2088
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2090
• jwt: Settings rejects out-of-range NumericDate precision by @​lestrrat in #​2092
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2093
• jwt: reshape base64-corruption hint as diagnosis-first by @​lestrrat in #​2095
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2098
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2096
• jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @​lestrrat in #​2100
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2101
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2103
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2105
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2107
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2109
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2111
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2113
• jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @​lestrrat in #​2115
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2116
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2118
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2120
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2122
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2124
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2126
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2128
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2130
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2132
• jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @​lestrrat in #​2134
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2136
• jwk: probe tolerates duplicate JSON field names by @​lestrrat in #​2138
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2139
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2141
• jwk: add UnknownKeyTypeError typed error by @​lestrrat in #​2143
• jwk: document AKP-specific Thumbprint canonicalization on public methods by @​lestrrat in #​2144
• docs/jwk: use jwk.WithX509(true) in PEM section prose by @​lestrrat in #​2145
• docs/jwk: document EncodePEM emit-to-PEM path by @​lestrrat in #​2146
• MIGRATION: document PublicSetOf default-reject for symmetric keys by @​lestrrat in #​2147
• jwk: clarify that any value <= 0 disables the RSA strength floor by @​lestrrat in #​2148
• jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @​lestrrat in #​2149
• jwk: correct Import godoc for crypto/ecdh dispatch by @​lestrrat in #​2150
• jwk: surface Export type mismatch as KeyTypeMismatchError by @​lestrrat in #​2151
• jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @​lestrrat in #​2152
• Changes: draft v4.0.2 release notes by @​lestrrat in #​2154

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in #​2041
• autodoc updates by @​github-actions[bot] in #​2042
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in #​2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2051
• autodoc updates by @​github-actions[bot] in #​2053
• docs: document PrivateClaims concurrency contract by @​lestrrat in #​2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in #​2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in #​2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in #​2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2070
• autodoc updates by @​github-actions[bot] in #​2069
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in #​2076

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

v3.3.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2280
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2283
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2287
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2290
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2293
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2301
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2299
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @​dependabot[bot] in #​2306
• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​2316
• build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @​dependabot[bot] in #​2319
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​2321
• [v3] deprecate AlgorithmsForKey, move to internal by @​lestrrat in #​2326
• [v3] add jws.WithStrictECDSA sign option by @​lestrrat in #​2328
• [v3] fix curve inference claim in docs by @​lestrrat in #​2330
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​2332
• add example for bounded WithWaitReady wait by @​lestrrat in #​2343
• show fetch failure cause via error sink by @​lestrrat in #​2344
• [v3] escape JSON object member names on output by @​lestrrat in #​2349

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0

v3.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github.com/lestrrat-go/dsig from 1.2.1 to 1.3.0 by @​dependabot[bot] in #​2043
• build(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @​dependabot[bot] in #​2159
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2174
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2179
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2180
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2184
• bump httprc to v3.0.6 by @​lestrrat in #​2189
• autodoc updates by @​github-actions[bot] in #​2190
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2192
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2226
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2231
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2230
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2238
• build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @​dependabot[bot] in #​2242
• fix misspellings in code comments by @​lestrrat in #​2249
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2254
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2250
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2258
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2261
• bump x/crypto to v0.54.0 in codegen modules by @​lestrrat in #​2266
• [v3] retain unparseable JWK set keys, opt-in by @​lestrrat in #​2265
• [v3] fix per-call reject-dup-kid override by @​lestrrat in #​2270
• [v3] test jwe rejects UnsupportedKey placeholder by @​lestrrat in #​2272
• [v3] doc: recommend retain mode for third-party JWK sets as PQC rolls out by @​lestrrat in #​2274
• fix jwe JSON AAD serialization by @​lestrrat in #​2276
• add JWE authenticated data option by @​lestrrat in #​2278

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.1.1...v3.2.0

v3.1.1

Compare Source

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by @​dependabot[bot] in #​2045
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2050
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2052
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2056
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2058
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2060
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2066
• build(deps): bump pozil/auto-assign-issue from f245a91 to 7bf9d82 by @​dependabot[bot] in #​2065
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2071
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2081
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2083
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2085
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2087
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2089
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2091
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2094
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2099
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2097
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2102
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2104
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2106
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2108
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2110
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2112
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2114
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2117
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2119
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2121
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2123
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2125
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2127
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2129
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2131
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2133
• jwk: wrap ParseKey errors with ParseError sentinel by @​lestrrat in #​2135
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2137
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2140
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2142
• Changes: draft v3.1.1 release notes by @​lestrrat in #​2155

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1

v3.1.0

Compare Source

See Changes file for curated list of changes

What's Changed

• Appease linter by @​lestrrat in #​1543
• Bump kentaro-m/auto-assign-action from 2.0.0 to 2.0.1 by @​dependabot[bot] in #​1538
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in #​1542
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​1536
• Bump actions/cache from 5.0.1 to 5.0.2 by @​dependabot[bot] in #​1539
• Add AGENTS.md by @​lestrrat in #​1546
• exclude AGENTS.md by @​lestrrat in #​1548
• Bump actions/cache from 5.0.2 to 5.0.3 by @​dependabot[bot] in #​1545
• Bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​1535
• Add symlink by @​lestrrat in #​1549
• Fix jwk.Cache worker issues by @​lestrrat in #​1552
• Exclude CLAUDE.md from autodoc by @​lestrrat in #​1555
• Bump github.com/valyala/fastjson from 1.6.7 to 1.6.9 by @​dependabot[bot] in #​1561
• Bump actions/stale from 10.1.1 to 10.2.0 by @​dependabot[bot] in #​1559
• Bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @​dependabot[bot] in #​1557
• Reduce allocations in concatkdf Read by @​lestrrat in #​1562
• Eliminate redundant lock acquisitions in LookupKeyID by @​lestrrat in #​1563
• Replace make+copy with bytes.Clone by @​lestrrat in #​1564
• Use base64.Encode instead of EncodeToString in JWS marshal by @​lestrrat in #​1565
• Cache keyalg/ctalg String() in JWE encrypt/decrypt by @​lestrrat in #​1566
• Inline ndata() in concatkdf New by @​lestrrat in #​1567
• Fix dependabot workflow by @​lestrrat in #​1574
• Bump github.com/valyala/fastjson from 1.6.9 to 1.6.10 by @​dependabot[bot] in #​1568
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.4.0 to 4.4.1 by @​dependabot[bot] in #​1570
• Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /examples by @​dependabot[bot] in #​1571
• Bump actions/setup-go from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​1573
• harden dependabot workflow by @​lestrrat in #​1575
• fix inverted rlocker condition in RSA key export by @​lestrrat in #​1576
• Fix jwe decrypt typo by @​lestrrat in #​1577
• Fix example naming by @​lestrrat in #​1578
• Chore remove unused blank assigns by @​lestrrat in #​1579
• add WhitelistError sentinel, use errors.Is in test by @​lestrrat in #​1581
• standardize error helpers in jws and jwe by @​lestrrat in #​1582
• add fuzz testing infrastructure for jwt/jws/jwe/jwk by @​lestrrat in #​1583
• fix flaky cache and jwt validation tests by @​lestrrat in #​1585
• add .claude/docs and pre-read rules to AGENTS.md by @​lestrrat in #​1584
• Bump golang.org/x/crypto from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​1587
• Bump github.com/emmansun/gmsm from 0.21.5 to 0.41.1 in /examples by @​dependabot[bot] in #​1590
• Bump actions/cache from 5.0.3 to 5.0.4 by @​dependabot[bot] in #​1593
• Bump github.com/goccy/go-json from 0.10.3 to 0.10.6 by @​dependabot[bot] in #​1589
• Bump kentaro-m/auto-assign-action from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​1595
• use standard go deprecation markers in jws by @​lestrrat in #​1596
• fix probe field name in panic message by @​lestrrat in #​1597
• Bump github.com/lestrrat-go/httprc/v3 from 3.0.4 to 3.0.5 by @​dependabot[bot] in #​1599
• Bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​1600
• enforce crit header validation in jws.Verify per RFC 7515 by @​lestrrat in #​1601
• validate crit header in VerifyCompactFast by @​lestrrat in #​1602
• fix X25519 ECDH-ES to include apu/apv in KDF by @​lestrrat in #​1603
• enforce minimum PBES2 iteration count by @​lestrrat in #​1604
• reject null JSON values for string claims (#​1484) by @​lestrrat in #​1605
• add RFC 9864 fully-specified EdDSA signature algorithms by @​lestrrat in #​1606
• add extension APIs and KeyKind dispatch for external algorithm modules by @​lestrrat in #​1607
• add jwkunsafe package docs and tests by @​lestrrat in #​1609
• delegate custom algorithm registration to dsig by @​lestrrat in #​1610
• autodoc updates by @​github-actions[bot] in #​1611
• pin ed448 module to latest jwx by @​lestrrat in #​1612
• move ed448 to external jwx-circl-ed448 repo by @​lestrrat in #​1613
• autodoc updates by @​github-actions[bot] in #​1614
• pin jwx-circl-ed448 to latest commit by @​lestrrat in #​1615
• update Changes for v3.0.14 by @​lestrrat in #​1616
• use jwk.Import fallback in AlgorithmsForKey by @​lestrrat in #​1617
• fix OKP key export dispatch for Ed448 by @​lestrrat in #​1618
• fix misleading Ed448 dispatch comments in jwsbb by @​lestrrat in #​1619
• add RegisterAlgorithmForCurve, filter AlgorithmsForKey by curve by @​lestrrat in #​1620
• pin jwx-circl-ed448 to ce28e4b in examples by @​lestrrat in #​1621
• add WithMaxFetchBodySize to limit Fetch response body by @​lestrrat in #​1622
• add per-call PBES2 count overrides to jwe.Decrypt by @​lestrrat in #​1623
• fix X509CertChain() to return false when chain is nil by @​lestrrat in #​1624
• fix data race in x509 decoder registry iteration by @​lestrrat in #​1625
• add max key count limit to PEM parsing loop by @​lestrrat in #​1626
• reject negative WithAcceptableSkew in jwt.Validate by @​lestrrat in #​1627
• accept year 0000 in OIDC birthdate per spec by @​lestrrat in #​1628
• update Changes for #​1620-#​1628 by @​lestrrat in #​1629
• add max input size limit to jwt/jwe ParseReader by @​lestrrat in #​1630
• add global default for MaxFetchBodySize by @​lestrrat in #​1631
• fix parse size limit race, validation, and jws coverage by @​lestrrat in #​1632
• add max recipients limit for JWE messages by @​lestrrat in #​1633
• add default HTTP timeout for jwk.Fetch by @​lestrrat in #​1634
• document jti replay protection as caller responsibility by @​lestrrat in #​1635
• add max signatures limit for JWS messages by @​lestrrat in #​1636
• add default redirect policy for jwk.Fetch by @​lestrrat in #​1637
• add jwk.DefaultHTTPClient by @​lestrrat in #​1638
• check redirect scheme downgrade at every hop by @​lestrrat in #​1639
• apply default redirect policy to jwk.Cache by @​lestrrat in #​1640
• make null string claim rejection opt-in by @​lestrrat in #​1641
• add jwk.WrapHTTPClientDefaults by @​lestrrat in #​1642
• update Changes for #​1630-#​1640 by @​lestrrat in #​1643
• document WithHTTPClient bypass of defaults by @​lestrrat in #​1646
• use atomic wrappers for global settings by @​lestrrat in #​1647
• reuse shared HTTP client in Cache.Register by @​lestrrat in #​1648
• accept ParseOption in jws.ParseString by @​lestrrat in #​1650
• validate maxSignatures is positive by @​lestrrat in #​1649
• document body size limit approach in jwk.Fetch by @​lestrrat in #​1651
• remove minor entries from Changes by @​lestrrat in #​1653
• make WithStrictStringClaims per-call only by @​lestrrat in #​1654
• add per-call opt-out for crit header validation by @​lestrrat in #​1655
• protect global settings with mutex by @​lestrrat in #​1656
• document WithStrictStringClaims scope to JWT only by @​lestrrat in #​1657
• document WithStrictStringClaims scope includes JWK by @​lestrrat in #​1658
• deep-copy slice fields in generated Set methods by @​lestrrat in #​1659
• zero private key fields on UnmarshalJSON error by @​lestrrat in #​1660
• document x509 validation as out of scope by @​lestrrat in #​1661
• update Changes for #​1659 and #​1660 by @​lestrrat in #​1662
• fix inconsistent mutex locking in data structures by @​lestrrat in #​1666
• replace intermediate map in MarshalJSON with pair+pool by @​lestrrat in #​1667
• validate algorithm-key compatibility in WithKey by @​lestrrat in #​1668
• reduce allocations in JWE encrypt path by @​lestrrat in #​1676
• Bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @​dependabot[bot] in #​1684
• clean up jws sign/verify code for legibility by @​lestrrat in #​1687
• clean up jws sign/verify key selection code by @​lestrrat in #​1689
• fix dependabot workflow for develop/v2 bazel by @​lestrrat in #​1691
• use squash merge in dependabot workflow by @​lestrrat in #​1692
• remove auto-approve and auto-merge from dependabot workflow by @​lestrrat in #​1693
• scrub full backing array in byte slice pool by @​lestrrat in #​1729
• clear fieldPair list before returning to pool by @​lestrrat in #​1732
• rework jws crit header validation by @​lestrrat in #​1733
• add jwe crit header validation by @​lestrrat in #​1735
• clone per-recipient headers, recycle via headerPool by @​lestrrat in #​1739
• reject ecdh keys in AlgorithmsForKey by @​lestrrat in #​1741
• stop pooling escaping big.Int in buildRSAPublicKey by @​lestrrat in #​1745
• auto-declare b64 crit when WithDetachedPayload is set by @​lestrrat in #​1748
• fail loudly on rand.Reader errors in key gen helpers by @​lestrrat in #​1751
• drop big.Int pool by @​lestrrat in #​1754
• fix race in jwk/ecdsa lookup functions by @​lestrrat in #​1756
• clone protected headers in signatureBuilder.Build by @​lestrrat in #​1759
• fix ValidationCtx extractors panicking on uninitialized contexts by @​lestrrat in #​1761
• docs: note ES256K low-S non-enforcement by @​lestrrat in #​1763
• reject empty ciphertext/iv/tag in jwe.Message.UnmarshalJSON by @​lestrrat in #​1768
• drop unprotected header merge from jwe.Decrypt by @​lestrrat in #​1770
• document VerifyCompactFast b64:true assumption by @​lestrrat in #​1773
• pin unprotected header merge fix with regression test by @​lestrrat in #​1776
• validate AES-CBC IV length in aescbc.Hmac.Open by @​lestrrat in #​1778
• reslice pooled jwe buffers before defer by @​lestrrat in #​1781
• reject sub-minimum input in RFC 3394 keywrap primitives by @​lestrrat in #​1784
• add jwe.WithPBES2Count encrypt option by @​lestrrat in #​1782
• jwe: use privkey.Size() for RSA PKCS1v1.5 length check by @​lestrrat in #​1788
• document default InsecureWhitelist on jwk.Fetch (JWK-001) by @​lestrrat in #​1790
• reject crit-bearing messages in jws.VerifyCompactFast by @​lestrrat in #​1793
• jwe: stop aliasing AAD backing slices when concatenating external aad by @​lestrrat in #​1796
• validate ECDSA point on curve (JWK-003) by @​lestrrat in #​1797
• copy recipientKey in KeyDecryptAESGCMKW to avoid caller aliasing (JWE-002) by @​lestrrat in #​1800
• strip key options in jwt.ParseInsecure by @​lestrrat in #​1802
• Bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​1795
• enforce jws signatures cap before decoding entries by @​lestrrat in #​1804
• cap SplitCompactReader non-finite reads at 10 MiB by @​lestrrat in #​1806
• copy rawKey in symmetricKey.Import to avoid caller aliasing by @​lestrrat in #​1808
• enforce max parse input size in jws.Parse and jwe.Parse by @​lestrrat in #​1809
• fix cert.Chain.Add to strip real PEM markers by @​lestrrat in #​1814
• fix jwk x509 decoder unregister index and race by @​lestrrat in #​1812
• fix jwt fast path json injection via unescaped kid by @​lestrrat in #​1817
• fix nil-aware ok return in jws header accessors by @​lestrrat in #​1818
• fix: jwk.PublicSetOf rejects symmetric keys by default (v3.1.0) by @​lestrrat in #​1829
• autodoc updates by @​github-actions[bot] in #​1832
• fix jwk rsa exponent truncation and thumbprint collision by @​lestrrat in #​1833
• fix cert.Chain MarshalJSON and validate Add input by @​lestrrat in #​1836
• fix jwt fast path json injection via unescaped alg by @​lestrrat in #​1838
• track aes-cbc-hmac tag length independently of key size by @​lestrrat in #​1841
• fix jwe aescbc open opaque errors by @​lestrrat in #​1843
• fix jwe keyset selecting keys without alg field by @​lestrrat in #​1845
• fix jwe ecdh-es invalid-curve attack surface by @​lestrrat in #​1847
• fix jwk.Set.AddKey panic on nil or struct keys by @​lestrrat in #​1852
• fix jwk parser to validate keys after unmarshal by @​lestrrat in #​1854
• wrap underlying error in jwk set single-key fallback by @​lestrrat in #​1856
• fix cmd/jwx output file mode and truncation by @​lestrrat in #​1858
• fix jwt.ParseHeader bearer scheme per rfc 6750 by @​lestrrat in #​1859
• make MissingRequiredClaimError.Is type-only by @​lestrrat in #​1862
• document WithUseNumber concurrency contract as startup-only by @​lestrrat in #​1864
• reject key-bearing options in jwt.ParseInsecure by @​lestrrat in #​1867
• bound jws keyset verification fan-out by header alg by @​lestrrat in #​1869
• add jwk.WithForceAssign to overwrite existing kid by @​lestrrat in #​1874
• tighten HeaderGetStringBytes lifetime doc by @​lestrrat in #​1876
• fix jwxio limited reader detection by @​lestrrat in #​1877
• fix jwa error truncation by @​lestrrat in #​1880
• fix jwa registry snapshots by @​lestrrat in #​1883
• tighten jws validateAlgorithmForKey escape by @​lestrrat in #​1887
• fix jws jku kid-miss silent nil by @​lestrrat in #​1888
• surface jku kid-miss error from jkuProvider by @​lestrrat in #​1891
• fix jws VerifyCompactFast header alg cross-check by @​lestrrat in #​1893
• fix okp key length checks by @​lestrrat in #​1896
• fix jwa builtin protection by @​lestrrat in #​1899
• fix v3 rsa jwk validation by @​lestrrat in #​1895
• fix compact sign errors by @​lestrrat in #​1902
• zero bytes.Buffer backing array on pool return by @​lestrrat in #​1905
• remove internal/json.Dump debug helper by @​lestrrat in #​1907
• fix SplitCompactReader LimitedReader size bypass by @​lestrrat in #​1909
• fix jwe godoc references by @​lestrrat in #​1911
• fix v3 jwt package docs by @​lestrrat in #​1915
• fix v3 jwe cek length checks by @​lestrrat in #​1918
• make x5c cert limits configurable by @​lestrrat in #​1919
• document v3 transform.AsMap aliasing by @​lestrrat in #​1920
• fix v3 ecdsa algorithms snapshot by @​lestrrat in #​1923
• fix jwxio limitedreader bounds by @​lestrrat in #​1924
• warn about jws WithKey misuse in v3 by @​lestrrat in #​1930
• fix v3 jws parse autodetect by @​lestrrat in #​1927
• fix empty compact jws signature by @​lestrrat in #​1933
• fix v3 jwe p2c validation by @​lestrrat in #​1935
• fix v3 jwe gcmkw header typing by @​lestrrat in #​1939
• fix v3 jwe aescbc append by @​lestrrat in #​1937
• document jwe compression caveats by @​lestrrat in #​1941
• warn about jwe rsa1_5 by @​lestrrat in #​1943
• document jwe WithKey pairs in v3 by @​lestrrat in #​1945
• fix PublicSetOf oct bypass in v3 by @​lestrrat in #​1946
• docs: warn about short symmetric keys by @​lestrrat in #​1949
• add jws.WithDetachedPayloadReader for streaming detached payloads by @​lestrrat in #​1663
• jws: return non-nil empty []byte from streaming Verify by @​lestrrat in #​1979
• clarify jwe decrypt unprotected-header scope by @​lestrrat in #​1983
• drop raw input-byte caps from parse apis by @​lestrrat in #​1985
• fix ClaimValueIs panic on non-comparable values by @​lestrrat in #​1987
• clarify EncryptStatic CEK for direct-CEK algs by @​lestrrat in #​1990
• jwk: add WithMaxKeys cap on JWKS entries by @​lestrrat in #​1991
• jws: expand WithDetachedPayloadReader encoder-missing error with install hint by @​lestrrat in #​1993
• jws: document goroutine-safety for WithDetachedPayloadReader by @​lestrrat in #​1997
• jws: explain RFC 8032 EdDSA streaming incompatibility in error message by @​lestrrat in #​1995
• jws: align streaming HMAC key-type error with non-streaming path by @​lestrrat in #​2000
• jwe: fix grammar in ECDH-ES/DIRECT multi-recipient error by @​lestrrat in #​2002
• jws: drop double-wrap on compact parse errors by @​lestrrat in #​2004
• jwt: guard Validate against nil token by @​lestrrat in #​2007
• jws: make jkuProvider surface missing-alg error by @​lestrrat in #​2009
• jws: surface per-key selectKey errors in keySetProvider by @​lestrrat in #​2011
• jws: surface use=enc mismatch as explicit error by @​lestrrat in #​2013
• jwt: stop using dynamic fmt.Errorf format string in ParseRequest by @​lestrrat in #​2017
• jws: document kid precedence on WithProtectedHeaders by @​lestrrat in #​2024
• jwk: add WithRejectDuplicateKID parse option by @​lestrrat in #​2027
• jwk: replace misleading RegisterKeyImporter godoc by @​lestrrat in #​2029
• jwt: wrap unsupported-time-claim error as ValidateError by @​lestrrat in #​2015
• changes: add jwk.WithRejectDuplicateKID entry by @​lestrrat in #​2033
• fix v3.1.0 changelog inaccuracies and add missing entries by @​lestrrat in #​2037

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.13...v3.1.0

v3.0.13

Compare Source

What's Changed

• Pass value of WithContext to jws.Verify by @​lestrrat in #​1483
• Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by @​dependabot[bot] in #​1490
• Bump actions/checkout from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​1494
• Bump actions/setup-go from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​1500
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @​dependabot[bot] in #​1499
• Bump golang.org/x/crypto from 0.39.0 to 0.45.0 in /cmd/jwx by @​dependabot[bot] in #​1495
• Bump actions/checkout from 5.0.1 to 6.0.0 by @​dependabot[bot] in #​1504
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /tools/cmd/genoptions by @​dependabot[bot] in #​1502
• Bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by @​dependabot[bot] in #​1506
• Fix document for (jwk.Set).LookupKeyID by @​lestrrat in #​1508
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /tools/cmd/genjwt by @​dependabot[bot] in #​1509
• Bump actions/stale from 10.1.0 to 10.1.1 by @​dependabot[bot] in #​1514
• Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 by @​dependabot[bot] in #​1515
• Bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​1516
• Update httprc by @​lestrrat in #​1518
• Bump actions/cache from 4.3.0 to 5.0.1 by @​dependabot[bot] in #​1525
• Appease linter (v2.7.2) by @​lestrrat in #​1526
• Bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @​dependabot[bot] in #​1520
• Add permissions by @​lestrrat in #​1528
• Bump github.com/valyala/fastjson from 1.6.4 to 1.6.7 by @​dependabot[bot] in #​1524
• Fix Clone() by @​lestrrat in #​1530

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.12...v3.0.13

v3.0.12

Compare Source

What's Changed

• Change go.mod version requirements to go 1.24.0 and introduce toolchain directive by @​henrymcconville in #​1465
• Use go.mod for go version in Bazel module by @​henrymcconville in #​1466
• Enable legacy signers by default, and explicitly populate new signer instances by @​lestrrat in #​1460
• autodoc updates by @​github-actions[bot] in #​1475
• Fix godoclint issues by @​babakks in #​1469
• Bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​1463
• Bump actions/stale from 10.0.0 to 10.1.0 by @​dependabot[bot] in #​1468
• Bump github.com/segmentio/asm from 1.2.0 to 1.2.1 by @​dependabot[bot] in #​1462
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​1472
• Bump golang.org/x/crypto from 0.42.0 to 0.43.0 by @​dependabot[bot] in #​1474
• revive godoclint by @​lestrrat in #​1478
• [jwe] Add option to explicitly clear per-recipient headers ("header") for flattened JSON serialization by @​lestrrat in #​1477
• autodoc updates by @​github-actions[bot] in #​1480

New Contributors

• @​henrymcconville made their first contribution in #​1465
• @​babakks made their first contribution in #​1469

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.11...v3.0.12

v3.0.11

Compare Source

What's Changed

• Bump actions/cache from 4.2.3 to 4.2.4 by @​dependabot[bot] in #​1438
• Bump golang.org/x/crypto from 0.40.0 to 0.41.0 by @​dependabot[bot] in #​1436
• [jwe] Work with non X25519 ECDH encryption by @​lestrrat in #​1442
• Bump actions/checkout from 4.2.2 to 5.0.0 by @​dependabot[bot] in #​1440
• Separate out signature generation / verification into its own framework by @​lestrrat in #​1439
• Bump github.com/lestrrat-go/httprc/v3 from 3.0.0 to 3.0.1 by @​dependabot[bot] in #​1443
• Bump actions/stale from 9.1.0 to 10.0.0 by @​dependabot[bot] in #​1451
• Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by @​dependabot[bot] in #​1447
• Bump golang.org/x/crypto from 0.41.0 to 0.42.0 by @​dependabot[bot] in #​1456
• Bump actions/setup-go from 5.5.0 to 6.0.0 by @​dependabot[bot] in #​1449
• Warh40k fix/connection leak by @​lestrrat in #​1458
• Allow shutting down jwk cache by @​adam-bates in #​1457

New Contributors

• @​adam-bates made their first contribution in #​1457

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.10...v3.0.11

v3.0.10

Compare Source

What's Changed

• Fix header not found error by @​lestrrat in #​1435

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.9...v3.0.10

v3.0.9

Compare Source

What's Changed

• [jwk] Implement X509 related code in jwkbb by @​lestrrat in #​1423
• Tweak error message by @​lestrrat in #​1424
• [jwt] implement distinguishable jwt.Get errors by @​lestrrat in #​1426
• Update bazel to v8 by @​lestrrat in #​1429
• Bump golang.org/x/crypto from 0.39.0 to 0.40.0 by @​dependabot[bot] in #​1428
• Allow HeaderGetXXX() functions to differentiate not found / invalid headers by @​lestrrat in #​1432

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.8...v3.0.9

v3.0.8

Compare Source

What's Changed

• change from interface{} to any by @​lestrrat in #​1417
• autodoc updates by @​github-actions in #​1418
• Introduce jwe lower level API (jwebb), and refactor a bunch of things. by @​lestrrat in #​1419
• [jws/jwsbb] Add io.Reader for source of randomness by @​lestrrat in #​1420
• Add package level doc for jwe by @​lestrrat in #​1421
• Add jwsbb.HeaderParse by @​lestrrat in #​1422

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.7...v3.0.8

v3.0.7

Compare Source

What's Changed

• Update examples by @​lestrrat in #​1412
• autodoc updates by @​github-actions in #​1413
• Add error when signature could not be verified by @​lestrrat in #​1414
• Add Header type for quick and dirty access to JWS headers by @​lestrrat in #​1415
• Refactor jwsbb code by @​lestrrat in #​1416

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.6...v3.0.7

v3.0.6

Compare Source

What's Changed

• Use shared constants for better legibility/greppability by @​lestrrat in #​1398
• Rework pool objects by @​lestrrat in #​1399
• Bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 in /examples by @​dependabot in #​1395
• Add AppendEncode to the interface by @​lestrrat in #​1400
• Upgrade option and blackmagic by @​lestrrat in #​1401
• Add comparison benchmark by @​lestrrat in #​1407
• Implement low-level API for jws, and incorporate it to JWT to achieve massive performance gains by @​lestrrat in #​1408
• autodoc updates by @​github-actions in #​1409
• Rename comparison by @​lestrrat in #​1410

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.5...v3.0.6

v3.0.5

Compare Source

What's Changed

• Revert "Improve performance (#​1391)" by @​lestrrat in #​1397
• v3.0.4 has also been retracted on go.mod

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.4...v3.0.5

v3.0.4

Compare Source

v3.0.3

Compare Source

What's Changed

• Add more context to the errors by @​lestrrat in #​1387
• Update httprc version by @​lestrrat in #​1388

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

• Bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @​dependabot in #​1369
• Bump golang.org/x/crypto from 0.37.0 to 0.38.0 by @​dependabot in #​1372
• Bump actions/setup-go from 5.4.0 to 5.5.0 by @​dependabot in #​1373
• Add .deprecated field to algorithms in anticipation of future deprecations by @​lestrrat in #​1374
• Add .deprecated field to algorithms in anticipation of future deprecations by @​lestrrat in #​1376
• Add doc tweaks to #​1380 by @​lestrrat in #​1383
• autodoc updates by @​github-actions in #​1384
• Use jwk interfaces for each key type rather than concrete types by @​lestrrat in #​1381
• Implement Filter objects for container types by @​lestrrat in #​1377
• autodoc updates by @​github-actions in #​1386
• Implement generic AsMap by @​lestrrat in #​1385

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

• DIRECT mode content encryption
• Using A256CBC_HS512
• With an erroneously created CEK of exactly 32-bytes.

---

• Bump actions/cache from 4.2.1 to 4.2.3 by @​dependabot in #​1336
• Bump actions/checkout from 4.1.7 to 4.2.2 by @​dependabot in #​1337
• Bump actions/setup-go from 5.0.2 to 5.4.0 by @​dependabot in #​1338
• Update 02-jws.md by @​lestrrat in #​1341
• Bump golang.org/x/crypto from 0.36.0 to 0.37.0 by @​dependabot in #​1342
• Add the claim name to error messages produced by ClaimValueIs() by @​jmalloc in #​1347
• Tweak comments generated by genwa under jwa directory by @​lestrrat in #​1348
• autodoc updates by @​github-actions in #​1349
• Disable funcorder by @​lestrrat in #​1351
• Update .golangci.yml by @​lestrrat in #​1353
• Update github.com/lestrrat-go/blackmagic by @​lestrrat in #​1352
• disable dependabot for develop/v1 branch by @​lestrrat in #​1358
• jws: improve performance for SplitCompact/SplitCompactString by @​drakkan in #​1360
• jwe: use strings.Cut in parseCompact by @​drakkan in #​1362
• Update httprc to v3.0.0-beta2 by @​lestrrat in #​1364
• Create SECURITY.md by @​lestrrat in #​1365
• [v3] Explcitly check key sizes before passing to aes.NewCipher by @​lestrrat in #​1367

New Contributors

• @​jmalloc made their first contribution in #​1347

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed

• Add support for RSA-OAEP-384 and RSA-OAEP-512 by @​Hannes-Kunnen in #​1142
• fix: typos by @​maro114510 in #​1145
• Update httprc to v1.0.6 by @​lestrrat in #​1150
• Improve API for checking algorithm characteristics around symmetry by @​lestrrat in #​1151
• Fix typos/mistakes/wording/links in documentation/comments by @​Hannes-Kunnen in #​1152
• Apply changes from #​1156 to v2 by @​lestrrat in #​1158
• Avoid problems on 32-bit systems by @​lestrrat in #​1159
• Update minimum required go version to 1.20 by @​lestrrat in #​1161
• Run CI with minimum go version 1.20 by @​lestrrat in #​1162
• Bump golang.org/x/crypto from 0.24.0 to 0.25.0 by @​dependabot in #​1149
• Deprecate jws.WithHeaders by @​lestrrat in #​1163
• Bump golang.org/x/crypto from 0.25.0 to 0.26.0 by @​dependabot in #​1168
• Fix document of how to parse PEM via CLI by @​kg0r0 in #​1174
• Wrap the errors from functions called within ParseRequest by @​lestrrat in #​1176
• V3 modernize infra by @​lestrrat in #​1180
• autodoc updates by @​github-actions in #​1181
• V3 dependabot by @​lestrrat in #​1184
• Completely rework jwk.Cache using github.com/lestrrat-go/httprc/v3 by @​lestrrat in #​1189
• autodoc updates by @​github-actions in #​1190
• Use import by @​lestrrat in #​1191
• include an extra attribute in the trace log for debugging by @​lestrrat in #​1192
• remove old references and unused files by @​lestrrat in #​1193
• Bump golang.org/x/crypto from 0.26.0 to 0.27.0 by @​dependabot in #​1185
• cleanup docs, options around cache by @​lestrrat in #​1194
• autodoc updates by @​github-actions in #​1195
• fix docs by @​lestrrat in #​1196
• Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @​dependabot in #​1197
• Allow flexible key usage values by @​lestrrat in #​1198
• Remove assert by @​lestrrat in #​1200
• Convert jwa constants to function calls returning objects by @​lestrrat in #​1203
• Mention RegisterKeyUsage by @​lestrrat in #​1201
• autodoc updates by @​github-actions in #​1206
• Change accessors in jwk to return (T, bool) by @​lestrrat in #​1207
• autodoc updates by @​github-actions in #​1211
• Bump golang.org/x/crypto from 0.27.0 to 0.28.0 by @​dependabot in #​1210
• Change JWT accessors from returning T to returning (T, bool) by @​lestrrat in #​1212
• autodoc updates by @​github-actions in #​1213
• update comments to include iat (#​1216) by @​lestrrat in #​1217
• Rename the old WithMaxBufferSize option as previously warned by @​lestrrat in #​1218
• Streamline errors by @​lestrrat in #​1220
• autodoc updates by @​github-actions in #​1221
• allow passing context.Contex to jwe.Decrypt by @​lestrrat in #​1222
• Remove non-applicable comment by @​lestrrat in #​1224
• fix document by @​lestrrat in #​1226
• Remove jws.WithHeaders by @​lestrrat in #​1227
• tweak badge URL by @​lestrrat in #​1228
• Add quid pro quo in README by @​lestrrat in #​1225
• Update serialize.go by @​lestrrat in #​1234
• Lint fix by @​lestrrat in #​1235
• Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @​dependabot in #​1231
• Change random big value to math.MaxInt by @​lestrrat in #​1241
• Bump pozil/auto-assign-issue from 2.0.0 to 2.0.1 by @​dependabot in #​1238
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @​dependabot in #​1245
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @​dependabot in #​1269
• Bump pozil/auto-assign-issue from 2.0.1 to 2.1.2 by @​dependabot in #​1261
• Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by @​dependabot in #​1263
• Bump actions/stale from 9.0.0 to 9.1.0 by @​dependabot in #​1272
• [v3] Fixes to work with go1.24 by @​lestrrat in #​1299
• autodoc updates by @​github-actions in #​1300
• Bump pozil/auto-assign-issue from 2.1.2 to 2.2.0 by @​dependabot in #​1279
• Develop v3 actions cache by @​lestrrat in #​1303
• Bump golangci/golangci-lint-action from 6.2.0 to 6.5.0 by @​dependabot in #​1290
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by @​dependabot in #​1293
• Bump golang.org/x/crypto from 0.32.0 to 0.34.0 by @​dependabot in #​1297
• Bump golang.org/x/crypto from 0.34.0 to 0.35.0 by @​dependabot in #​1307
• jws/jwe: split token into fixed number of parts by @​drakkan in #​1308
• [jwk] Change ecdh importer/exporter by @​lestrrat in #​1315
• Bump golang.org/x/crypto from 0.35.0 to 0.36.0 by @​dependabot in #​1312
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @​dependabot in #​1316
• Change default behavior around truncation of time fields by @​lestrrat in #​1318
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @​dependabot in #​1320
• Tweaks on #​1322 by @​lestrrat in #​1323
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @​dependabot in #​1325
• Implement AWS ALB User Claims parser by @​lestrrat in #​1328
• Add docs for WithBase64Encoder by @​lestrrat in #​1329
• autodoc updates by @​github-actions in #​1330
• avoid internal module by @​lestrrat in #​1331
• Clear key.Precomputed values before testing equality by @​lestrrat in #​1333
• autodoc updates by @​github-actions in #​1332
• autodoc updates by @​github-actions in #​1334

New Contributors

• @​Hannes-Kunnen made their first contribution in #​1142
• @​maro114510 made their first contribution in #​1145
• @​kg0r0 made their first contribution in #​1174
• @​drakkan made their first contribution in #​1308

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v2.1.0...v3.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v2](https://github.com/lestrrat-go/jwx) | `v2.1.7` → `v4.5.0` |  |  | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)</summary> ### [`v4.5.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.5.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.5.0/Changes). #### What's Changed - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2318](https://github.com/lestrrat-go/jwx/pull/2318) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2322](https://github.com/lestrrat-go/jwx/pull/2322) - \[v4] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2325](https://github.com/lestrrat-go/jwx/pull/2325) - \[v4] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2327](https://github.com/lestrrat-go/jwx/pull/2327) - \[v4] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2329](https://github.com/lestrrat-go/jwx/pull/2329) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2333](https://github.com/lestrrat-go/jwx/pull/2333) - fix jwk.ParseKey generic guidance in guide skill by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2335](https://github.com/lestrrat-go/jwx/pull/2335) - fix JWKS algorithm inference claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2336](https://github.com/lestrrat-go/jwx/pull/2336) - document exact alg match rule in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2337](https://github.com/lestrrat-go/jwx/pull/2337) - note RFC 9864 EdDSA deprecation in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2338](https://github.com/lestrrat-go/jwx/pull/2338) - drop nonexistent v3 and v2 plugin pointers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2339](https://github.com/lestrrat-go/jwx/pull/2339) - correct ML-DSA import panic claim in guide by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2340](https://github.com/lestrrat-go/jwx/pull/2340) - add jwxfilter to guide companion table by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2341](https://github.com/lestrrat-go/jwx/pull/2341) - build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2347](https://github.com/lestrrat-go/jwx/pull/2347) - \[v4] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2348](https://github.com/lestrrat-go/jwx/pull/2348) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0> ### [`v4.4.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.4.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.4.0/Changes). #### What's Changed - implement ML-DSA natively on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2309](https://github.com/lestrrat-go/jwx/pull/2309) - use released Go 1.27 in CI by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2308](https://github.com/lestrrat-go/jwx/pull/2308) - move ML-DSA primitives to dsig by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2310](https://github.com/lestrrat-go/jwx/pull/2310) - generate ML-DSA from jwa/objects.yml by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2311](https://github.com/lestrrat-go/jwx/pull/2311) - show both ML-DSA paths in the extensions doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2312](https://github.com/lestrrat-go/jwx/pull/2312) - make GOEXPERIMENT conditional on Go 1.26 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2313](https://github.com/lestrrat-go/jwx/pull/2313) - point ML-DSA doc cache at generated jwa file by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2314](https://github.com/lestrrat-go/jwx/pull/2314) - strip inherited jsonv2 on Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2315](https://github.com/lestrrat-go/jwx/pull/2315) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.3.0...v4.4.0> ### [`v4.3.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.3.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.3.0/Changes). #### What's Changed - jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by [@&#8203;sueun-dev](https://github.com/sueun-dev) in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) - add JWE authenticated data option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2277](https://github.com/lestrrat-go/jwx/pull/2277) - build(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2281](https://github.com/lestrrat-go/jwx/pull/2281) - build(deps): bump github/codeql-action from 4 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2284](https://github.com/lestrrat-go/jwx/pull/2284) - build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2286](https://github.com/lestrrat-go/jwx/pull/2286) - build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2291](https://github.com/lestrrat-go/jwx/pull/2291) - build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2294](https://github.com/lestrrat-go/jwx/pull/2294) - fuzz every package, not just the module root by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2295](https://github.com/lestrrat-go/jwx/pull/2295) - retry a fuzz target that fails with no crasher by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2296](https://github.com/lestrrat-go/jwx/pull/2296) - build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2303](https://github.com/lestrrat-go/jwx/pull/2303) - build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2302](https://github.com/lestrrat-go/jwx/pull/2302) - fix build under Go 1.27 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2304](https://github.com/lestrrat-go/jwx/pull/2304) #### New Contributors - [@&#8203;sueun-dev](https://github.com/sueun-dev) made their first contribution in [#&#8203;2275](https://github.com/lestrrat-go/jwx/pull/2275) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.2.0...v4.3.0> ### [`v4.2.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.2.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.2.0/Changes). #### What's Changed - docs: point jwkcache references to jwkfetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2245](https://github.com/lestrrat-go/jwx/pull/2245) - chore: bump golangci-lint-action to 9.3.0 + sync action versions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2246](https://github.com/lestrrat-go/jwx/pull/2246) - fix misspellings in code comments by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2248](https://github.com/lestrrat-go/jwx/pull/2248) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2256](https://github.com/lestrrat-go/jwx/pull/2256) - build(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2255](https://github.com/lestrrat-go/jwx/pull/2255) - build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2252](https://github.com/lestrrat-go/jwx/pull/2252) - build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2259](https://github.com/lestrrat-go/jwx/pull/2259) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2262](https://github.com/lestrrat-go/jwx/pull/2262) - \[v4] retain unparseable JWKS entries as UnsupportedKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2264](https://github.com/lestrrat-go/jwx/pull/2264) - fix CodeQL autobuild for encoding/json/v2 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2268](https://github.com/lestrrat-go/jwx/pull/2268) - \[v4] let per-call WithRejectDuplicateKID override global by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2269](https://github.com/lestrrat-go/jwx/pull/2269) - \[v4] test jwe rejects UnsupportedKey placeholders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2271](https://github.com/lestrrat-go/jwx/pull/2271) - \[v4] doc: warn that global strict JWK set parsing breaks on PQC keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2273](https://github.com/lestrrat-go/jwx/pull/2273) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.1.0...v4.2.0> ### [`v4.1.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.1.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.1.0/Changes). #### What's Changed - docs: refresh CONTRIBUTING examples link and branch example by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2156](https://github.com/lestrrat-go/jwx/pull/2156) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2157](https://github.com/lestrrat-go/jwx/pull/2157) - add dependabot updates for develop/v4 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2160](https://github.com/lestrrat-go/jwx/pull/2160) - build(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2161](https://github.com/lestrrat-go/jwx/pull/2161) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2162](https://github.com/lestrrat-go/jwx/pull/2162) - build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2163](https://github.com/lestrrat-go/jwx/pull/2163) - docs: drop dead jwt error helper references by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2164](https://github.com/lestrrat-go/jwx/pull/2164) - add claude code plugin and supporting docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2165](https://github.com/lestrrat-go/jwx/pull/2165) - tighten companion-bulk skill rules by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2166](https://github.com/lestrrat-go/jwx/pull/2166) - docs: add claude code skill install instructions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2167](https://github.com/lestrrat-go/jwx/pull/2167) - docs: add DeepWiki badge to README by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2168](https://github.com/lestrrat-go/jwx/pull/2168) - ci: make v4 fuzz workflow actually run by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2169](https://github.com/lestrrat-go/jwx/pull/2169) - ci: rotate companion fuzz cache via per-run key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2170](https://github.com/lestrrat-go/jwx/pull/2170) - docs: explain fuzz template skip-list by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2171](https://github.com/lestrrat-go/jwx/pull/2171) - build(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2175](https://github.com/lestrrat-go/jwx/pull/2175) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2181](https://github.com/lestrrat-go/jwx/pull/2181) - build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2182](https://github.com/lestrrat-go/jwx/pull/2182) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2185](https://github.com/lestrrat-go/jwx/pull/2185) - build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2186](https://github.com/lestrrat-go/jwx/pull/2186) - docs: warn about anchoring RegexpWhitelist patterns by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2187](https://github.com/lestrrat-go/jwx/pull/2187) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2188](https://github.com/lestrrat-go/jwx/pull/2188) - build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2193](https://github.com/lestrrat-go/jwx/pull/2193) - build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2194](https://github.com/lestrrat-go/jwx/pull/2194) - clear pooled error slice before reuse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2195](https://github.com/lestrrat-go/jwx/pull/2195) - avoid full-string rune alloc in alg error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2196](https://github.com/lestrrat-go/jwx/pull/2196) - release json registry lock before decoder call by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2197](https://github.com/lestrrat-go/jwx/pull/2197) - compute cbc-hmac aad bit length in uint64 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2198](https://github.com/lestrrat-go/jwx/pull/2198) - error on nil curve and oversized d at import by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2199](https://github.com/lestrrat-go/jwx/pull/2199) - error on unavailable thumbprint hash by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2200](https://github.com/lestrrat-go/jwx/pull/2200) - handle nil clock and validator in validate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2202](https://github.com/lestrrat-go/jwx/pull/2202) - reset private claims on token unmarshal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2203](https://github.com/lestrrat-go/jwx/pull/2203) - apply jwt settings only when supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2204](https://github.com/lestrrat-go/jwx/pull/2204) - validate use field at jwk parse time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2205](https://github.com/lestrrat-go/jwx/pull/2205) - document intentional ecdsa high-s acceptance by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2213](https://github.com/lestrrat-go/jwx/pull/2213) - read jwe zip only from protected header by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2206](https://github.com/lestrrat-go/jwx/pull/2206) - enforce aead wire tag and iv length on decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2207](https://github.com/lestrrat-go/jwx/pull/2207) - require 8-octet minimum pbes2 salt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2208](https://github.com/lestrrat-go/jwx/pull/2208) - require empty encrypted\_key for direct cek by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2209](https://github.com/lestrrat-go/jwx/pull/2209) - error on wrong-length [`ed25519`](https://github.com/lestrrat-go/jwx/commit/ed25519) key by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2201](https://github.com/lestrrat-go/jwx/pull/2201) - enforce protected alg match in jws verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2212](https://github.com/lestrrat-go/jwx/pull/2212) - document intentional lenient base64 in verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2214](https://github.com/lestrrat-go/jwx/pull/2214) - reject detached payload when payload present by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2211](https://github.com/lestrrat-go/jwx/pull/2211) - document jwk alg is informational, not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2215](https://github.com/lestrrat-go/jwx/pull/2215) - document symmetric key length not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2216](https://github.com/lestrrat-go/jwx/pull/2216) - document rsa private params not validated by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2217](https://github.com/lestrrat-go/jwx/pull/2217) - note AlgorithmsForKey does not validate key length by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2222](https://github.com/lestrrat-go/jwx/pull/2222) - document okp public key not bound to scalar by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2219](https://github.com/lestrrat-go/jwx/pull/2219) - document Chain.Get returns aliased read-only slice by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2220](https://github.com/lestrrat-go/jwx/pull/2220) - fix WithPedantic doc: typ is not checked by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2221](https://github.com/lestrrat-go/jwx/pull/2221) - document ec private scalar not bound to point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2218](https://github.com/lestrrat-go/jwx/pull/2218) - extend direct-mode empty key guard to ml-kem by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2223](https://github.com/lestrrat-go/jwx/pull/2223) - add bazel test target for internal/json by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2224](https://github.com/lestrrat-go/jwx/pull/2224) - build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2227](https://github.com/lestrrat-go/jwx/pull/2227) - build(deps): bump actions/cache from 5.0.5 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2232](https://github.com/lestrrat-go/jwx/pull/2232) - build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2233](https://github.com/lestrrat-go/jwx/pull/2233) - fix: reject duplicate JOSE headers on fast path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2236](https://github.com/lestrrat-go/jwx/pull/2236) - build(deps): bump actions/cache from 6.0.0 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2239](https://github.com/lestrrat-go/jwx/pull/2239) - docs: add unreleased Changes entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2240](https://github.com/lestrrat-go/jwx/pull/2240) - chore: run jwkfetch in companion test sweep by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2244](https://github.com/lestrrat-go/jwx/pull/2244) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0> ### [`v4.0.2`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.2) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.0.2/Changes). #### What's Changed - ci: print coverage summary in GitHub Actions run summary by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2078](https://github.com/lestrrat-go/jwx/pull/2078) - ci: also run on push to target branches by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2079](https://github.com/lestrrat-go/jwx/pull/2079) - jws: refuse "b64" header in VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2080](https://github.com/lestrrat-go/jwx/pull/2080) - jws: VerifyCompactFast refusals match jws.VerifyError() class by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2082](https://github.com/lestrrat-go/jwx/pull/2082) - jws: name loose keySet options in fan-out verify error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2084](https://github.com/lestrrat-go/jwx/pull/2084) - jws: honor RFC 7797 b64=false in Message.MarshalJSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2086](https://github.com/lestrrat-go/jwx/pull/2086) - jws: reject literal-JSON "protected" in general-form JWS by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2088](https://github.com/lestrrat-go/jwx/pull/2088) - jwt: ParseRequest: don't skip form body on chunked transfer by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2090](https://github.com/lestrrat-go/jwx/pull/2090) - jwt: Settings rejects out-of-range NumericDate precision by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2092](https://github.com/lestrrat-go/jwx/pull/2092) - jwt: pedantic mode enforces cty=JWT nested-envelope shape by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2093](https://github.com/lestrrat-go/jwx/pull/2093) - jwt: reshape base64-corruption hint as diagnosis-first by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2095](https://github.com/lestrrat-go/jwx/pull/2095) - jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2098](https://github.com/lestrrat-go/jwx/pull/2098) - jwt: ParseInsecure: parse loop-local payload, not original input by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2096](https://github.com/lestrrat-go/jwx/pull/2096) - jwt: align Validate fast/slow paths to same iat,exp,nbf check order by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2100](https://github.com/lestrrat-go/jwx/pull/2100) - jws: Verify rejects b64=false without "b64" listed in "crit" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2101](https://github.com/lestrrat-go/jwx/pull/2101) - jws: Sign auto-declares "b64" in "crit" when emitting b64=false by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2103](https://github.com/lestrrat-go/jwx/pull/2103) - jws: declare "b64" as typed bool header field by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2105](https://github.com/lestrrat-go/jwx/pull/2105) - jws: reject general-form JWS with top-level "header" sibling of "signatures" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2107](https://github.com/lestrrat-go/jwx/pull/2107) - jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2109](https://github.com/lestrrat-go/jwx/pull/2109) - jws: VerifyMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2111](https://github.com/lestrrat-go/jwx/pull/2111) - jws: cleanup follow-ups from recent review (low-severity batch) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2113](https://github.com/lestrrat-go/jwx/pull/2113) - jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2115](https://github.com/lestrrat-go/jwx/pull/2115) - jwe: DecryptMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2116](https://github.com/lestrrat-go/jwx/pull/2116) - jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2118](https://github.com/lestrrat-go/jwx/pull/2118) - jwe: WithKey validates alg-vs-key shape at option-time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2120](https://github.com/lestrrat-go/jwx/pull/2120) - jwe: compression cap error names "decompressed" payload, the option, and the size by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2122](https://github.com/lestrrat-go/jwx/pull/2122) - jwe: bound joined-error count and drop redundant outer Decrypt prefix by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2124](https://github.com/lestrrat-go/jwx/pull/2124) - jwe: keySetProvider surfaces per-key errors via errors.Join by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2126](https://github.com/lestrrat-go/jwx/pull/2126) - jwe: add WithDisabledKeyAlgorithms global policy hook by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2128](https://github.com/lestrrat-go/jwx/pull/2128) - jwe: document WithMaxDecompressBufferSize behavior at non-positive values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2130](https://github.com/lestrrat-go/jwx/pull/2130) - jwk: stop duplicating JWK fields at JWKS top level on parse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2132](https://github.com/lestrrat-go/jwx/pull/2132) - jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2134](https://github.com/lestrrat-go/jwx/pull/2134) - jwk: stream the keys array with cap-before-allocate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2136](https://github.com/lestrrat-go/jwx/pull/2136) - jwk: probe tolerates duplicate JSON field names by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2138](https://github.com/lestrrat-go/jwx/pull/2138) - jwk: treat nil key from custom KeyParser as continue, not success by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2139](https://github.com/lestrrat-go/jwx/pull/2139) - jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2141](https://github.com/lestrrat-go/jwx/pull/2141) - jwk: add UnknownKeyTypeError typed error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2143](https://github.com/lestrrat-go/jwx/pull/2143) - jwk: document AKP-specific Thumbprint canonicalization on public methods by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2144](https://github.com/lestrrat-go/jwx/pull/2144) - docs/jwk: use jwk.WithX509(true) in PEM section prose by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2145](https://github.com/lestrrat-go/jwx/pull/2145) - docs/jwk: document EncodePEM emit-to-PEM path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2146](https://github.com/lestrrat-go/jwx/pull/2146) - MIGRATION: document PublicSetOf default-reject for symmetric keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2147](https://github.com/lestrrat-go/jwx/pull/2147) - jwk: clarify that any value <= 0 disables the RSA strength floor by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2148](https://github.com/lestrrat-go/jwx/pull/2148) - jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2149](https://github.com/lestrrat-go/jwx/pull/2149) - jwk: correct Import godoc for crypto/ecdh dispatch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2150](https://github.com/lestrrat-go/jwx/pull/2150) - jwk: surface Export type mismatch as KeyTypeMismatchError by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2151](https://github.com/lestrrat-go/jwx/pull/2151) - jwk: RegisterKeyImporter takes KeyImporter, not a typed function by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2152](https://github.com/lestrrat-go/jwx/pull/2152) - Changes: draft v4.0.2 release notes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2154](https://github.com/lestrrat-go/jwx/pull/2154) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2> ### [`v4.0.1`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.1) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1) #### What's Changed - docs: add jwxfilter to extension modules doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2041](https://github.com/lestrrat-go/jwx/pull/2041) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2042](https://github.com/lestrrat-go/jwx/pull/2042) - docs: fix broken v3-to-v4.yaml link in Changes-v4.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2048](https://github.com/lestrrat-go/jwx/pull/2048) - guard ecdsa coordinates against oversized big.Int by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2049](https://github.com/lestrrat-go/jwx/pull/2049) - reject jwe with conflicting alg in protected vs per-recipient by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2051](https://github.com/lestrrat-go/jwx/pull/2051) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2053](https://github.com/lestrrat-go/jwx/pull/2053) - docs: document PrivateClaims concurrency contract by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2055](https://github.com/lestrrat-go/jwx/pull/2055) - fix AddressClaim.MarshalJSON for non-printable bytes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2054](https://github.com/lestrrat-go/jwx/pull/2054) - jwt: only call ParseForm when WithFormKey is supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2057](https://github.com/lestrrat-go/jwx/pull/2057) - jws: jkuProvider rejects fetched keys marked use=enc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2059](https://github.com/lestrrat-go/jwx/pull/2059) - jwk: refuse RegisterKeyImporter for built-in raw key types by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2061](https://github.com/lestrrat-go/jwx/pull/2061) - jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2062](https://github.com/lestrrat-go/jwx/pull/2062) - docs: jwkbb X509 registry is a privileged extension point by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2067](https://github.com/lestrrat-go/jwx/pull/2067) - docs(internals): record Settings unknown-option handling as design intent by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2068](https://github.com/lestrrat-go/jwx/pull/2068) - cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2070](https://github.com/lestrrat-go/jwx/pull/2070) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2069](https://github.com/lestrrat-go/jwx/pull/2069) - fix jwxmigrate install path in MIGRATION.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2076](https://github.com/lestrrat-go/jwx/pull/2076) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.0...v4.0.1> ### [`v4.0.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.3.0...v4.0.0) # Changes v4 has many incompatibilities with v3. To see the full list of differences between v3 and v4, please read the [Changes-v4.md file](./Changes-v4.md). Coding Agents should read [MIGRATION.md](./MIGRATION.md) v4.0.0 - 19 Apr 2026 - Initial v4 release. Major features: - Lighter: Core / Companion module separation. Less dependencies in core. - Faster: Use of generics and other optimizations make v4 2x\~3x faster than before. - Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules. - See Changes-v4.md for a full set of Changes since v3. ### [`v3.3.0`](https://github.com/lestrrat-go/jwx/releases/tag/v3.3.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0) Security fix for GHSA-4cf7-xm37-g63h. Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing `"` could close its own member and add members the application never set. For example, calling `Set` with the name `x":0,"admin` produced a signed token containing `"admin":true`. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. See the Changes file for guidance on screening caller-supplied names. Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix. For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v3.3.0/Changes). #### What's Changed - build(deps): bump actions/stale from 10.4.0 to 11.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2280](https://github.com/lestrrat-go/jwx/pull/2280) - build(deps): bump github/codeql-action from 4 to 4.37.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2283](https://github.com/lestrrat-go/jwx/pull/2283) - build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2287](https://github.com/lestrrat-go/jwx/pull/2287) - build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2290](https://github.com/lestrrat-go/jwx/pull/2290) - build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2293](https://github.com/lestrrat-go/jwx/pull/2293) - build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2301](https://github.com/lestrrat-go/jwx/pull/2301) - build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2299](https://github.com/lestrrat-go/jwx/pull/2299) - build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2306](https://github.com/lestrrat-go/jwx/pull/2306) - build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2316](https://github.com/lestrrat-go/jwx/pull/2316) - build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2319](https://github.com/lestrrat-go/jwx/pull/2319) - build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2321](https://github.com/lestrrat-go/jwx/pull/2321) - \[v3] deprecate AlgorithmsForKey, move to internal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2326](https://github.com/lestrrat-go/jwx/pull/2326) - \[v3] add jws.WithStrictECDSA sign option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2328](https://github.com/lestrrat-go/jwx/pull/2328) - \[v3] fix curve inference claim in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2330](https://github.com/lestrrat-go/jwx/pull/2330) - build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2332](https://github.com/lestrrat-go/jwx/pull/2332) - add example for bounded WithWaitReady wait by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2343](https://github.com/lestrrat-go/jwx/pull/2343) - show fetch failure cause via error sink by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2344](https://github.com/lestrrat-go/jwx/pull/2344) - \[v3] escape JSON object member names on output by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2349](https://github.com/lestrrat-go/jwx/pull/2349) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.2.0...v3.3.0> ### [`v3.2.0`](https://github.com/lestrrat-go/jwx/releases/tag/v3.2.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.1.1...v3.2.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v3.2.0/Changes). #### What's Changed - build(deps): bump github.com/lestrrat-go/dsig from 1.2.1 to 1.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2043](https://github.com/lestrrat-go/jwx/pull/2043) - build(deps): bump golang.org/x/crypto from 0.50.0 to 0.51.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2159](https://github.com/lestrrat-go/jwx/pull/2159) - build(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2174](https://github.com/lestrrat-go/jwx/pull/2174) - build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2179](https://github.com/lestrrat-go/jwx/pull/2179) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2180](https://github.com/lestrrat-go/jwx/pull/2180) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2184](https://github.com/lestrrat-go/jwx/pull/2184) - bump httprc to v3.0.6 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2189](https://github.com/lestrrat-go/jwx/pull/2189) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;2190](https://github.com/lestrrat-go/jwx/pull/2190) - build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2192](https://github.com/lestrrat-go/jwx/pull/2192) - build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2226](https://github.com/lestrrat-go/jwx/pull/2226) - build(deps): bump actions/cache from 5.0.5 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2231](https://github.com/lestrrat-go/jwx/pull/2231) - build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2230](https://github.com/lestrrat-go/jwx/pull/2230) - build(deps): bump actions/cache from 6.0.0 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2238](https://github.com/lestrrat-go/jwx/pull/2238) - build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2242](https://github.com/lestrrat-go/jwx/pull/2242) - fix misspellings in code comments by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2249](https://github.com/lestrrat-go/jwx/pull/2249) - build(deps): bump actions/stale from 10.3.0 to 10.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2254](https://github.com/lestrrat-go/jwx/pull/2254) - build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2250](https://github.com/lestrrat-go/jwx/pull/2250) - build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2258](https://github.com/lestrrat-go/jwx/pull/2258) - build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2261](https://github.com/lestrrat-go/jwx/pull/2261) - bump x/crypto to v0.54.0 in codegen modules by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2266](https://github.com/lestrrat-go/jwx/pull/2266) - \[v3] retain unparseable JWK set keys, opt-in by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2265](https://github.com/lestrrat-go/jwx/pull/2265) - \[v3] fix per-call reject-dup-kid override by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2270](https://github.com/lestrrat-go/jwx/pull/2270) - \[v3] test jwe rejects UnsupportedKey placeholder by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2272](https://github.com/lestrrat-go/jwx/pull/2272) - \[v3] doc: recommend retain mode for third-party JWK sets as PQC rolls out by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2274](https://github.com/lestrrat-go/jwx/pull/2274) - fix jwe JSON AAD serialization by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2276](https://github.com/lestrrat-go/jwx/pull/2276) - add JWE authenticated data option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2278](https://github.com/lestrrat-go/jwx/pull/2278) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.1.1...v3.2.0> ### [`v3.1.1`](https://github.com/lestrrat-go/jwx/releases/tag/v3.1.1) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v3.1.1/Changes). #### What's Changed - build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2045](https://github.com/lestrrat-go/jwx/pull/2045) - guard ecdsa coordinates against oversized big.Int by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2050](https://github.com/lestrrat-go/jwx/pull/2050) - reject jwe with conflicting alg in protected vs per-recipient by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2052](https://github.com/lestrrat-go/jwx/pull/2052) - fix AddressClaim.MarshalJSON for non-printable bytes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2056](https://github.com/lestrrat-go/jwx/pull/2056) - jwt: only call ParseForm when WithFormKey is supplied by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2058](https://github.com/lestrrat-go/jwx/pull/2058) - jws: jkuProvider rejects fetched keys marked use=enc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2060](https://github.com/lestrrat-go/jwx/pull/2060) - jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2066](https://github.com/lestrrat-go/jwx/pull/2066) - build(deps): bump pozil/auto-assign-issue from [`f245a91`](https://github.com/lestrrat-go/jwx/commit/f245a9119ba5cc2fed4aa7b8268d576d40acddf0) to [`7bf9d82`](https://github.com/lestrrat-go/jwx/commit/7bf9d82c77d45976224660b873fc83e60576c5aa) by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;2065](https://github.com/lestrrat-go/jwx/pull/2065) - cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2071](https://github.com/lestrrat-go/jwx/pull/2071) - jws: refuse "b64" header in VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2081](https://github.com/lestrrat-go/jwx/pull/2081) - jws: VerifyCompactFast refusals match jws.VerifyError() class by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2083](https://github.com/lestrrat-go/jwx/pull/2083) - jws: name loose keySet options in fan-out verify error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2085](https://github.com/lestrrat-go/jwx/pull/2085) - jws: honor RFC 7797 b64=false in Message.MarshalJSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2087](https://github.com/lestrrat-go/jwx/pull/2087) - jws: reject literal-JSON "protected" in general-form JWS by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2089](https://github.com/lestrrat-go/jwx/pull/2089) - jwt: ParseRequest: don't skip form body on chunked transfer by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2091](https://github.com/lestrrat-go/jwx/pull/2091) - jwt: pedantic mode enforces cty=JWT nested-envelope shape by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2094](https://github.com/lestrrat-go/jwx/pull/2094) - jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2099](https://github.com/lestrrat-go/jwx/pull/2099) - jwt: ParseInsecure: parse loop-local payload, not original input by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2097](https://github.com/lestrrat-go/jwx/pull/2097) - jws: Verify rejects b64=false without "b64" listed in "crit" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2102](https://github.com/lestrrat-go/jwx/pull/2102) - jws: Sign auto-declares "b64" in "crit" when emitting b64=false by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2104](https://github.com/lestrrat-go/jwx/pull/2104) - jws: declare "b64" as typed bool header field by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2106](https://github.com/lestrrat-go/jwx/pull/2106) - jws: reject general-form JWS with top-level "header" sibling of "signatures" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2108](https://github.com/lestrrat-go/jwx/pull/2108) - jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2110](https://github.com/lestrrat-go/jwx/pull/2110) - jws: VerifyMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2112](https://github.com/lestrrat-go/jwx/pull/2112) - jws: cleanup follow-ups from recent review (low-severity batch) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2114](https://github.com/lestrrat-go/jwx/pull/2114) - jwe: DecryptMessage observes ctx cancellation between loop iterations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2117](https://github.com/lestrrat-go/jwx/pull/2117) - jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2119](https://github.com/lestrrat-go/jwx/pull/2119) - jwe: WithKey validates alg-vs-key shape at option-time by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2121](https://github.com/lestrrat-go/jwx/pull/2121) - jwe: compression cap error names "decompressed" payload, the option, and the size by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2123](https://github.com/lestrrat-go/jwx/pull/2123) - jwe: bound joined-error count and drop redundant outer Decrypt prefix by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2125](https://github.com/lestrrat-go/jwx/pull/2125) - jwe: keySetProvider surfaces per-key errors via errors.Join by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2127](https://github.com/lestrrat-go/jwx/pull/2127) - jwe: add WithDisabledKeyAlgorithms global policy hook by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2129](https://github.com/lestrrat-go/jwx/pull/2129) - jwe: document WithMaxDecompressBufferSize behavior at non-positive values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2131](https://github.com/lestrrat-go/jwx/pull/2131) - jwk: stop duplicating JWK fields at JWKS top level on parse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2133](https://github.com/lestrrat-go/jwx/pull/2133) - jwk: wrap ParseKey errors with ParseError sentinel by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2135](https://github.com/lestrrat-go/jwx/pull/2135) - jwk: stream the keys array with cap-before-allocate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2137](https://github.com/lestrrat-go/jwx/pull/2137) - jwk: treat nil key from custom KeyParser as continue, not success by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2140](https://github.com/lestrrat-go/jwx/pull/2140) - jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2142](https://github.com/lestrrat-go/jwx/pull/2142) - Changes: draft v3.1.1 release notes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2155](https://github.com/lestrrat-go/jwx/pull/2155) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.1.0...v3.1.1> ### [`v3.1.0`](https://github.com/lestrrat-go/jwx/releases/tag/v3.1.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.13...v3.1.0) See Changes file for curated list of changes #### What's Changed - Appease linter by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1543](https://github.com/lestrrat-go/jwx/pull/1543) - Bump kentaro-m/auto-assign-action from 2.0.0 to 2.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1538](https://github.com/lestrrat-go/jwx/pull/1538) - Bump actions/checkout from 6.0.1 to 6.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1542](https://github.com/lestrrat-go/jwx/pull/1542) - Bump actions/setup-go from 6.1.0 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1536](https://github.com/lestrrat-go/jwx/pull/1536) - Bump actions/cache from 5.0.1 to 5.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1539](https://github.com/lestrrat-go/jwx/pull/1539) - Add AGENTS.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1546](https://github.com/lestrrat-go/jwx/pull/1546) - exclude AGENTS.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1548](https://github.com/lestrrat-go/jwx/pull/1548) - Bump actions/cache from 5.0.2 to 5.0.3 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1545](https://github.com/lestrrat-go/jwx/pull/1545) - Bump golang.org/x/crypto from 0.46.0 to 0.47.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1535](https://github.com/lestrrat-go/jwx/pull/1535) - Add symlink by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1549](https://github.com/lestrrat-go/jwx/pull/1549) - Fix jwk.Cache worker issues by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1552](https://github.com/lestrrat-go/jwx/pull/1552) - Exclude CLAUDE.md from autodoc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1555](https://github.com/lestrrat-go/jwx/pull/1555) - Bump github.com/valyala/fastjson from 1.6.7 to 1.6.9 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1561](https://github.com/lestrrat-go/jwx/pull/1561) - Bump actions/stale from 10.1.1 to 10.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1559](https://github.com/lestrrat-go/jwx/pull/1559) - Bump golang.org/x/crypto from 0.47.0 to 0.48.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1557](https://github.com/lestrrat-go/jwx/pull/1557) - Reduce allocations in concatkdf Read by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1562](https://github.com/lestrrat-go/jwx/pull/1562) - Eliminate redundant lock acquisitions in LookupKeyID by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1563](https://github.com/lestrrat-go/jwx/pull/1563) - Replace make+copy with bytes.Clone by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1564](https://github.com/lestrrat-go/jwx/pull/1564) - Use base64.Encode instead of EncodeToString in JWS marshal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1565](https://github.com/lestrrat-go/jwx/pull/1565) - Cache keyalg/ctalg String() in JWE encrypt/decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1566](https://github.com/lestrrat-go/jwx/pull/1566) - Inline ndata() in concatkdf New by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1567](https://github.com/lestrrat-go/jwx/pull/1567) - Fix dependabot workflow by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1574](https://github.com/lestrrat-go/jwx/pull/1574) - Bump github.com/valyala/fastjson from 1.6.9 to 1.6.10 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1568](https://github.com/lestrrat-go/jwx/pull/1568) - Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.4.0 to 4.4.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1570](https://github.com/lestrrat-go/jwx/pull/1570) - Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /examples by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1571](https://github.com/lestrrat-go/jwx/pull/1571) - Bump actions/setup-go from 6.2.0 to 6.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1573](https://github.com/lestrrat-go/jwx/pull/1573) - harden dependabot workflow by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1575](https://github.com/lestrrat-go/jwx/pull/1575) - fix inverted rlocker condition in RSA key export by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1576](https://github.com/lestrrat-go/jwx/pull/1576) - Fix jwe decrypt typo by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1577](https://github.com/lestrrat-go/jwx/pull/1577) - Fix example naming by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1578](https://github.com/lestrrat-go/jwx/pull/1578) - Chore remove unused blank assigns by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1579](https://github.com/lestrrat-go/jwx/pull/1579) - add WhitelistError sentinel, use errors.Is in test by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1581](https://github.com/lestrrat-go/jwx/pull/1581) - standardize error helpers in jws and jwe by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1582](https://github.com/lestrrat-go/jwx/pull/1582) - add fuzz testing infrastructure for jwt/jws/jwe/jwk by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1583](https://github.com/lestrrat-go/jwx/pull/1583) - fix flaky cache and jwt validation tests by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1585](https://github.com/lestrrat-go/jwx/pull/1585) - add .claude/docs and pre-read rules to AGENTS.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1584](https://github.com/lestrrat-go/jwx/pull/1584) - Bump golang.org/x/crypto from 0.48.0 to 0.49.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1587](https://github.com/lestrrat-go/jwx/pull/1587) - Bump github.com/emmansun/gmsm from 0.21.5 to 0.41.1 in /examples by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1590](https://github.com/lestrrat-go/jwx/pull/1590) - Bump actions/cache from 5.0.3 to 5.0.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1593](https://github.com/lestrrat-go/jwx/pull/1593) - Bump github.com/goccy/go-json from 0.10.3 to 0.10.6 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1589](https://github.com/lestrrat-go/jwx/pull/1589) - Bump kentaro-m/auto-assign-action from 2.0.1 to 2.0.2 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1595](https://github.com/lestrrat-go/jwx/pull/1595) - use standard go deprecation markers in jws by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1596](https://github.com/lestrrat-go/jwx/pull/1596) - fix probe field name in panic message by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1597](https://github.com/lestrrat-go/jwx/pull/1597) - Bump github.com/lestrrat-go/httprc/v3 from 3.0.4 to 3.0.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1599](https://github.com/lestrrat-go/jwx/pull/1599) - Bump actions/setup-go from 6.3.0 to 6.4.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1600](https://github.com/lestrrat-go/jwx/pull/1600) - enforce crit header validation in jws.Verify per RFC 7515 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1601](https://github.com/lestrrat-go/jwx/pull/1601) - validate crit header in VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1602](https://github.com/lestrrat-go/jwx/pull/1602) - fix X25519 ECDH-ES to include apu/apv in KDF by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1603](https://github.com/lestrrat-go/jwx/pull/1603) - enforce minimum PBES2 iteration count by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1604](https://github.com/lestrrat-go/jwx/pull/1604) - reject null JSON values for string claims ([#&#8203;1484](https://github.com/lestrrat-go/jwx/issues/1484)) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1605](https://github.com/lestrrat-go/jwx/pull/1605) - add RFC 9864 fully-specified EdDSA signature algorithms by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1606](https://github.com/lestrrat-go/jwx/pull/1606) - add extension APIs and KeyKind dispatch for external algorithm modules by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1607](https://github.com/lestrrat-go/jwx/pull/1607) - add jwkunsafe package docs and tests by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1609](https://github.com/lestrrat-go/jwx/pull/1609) - delegate custom algorithm registration to dsig by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1610](https://github.com/lestrrat-go/jwx/pull/1610) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;1611](https://github.com/lestrrat-go/jwx/pull/1611) - pin ed448 module to latest jwx by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1612](https://github.com/lestrrat-go/jwx/pull/1612) - move ed448 to external jwx-circl-ed448 repo by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1613](https://github.com/lestrrat-go/jwx/pull/1613) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;1614](https://github.com/lestrrat-go/jwx/pull/1614) - pin jwx-circl-ed448 to latest commit by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1615](https://github.com/lestrrat-go/jwx/pull/1615) - update Changes for v3.0.14 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1616](https://github.com/lestrrat-go/jwx/pull/1616) - use jwk.Import fallback in AlgorithmsForKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1617](https://github.com/lestrrat-go/jwx/pull/1617) - fix OKP key export dispatch for Ed448 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1618](https://github.com/lestrrat-go/jwx/pull/1618) - fix misleading Ed448 dispatch comments in jwsbb by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1619](https://github.com/lestrrat-go/jwx/pull/1619) - add RegisterAlgorithmForCurve, filter AlgorithmsForKey by curve by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1620](https://github.com/lestrrat-go/jwx/pull/1620) - pin jwx-circl-ed448 to [`ce28e4b`](https://github.com/lestrrat-go/jwx/commit/ce28e4bb) in examples by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1621](https://github.com/lestrrat-go/jwx/pull/1621) - add WithMaxFetchBodySize to limit Fetch response body by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1622](https://github.com/lestrrat-go/jwx/pull/1622) - add per-call PBES2 count overrides to jwe.Decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1623](https://github.com/lestrrat-go/jwx/pull/1623) - fix X509CertChain() to return false when chain is nil by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1624](https://github.com/lestrrat-go/jwx/pull/1624) - fix data race in x509 decoder registry iteration by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1625](https://github.com/lestrrat-go/jwx/pull/1625) - add max key count limit to PEM parsing loop by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1626](https://github.com/lestrrat-go/jwx/pull/1626) - reject negative WithAcceptableSkew in jwt.Validate by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1627](https://github.com/lestrrat-go/jwx/pull/1627) - accept year 0000 in OIDC birthdate per spec by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1628](https://github.com/lestrrat-go/jwx/pull/1628) - update Changes for [#&#8203;1620](https://github.com/lestrrat-go/jwx/issues/1620)-[#&#8203;1628](https://github.com/lestrrat-go/jwx/issues/1628) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1629](https://github.com/lestrrat-go/jwx/pull/1629) - add max input size limit to jwt/jwe ParseReader by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1630](https://github.com/lestrrat-go/jwx/pull/1630) - add global default for MaxFetchBodySize by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1631](https://github.com/lestrrat-go/jwx/pull/1631) - fix parse size limit race, validation, and jws coverage by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1632](https://github.com/lestrrat-go/jwx/pull/1632) - add max recipients limit for JWE messages by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1633](https://github.com/lestrrat-go/jwx/pull/1633) - add default HTTP timeout for jwk.Fetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1634](https://github.com/lestrrat-go/jwx/pull/1634) - document jti replay protection as caller responsibility by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1635](https://github.com/lestrrat-go/jwx/pull/1635) - add max signatures limit for JWS messages by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1636](https://github.com/lestrrat-go/jwx/pull/1636) - add default redirect policy for jwk.Fetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1637](https://github.com/lestrrat-go/jwx/pull/1637) - add jwk.DefaultHTTPClient by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1638](https://github.com/lestrrat-go/jwx/pull/1638) - check redirect scheme downgrade at every hop by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1639](https://github.com/lestrrat-go/jwx/pull/1639) - apply default redirect policy to jwk.Cache by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1640](https://github.com/lestrrat-go/jwx/pull/1640) - make null string claim rejection opt-in by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1641](https://github.com/lestrrat-go/jwx/pull/1641) - add jwk.WrapHTTPClientDefaults by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1642](https://github.com/lestrrat-go/jwx/pull/1642) - update Changes for [#&#8203;1630](https://github.com/lestrrat-go/jwx/issues/1630)-[#&#8203;1640](https://github.com/lestrrat-go/jwx/issues/1640) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1643](https://github.com/lestrrat-go/jwx/pull/1643) - document WithHTTPClient bypass of defaults by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1646](https://github.com/lestrrat-go/jwx/pull/1646) - use atomic wrappers for global settings by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1647](https://github.com/lestrrat-go/jwx/pull/1647) - reuse shared HTTP client in Cache.Register by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1648](https://github.com/lestrrat-go/jwx/pull/1648) - accept ParseOption in jws.ParseString by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1650](https://github.com/lestrrat-go/jwx/pull/1650) - validate maxSignatures is positive by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1649](https://github.com/lestrrat-go/jwx/pull/1649) - document body size limit approach in jwk.Fetch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1651](https://github.com/lestrrat-go/jwx/pull/1651) - remove minor entries from Changes by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1653](https://github.com/lestrrat-go/jwx/pull/1653) - make WithStrictStringClaims per-call only by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1654](https://github.com/lestrrat-go/jwx/pull/1654) - add per-call opt-out for crit header validation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1655](https://github.com/lestrrat-go/jwx/pull/1655) - protect global settings with mutex by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1656](https://github.com/lestrrat-go/jwx/pull/1656) - document WithStrictStringClaims scope to JWT only by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1657](https://github.com/lestrrat-go/jwx/pull/1657) - document WithStrictStringClaims scope includes JWK by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1658](https://github.com/lestrrat-go/jwx/pull/1658) - deep-copy slice fields in generated Set methods by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1659](https://github.com/lestrrat-go/jwx/pull/1659) - zero private key fields on UnmarshalJSON error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1660](https://github.com/lestrrat-go/jwx/pull/1660) - document x509 validation as out of scope by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1661](https://github.com/lestrrat-go/jwx/pull/1661) - update Changes for [#&#8203;1659](https://github.com/lestrrat-go/jwx/issues/1659) and [#&#8203;1660](https://github.com/lestrrat-go/jwx/issues/1660) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1662](https://github.com/lestrrat-go/jwx/pull/1662) - fix inconsistent mutex locking in data structures by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1666](https://github.com/lestrrat-go/jwx/pull/1666) - replace intermediate map in MarshalJSON with pair+pool by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1667](https://github.com/lestrrat-go/jwx/pull/1667) - validate algorithm-key compatibility in WithKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1668](https://github.com/lestrrat-go/jwx/pull/1668) - reduce allocations in JWE encrypt path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1676](https://github.com/lestrrat-go/jwx/pull/1676) - Bump golang.org/x/crypto from 0.49.0 to 0.50.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1684](https://github.com/lestrrat-go/jwx/pull/1684) - clean up jws sign/verify code for legibility by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1687](https://github.com/lestrrat-go/jwx/pull/1687) - clean up jws sign/verify key selection code by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1689](https://github.com/lestrrat-go/jwx/pull/1689) - fix dependabot workflow for develop/v2 bazel by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1691](https://github.com/lestrrat-go/jwx/pull/1691) - use squash merge in dependabot workflow by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1692](https://github.com/lestrrat-go/jwx/pull/1692) - remove auto-approve and auto-merge from dependabot workflow by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1693](https://github.com/lestrrat-go/jwx/pull/1693) - scrub full backing array in byte slice pool by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1729](https://github.com/lestrrat-go/jwx/pull/1729) - clear fieldPair list before returning to pool by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1732](https://github.com/lestrrat-go/jwx/pull/1732) - rework jws crit header validation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1733](https://github.com/lestrrat-go/jwx/pull/1733) - add jwe crit header validation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1735](https://github.com/lestrrat-go/jwx/pull/1735) - clone per-recipient headers, recycle via headerPool by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1739](https://github.com/lestrrat-go/jwx/pull/1739) - reject ecdh keys in AlgorithmsForKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1741](https://github.com/lestrrat-go/jwx/pull/1741) - stop pooling escaping big.Int in buildRSAPublicKey by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1745](https://github.com/lestrrat-go/jwx/pull/1745) - auto-declare b64 crit when WithDetachedPayload is set by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1748](https://github.com/lestrrat-go/jwx/pull/1748) - fail loudly on rand.Reader errors in key gen helpers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1751](https://github.com/lestrrat-go/jwx/pull/1751) - drop big.Int pool by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1754](https://github.com/lestrrat-go/jwx/pull/1754) - fix race in jwk/ecdsa lookup functions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1756](https://github.com/lestrrat-go/jwx/pull/1756) - clone protected headers in signatureBuilder.Build by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1759](https://github.com/lestrrat-go/jwx/pull/1759) - fix ValidationCtx extractors panicking on uninitialized contexts by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1761](https://github.com/lestrrat-go/jwx/pull/1761) - docs: note ES256K low-S non-enforcement by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1763](https://github.com/lestrrat-go/jwx/pull/1763) - reject empty ciphertext/iv/tag in jwe.Message.UnmarshalJSON by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1768](https://github.com/lestrrat-go/jwx/pull/1768) - drop unprotected header merge from jwe.Decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1770](https://github.com/lestrrat-go/jwx/pull/1770) - document VerifyCompactFast b64:true assumption by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1773](https://github.com/lestrrat-go/jwx/pull/1773) - pin unprotected header merge fix with regression test by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1776](https://github.com/lestrrat-go/jwx/pull/1776) - validate AES-CBC IV length in aescbc.Hmac.Open by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1778](https://github.com/lestrrat-go/jwx/pull/1778) - reslice pooled jwe buffers before defer by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1781](https://github.com/lestrrat-go/jwx/pull/1781) - reject sub-minimum input in RFC 3394 keywrap primitives by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1784](https://github.com/lestrrat-go/jwx/pull/1784) - add jwe.WithPBES2Count encrypt option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1782](https://github.com/lestrrat-go/jwx/pull/1782) - jwe: use privkey.Size() for RSA PKCS1v1.5 length check by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1788](https://github.com/lestrrat-go/jwx/pull/1788) - document default InsecureWhitelist on jwk.Fetch (JWK-001) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1790](https://github.com/lestrrat-go/jwx/pull/1790) - reject crit-bearing messages in jws.VerifyCompactFast by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1793](https://github.com/lestrrat-go/jwx/pull/1793) - jwe: stop aliasing AAD backing slices when concatenating external aad by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1796](https://github.com/lestrrat-go/jwx/pull/1796) - validate ECDSA point on curve (JWK-003) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1797](https://github.com/lestrrat-go/jwx/pull/1797) - copy recipientKey in KeyDecryptAESGCMKW to avoid caller aliasing (JWE-002) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1800](https://github.com/lestrrat-go/jwx/pull/1800) - strip key options in jwt.ParseInsecure by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1802](https://github.com/lestrrat-go/jwx/pull/1802) - Bump actions/cache from 5.0.4 to 5.0.5 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1795](https://github.com/lestrrat-go/jwx/pull/1795) - enforce jws signatures cap before decoding entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1804](https://github.com/lestrrat-go/jwx/pull/1804) - cap SplitCompactReader non-finite reads at 10 MiB by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1806](https://github.com/lestrrat-go/jwx/pull/1806) - copy rawKey in symmetricKey.Import to avoid caller aliasing by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1808](https://github.com/lestrrat-go/jwx/pull/1808) - enforce max parse input size in jws.Parse and jwe.Parse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1809](https://github.com/lestrrat-go/jwx/pull/1809) - fix cert.Chain.Add to strip real PEM markers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1814](https://github.com/lestrrat-go/jwx/pull/1814) - fix jwk x509 decoder unregister index and race by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1812](https://github.com/lestrrat-go/jwx/pull/1812) - fix jwt fast path json injection via unescaped kid by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1817](https://github.com/lestrrat-go/jwx/pull/1817) - fix nil-aware ok return in jws header accessors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1818](https://github.com/lestrrat-go/jwx/pull/1818) - fix: jwk.PublicSetOf rejects symmetric keys by default (v3.1.0) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1829](https://github.com/lestrrat-go/jwx/pull/1829) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;1832](https://github.com/lestrrat-go/jwx/pull/1832) - fix jwk rsa exponent truncation and thumbprint collision by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1833](https://github.com/lestrrat-go/jwx/pull/1833) - fix cert.Chain MarshalJSON and validate Add input by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1836](https://github.com/lestrrat-go/jwx/pull/1836) - fix jwt fast path json injection via unescaped alg by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1838](https://github.com/lestrrat-go/jwx/pull/1838) - track aes-cbc-hmac tag length independently of key size by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1841](https://github.com/lestrrat-go/jwx/pull/1841) - fix jwe aescbc open opaque errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1843](https://github.com/lestrrat-go/jwx/pull/1843) - fix jwe keyset selecting keys without alg field by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1845](https://github.com/lestrrat-go/jwx/pull/1845) - fix jwe ecdh-es invalid-curve attack surface by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1847](https://github.com/lestrrat-go/jwx/pull/1847) - fix jwk.Set.AddKey panic on nil or struct keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1852](https://github.com/lestrrat-go/jwx/pull/1852) - fix jwk parser to validate keys after unmarshal by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1854](https://github.com/lestrrat-go/jwx/pull/1854) - wrap underlying error in jwk set single-key fallback by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1856](https://github.com/lestrrat-go/jwx/pull/1856) - fix cmd/jwx output file mode and truncation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1858](https://github.com/lestrrat-go/jwx/pull/1858) - fix jwt.ParseHeader bearer scheme per rfc 6750 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1859](https://github.com/lestrrat-go/jwx/pull/1859) - make MissingRequiredClaimError.Is type-only by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1862](https://github.com/lestrrat-go/jwx/pull/1862) - document WithUseNumber concurrency contract as startup-only by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1864](https://github.com/lestrrat-go/jwx/pull/1864) - reject key-bearing options in jwt.ParseInsecure by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1867](https://github.com/lestrrat-go/jwx/pull/1867) - bound jws keyset verification fan-out by header alg by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1869](https://github.com/lestrrat-go/jwx/pull/1869) - add jwk.WithForceAssign to overwrite existing kid by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1874](https://github.com/lestrrat-go/jwx/pull/1874) - tighten HeaderGetStringBytes lifetime doc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1876](https://github.com/lestrrat-go/jwx/pull/1876) - fix jwxio limited reader detection by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1877](https://github.com/lestrrat-go/jwx/pull/1877) - fix jwa error truncation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1880](https://github.com/lestrrat-go/jwx/pull/1880) - fix jwa registry snapshots by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1883](https://github.com/lestrrat-go/jwx/pull/1883) - tighten jws validateAlgorithmForKey escape by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1887](https://github.com/lestrrat-go/jwx/pull/1887) - fix jws jku kid-miss silent nil by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1888](https://github.com/lestrrat-go/jwx/pull/1888) - surface jku kid-miss error from jkuProvider by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1891](https://github.com/lestrrat-go/jwx/pull/1891) - fix jws VerifyCompactFast header alg cross-check by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1893](https://github.com/lestrrat-go/jwx/pull/1893) - fix okp key length checks by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1896](https://github.com/lestrrat-go/jwx/pull/1896) - fix jwa builtin protection by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1899](https://github.com/lestrrat-go/jwx/pull/1899) - fix v3 rsa jwk validation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1895](https://github.com/lestrrat-go/jwx/pull/1895) - fix compact sign errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1902](https://github.com/lestrrat-go/jwx/pull/1902) - zero bytes.Buffer backing array on pool return by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1905](https://github.com/lestrrat-go/jwx/pull/1905) - remove internal/json.Dump debug helper by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1907](https://github.com/lestrrat-go/jwx/pull/1907) - fix SplitCompactReader LimitedReader size bypass by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1909](https://github.com/lestrrat-go/jwx/pull/1909) - fix jwe godoc references by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1911](https://github.com/lestrrat-go/jwx/pull/1911) - fix v3 jwt package docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1915](https://github.com/lestrrat-go/jwx/pull/1915) - fix v3 jwe cek length checks by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1918](https://github.com/lestrrat-go/jwx/pull/1918) - make x5c cert limits configurable by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1919](https://github.com/lestrrat-go/jwx/pull/1919) - document v3 transform.AsMap aliasing by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1920](https://github.com/lestrrat-go/jwx/pull/1920) - fix v3 ecdsa algorithms snapshot by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1923](https://github.com/lestrrat-go/jwx/pull/1923) - fix jwxio limitedreader bounds by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1924](https://github.com/lestrrat-go/jwx/pull/1924) - warn about jws WithKey misuse in v3 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1930](https://github.com/lestrrat-go/jwx/pull/1930) - fix v3 jws parse autodetect by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1927](https://github.com/lestrrat-go/jwx/pull/1927) - fix empty compact jws signature by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1933](https://github.com/lestrrat-go/jwx/pull/1933) - fix v3 jwe p2c validation by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1935](https://github.com/lestrrat-go/jwx/pull/1935) - fix v3 jwe gcmkw header typing by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1939](https://github.com/lestrrat-go/jwx/pull/1939) - fix v3 jwe aescbc append by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1937](https://github.com/lestrrat-go/jwx/pull/1937) - document jwe compression caveats by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1941](https://github.com/lestrrat-go/jwx/pull/1941) - warn about jwe rsa1\_5 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1943](https://github.com/lestrrat-go/jwx/pull/1943) - document jwe WithKey pairs in v3 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1945](https://github.com/lestrrat-go/jwx/pull/1945) - fix PublicSetOf oct bypass in v3 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1946](https://github.com/lestrrat-go/jwx/pull/1946) - docs: warn about short symmetric keys by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1949](https://github.com/lestrrat-go/jwx/pull/1949) - add jws.WithDetachedPayloadReader for streaming detached payloads by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1663](https://github.com/lestrrat-go/jwx/pull/1663) - jws: return non-nil empty \[]byte from streaming Verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1979](https://github.com/lestrrat-go/jwx/pull/1979) - clarify jwe decrypt unprotected-header scope by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1983](https://github.com/lestrrat-go/jwx/pull/1983) - drop raw input-byte caps from parse apis by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1985](https://github.com/lestrrat-go/jwx/pull/1985) - fix ClaimValueIs panic on non-comparable values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1987](https://github.com/lestrrat-go/jwx/pull/1987) - clarify EncryptStatic CEK for direct-CEK algs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1990](https://github.com/lestrrat-go/jwx/pull/1990) - jwk: add WithMaxKeys cap on JWKS entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1991](https://github.com/lestrrat-go/jwx/pull/1991) - jws: expand WithDetachedPayloadReader encoder-missing error with install hint by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1993](https://github.com/lestrrat-go/jwx/pull/1993) - jws: document goroutine-safety for WithDetachedPayloadReader by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1997](https://github.com/lestrrat-go/jwx/pull/1997) - jws: explain RFC 8032 EdDSA streaming incompatibility in error message by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1995](https://github.com/lestrrat-go/jwx/pull/1995) - jws: align streaming HMAC key-type error with non-streaming path by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2000](https://github.com/lestrrat-go/jwx/pull/2000) - jwe: fix grammar in ECDH-ES/DIRECT multi-recipient error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2002](https://github.com/lestrrat-go/jwx/pull/2002) - jws: drop double-wrap on compact parse errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2004](https://github.com/lestrrat-go/jwx/pull/2004) - jwt: guard Validate against nil token by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2007](https://github.com/lestrrat-go/jwx/pull/2007) - jws: make jkuProvider surface missing-alg error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2009](https://github.com/lestrrat-go/jwx/pull/2009) - jws: surface per-key selectKey errors in keySetProvider by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2011](https://github.com/lestrrat-go/jwx/pull/2011) - jws: surface use=enc mismatch as explicit error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2013](https://github.com/lestrrat-go/jwx/pull/2013) - jwt: stop using dynamic fmt.Errorf format string in ParseRequest by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2017](https://github.com/lestrrat-go/jwx/pull/2017) - jws: document kid precedence on WithProtectedHeaders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2024](https://github.com/lestrrat-go/jwx/pull/2024) - jwk: add WithRejectDuplicateKID parse option by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2027](https://github.com/lestrrat-go/jwx/pull/2027) - jwk: replace misleading RegisterKeyImporter godoc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2029](https://github.com/lestrrat-go/jwx/pull/2029) - jwt: wrap unsupported-time-claim error as ValidateError by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2015](https://github.com/lestrrat-go/jwx/pull/2015) - changes: add jwk.WithRejectDuplicateKID entry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2033](https://github.com/lestrrat-go/jwx/pull/2033) - fix v3.1.0 changelog inaccuracies and add missing entries by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;2037](https://github.com/lestrrat-go/jwx/pull/2037) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.13...v3.1.0> ### [`v3.0.13`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.13) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.12...v3.0.13) #### What's Changed - Pass value of WithContext to jws.Verify by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1483](https://github.com/lestrrat-go/jwx/pull/1483) - Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1490](https://github.com/lestrrat-go/jwx/pull/1490) - Bump actions/checkout from 5.0.0 to 5.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1494](https://github.com/lestrrat-go/jwx/pull/1494) - Bump actions/setup-go from 6.0.0 to 6.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1500](https://github.com/lestrrat-go/jwx/pull/1500) - Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1499](https://github.com/lestrrat-go/jwx/pull/1499) - Bump golang.org/x/crypto from 0.39.0 to 0.45.0 in /cmd/jwx by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1495](https://github.com/lestrrat-go/jwx/pull/1495) - Bump actions/checkout from 5.0.1 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1504](https://github.com/lestrrat-go/jwx/pull/1504) - Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /tools/cmd/genoptions by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1502](https://github.com/lestrrat-go/jwx/pull/1502) - Bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1506](https://github.com/lestrrat-go/jwx/pull/1506) - Fix document for (jwk.Set).LookupKeyID by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1508](https://github.com/lestrrat-go/jwx/pull/1508) - Bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /tools/cmd/genjwt by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1509](https://github.com/lestrrat-go/jwx/pull/1509) - Bump actions/stale from 10.1.0 to 10.1.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1514](https://github.com/lestrrat-go/jwx/pull/1514) - Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1515](https://github.com/lestrrat-go/jwx/pull/1515) - Bump actions/checkout from 6.0.0 to 6.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1516](https://github.com/lestrrat-go/jwx/pull/1516) - Update httprc by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1518](https://github.com/lestrrat-go/jwx/pull/1518) - Bump actions/cache from 4.3.0 to 5.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1525](https://github.com/lestrrat-go/jwx/pull/1525) - Appease linter (v2.7.2) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1526](https://github.com/lestrrat-go/jwx/pull/1526) - Bump golang.org/x/crypto from 0.45.0 to 0.46.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1520](https://github.com/lestrrat-go/jwx/pull/1520) - Add permissions by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1528](https://github.com/lestrrat-go/jwx/pull/1528) - Bump github.com/valyala/fastjson from 1.6.4 to 1.6.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1524](https://github.com/lestrrat-go/jwx/pull/1524) - Fix Clone() by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1530](https://github.com/lestrrat-go/jwx/pull/1530) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.12...v3.0.13> ### [`v3.0.12`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.12) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.11...v3.0.12) #### What's Changed - Change go.mod version requirements to go 1.24.0 and introduce toolchain directive by [@&#8203;henrymcconville](https://github.com/henrymcconville) in [#&#8203;1465](https://github.com/lestrrat-go/jwx/pull/1465) - Use go.mod for go version in Bazel module by [@&#8203;henrymcconville](https://github.com/henrymcconville) in [#&#8203;1466](https://github.com/lestrrat-go/jwx/pull/1466) - Enable legacy signers by default, and explicitly populate new signer instances by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1460](https://github.com/lestrrat-go/jwx/pull/1460) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;1475](https://github.com/lestrrat-go/jwx/pull/1475) - Fix `godoclint` issues by [@&#8203;babakks](https://github.com/babakks) in [#&#8203;1469](https://github.com/lestrrat-go/jwx/pull/1469) - Bump actions/cache from 4.2.4 to 4.3.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1463](https://github.com/lestrrat-go/jwx/pull/1463) - Bump actions/stale from 10.0.0 to 10.1.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1468](https://github.com/lestrrat-go/jwx/pull/1468) - Bump github.com/segmentio/asm from 1.2.0 to 1.2.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1462](https://github.com/lestrrat-go/jwx/pull/1462) - Bump github/codeql-action from 3 to 4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1472](https://github.com/lestrrat-go/jwx/pull/1472) - Bump golang.org/x/crypto from 0.42.0 to 0.43.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1474](https://github.com/lestrrat-go/jwx/pull/1474) - revive godoclint by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1478](https://github.com/lestrrat-go/jwx/pull/1478) - \[jwe] Add option to explicitly clear per-recipient headers (`"header"`) for flattened JSON serialization by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1477](https://github.com/lestrrat-go/jwx/pull/1477) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions)\[bot] in [#&#8203;1480](https://github.com/lestrrat-go/jwx/pull/1480) #### New Contributors - [@&#8203;henrymcconville](https://github.com/henrymcconville) made their first contribution in [#&#8203;1465](https://github.com/lestrrat-go/jwx/pull/1465) - [@&#8203;babakks](https://github.com/babakks) made their first contribution in [#&#8203;1469](https://github.com/lestrrat-go/jwx/pull/1469) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.11...v3.0.12> ### [`v3.0.11`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.11) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.10...v3.0.11) #### What's Changed - Bump actions/cache from 4.2.3 to 4.2.4 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1438](https://github.com/lestrrat-go/jwx/pull/1438) - Bump golang.org/x/crypto from 0.40.0 to 0.41.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1436](https://github.com/lestrrat-go/jwx/pull/1436) - \[jwe] Work with non X25519 ECDH encryption by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1442](https://github.com/lestrrat-go/jwx/pull/1442) - Bump actions/checkout from 4.2.2 to 5.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1440](https://github.com/lestrrat-go/jwx/pull/1440) - Separate out signature generation / verification into its own framework by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1439](https://github.com/lestrrat-go/jwx/pull/1439) - Bump github.com/lestrrat-go/httprc/v3 from 3.0.0 to 3.0.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1443](https://github.com/lestrrat-go/jwx/pull/1443) - Bump actions/stale from 9.1.0 to 10.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1451](https://github.com/lestrrat-go/jwx/pull/1451) - Bump github.com/stretchr/testify from 1.10.0 to 1.11.1 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1447](https://github.com/lestrrat-go/jwx/pull/1447) - Bump golang.org/x/crypto from 0.41.0 to 0.42.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1456](https://github.com/lestrrat-go/jwx/pull/1456) - Bump actions/setup-go from 5.5.0 to 6.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1449](https://github.com/lestrrat-go/jwx/pull/1449) - Warh40k fix/connection leak by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1458](https://github.com/lestrrat-go/jwx/pull/1458) - Allow shutting down jwk cache by [@&#8203;adam-bates](https://github.com/adam-bates) in [#&#8203;1457](https://github.com/lestrrat-go/jwx/pull/1457) #### New Contributors - [@&#8203;adam-bates](https://github.com/adam-bates) made their first contribution in [#&#8203;1457](https://github.com/lestrrat-go/jwx/pull/1457) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.10...v3.0.11> ### [`v3.0.10`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.10) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.9...v3.0.10) #### What's Changed - Fix header not found error by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1435](https://github.com/lestrrat-go/jwx/pull/1435) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.9...v3.0.10> ### [`v3.0.9`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.9) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.8...v3.0.9) #### What's Changed - \[jwk] Implement X509 related code in jwkbb by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1423](https://github.com/lestrrat-go/jwx/pull/1423) - Tweak error message by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1424](https://github.com/lestrrat-go/jwx/pull/1424) - \[jwt] implement distinguishable jwt.Get errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1426](https://github.com/lestrrat-go/jwx/pull/1426) - Update bazel to v8 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1429](https://github.com/lestrrat-go/jwx/pull/1429) - Bump golang.org/x/crypto from 0.39.0 to 0.40.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;1428](https://github.com/lestrrat-go/jwx/pull/1428) - Allow HeaderGetXXX() functions to differentiate not found / invalid headers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1432](https://github.com/lestrrat-go/jwx/pull/1432) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.8...v3.0.9> ### [`v3.0.8`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.8) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.7...v3.0.8) #### What's Changed - change from interface{} to any by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1417](https://github.com/lestrrat-go/jwx/pull/1417) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1418](https://github.com/lestrrat-go/jwx/pull/1418) - Introduce jwe lower level API (jwebb), and refactor a bunch of things. by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1419](https://github.com/lestrrat-go/jwx/pull/1419) - \[jws/jwsbb] Add io.Reader for source of randomness by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1420](https://github.com/lestrrat-go/jwx/pull/1420) - Add package level doc for jwe by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1421](https://github.com/lestrrat-go/jwx/pull/1421) - Add jwsbb.HeaderParse by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1422](https://github.com/lestrrat-go/jwx/pull/1422) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.7...v3.0.8> ### [`v3.0.7`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.7) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.6...v3.0.7) #### What's Changed - Update examples by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1412](https://github.com/lestrrat-go/jwx/pull/1412) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1413](https://github.com/lestrrat-go/jwx/pull/1413) - Add error when signature could not be verified by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1414](https://github.com/lestrrat-go/jwx/pull/1414) - Add Header type for quick and dirty access to JWS headers by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1415](https://github.com/lestrrat-go/jwx/pull/1415) - Refactor jwsbb code by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1416](https://github.com/lestrrat-go/jwx/pull/1416) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.6...v3.0.7> ### [`v3.0.6`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.6) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.5...v3.0.6) #### What's Changed - Use shared constants for better legibility/greppability by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1398](https://github.com/lestrrat-go/jwx/pull/1398) - Rework pool objects by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1399](https://github.com/lestrrat-go/jwx/pull/1399) - Bump github.com/cloudflare/circl from 1.6.0 to 1.6.1 in /examples by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1395](https://github.com/lestrrat-go/jwx/pull/1395) - Add AppendEncode to the interface by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1400](https://github.com/lestrrat-go/jwx/pull/1400) - Upgrade option and blackmagic by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1401](https://github.com/lestrrat-go/jwx/pull/1401) - Add comparison benchmark by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1407](https://github.com/lestrrat-go/jwx/pull/1407) - Implement low-level API for jws, and incorporate it to JWT to achieve massive performance gains by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1408](https://github.com/lestrrat-go/jwx/pull/1408) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1409](https://github.com/lestrrat-go/jwx/pull/1409) - Rename comparison by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1410](https://github.com/lestrrat-go/jwx/pull/1410) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.5...v3.0.6> ### [`v3.0.5`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.5) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.4...v3.0.5) #### What's Changed - Revert "Improve performance ([#&#8203;1391](https://github.com/lestrrat-go/jwx/issues/1391))" by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1397](https://github.com/lestrrat-go/jwx/pull/1397) - v3.0.4 has also been retracted on go.mod **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.4...v3.0.5> ### [`v3.0.4`](https://github.com/lestrrat-go/jwx/compare/v3.0.3...v3.0.4) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.3...v3.0.4) ### [`v3.0.3`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.3) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.2...v3.0.3) #### What's Changed - Add more context to the errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1387](https://github.com/lestrrat-go/jwx/pull/1387) - Update httprc version by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1388](https://github.com/lestrrat-go/jwx/pull/1388) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.2...v3.0.3> ### [`v3.0.2`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.2) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.1...v3.0.2) #### What's Changed - Bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1369](https://github.com/lestrrat-go/jwx/pull/1369) - Bump golang.org/x/crypto from 0.37.0 to 0.38.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1372](https://github.com/lestrrat-go/jwx/pull/1372) - Bump actions/setup-go from 5.4.0 to 5.5.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1373](https://github.com/lestrrat-go/jwx/pull/1373) - Add .deprecated field to algorithms in anticipation of future deprecations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1374](https://github.com/lestrrat-go/jwx/pull/1374) - Add .deprecated field to algorithms in anticipation of future deprecations by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1376](https://github.com/lestrrat-go/jwx/pull/1376) - Add doc tweaks to [#&#8203;1380](https://github.com/lestrrat-go/jwx/issues/1380) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1383](https://github.com/lestrrat-go/jwx/pull/1383) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1384](https://github.com/lestrrat-go/jwx/pull/1384) - Use jwk interfaces for each key type rather than concrete types by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1381](https://github.com/lestrrat-go/jwx/pull/1381) - Implement Filter objects for container types by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1377](https://github.com/lestrrat-go/jwx/pull/1377) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1386](https://github.com/lestrrat-go/jwx/pull/1386) - Implement generic AsMap by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1385](https://github.com/lestrrat-go/jwx/pull/1385) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.1...v3.0.2> ### [`v3.0.1`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.1) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v3.0.0...v3.0.1) #### What's Changed Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE: - DIRECT mode content encryption - Using A256CBC\_HS512 - With an erroneously created CEK of exactly 32-bytes. *** - Bump actions/cache from 4.2.1 to 4.2.3 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1336](https://github.com/lestrrat-go/jwx/pull/1336) - Bump actions/checkout from 4.1.7 to 4.2.2 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1337](https://github.com/lestrrat-go/jwx/pull/1337) - Bump actions/setup-go from 5.0.2 to 5.4.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1338](https://github.com/lestrrat-go/jwx/pull/1338) - Update 02-jws.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1341](https://github.com/lestrrat-go/jwx/pull/1341) - Bump golang.org/x/crypto from 0.36.0 to 0.37.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1342](https://github.com/lestrrat-go/jwx/pull/1342) - Add the claim name to error messages produced by ClaimValueIs() by [@&#8203;jmalloc](https://github.com/jmalloc) in [#&#8203;1347](https://github.com/lestrrat-go/jwx/pull/1347) - Tweak comments generated by genwa under jwa directory by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1348](https://github.com/lestrrat-go/jwx/pull/1348) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1349](https://github.com/lestrrat-go/jwx/pull/1349) - Disable funcorder by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1351](https://github.com/lestrrat-go/jwx/pull/1351) - Update .golangci.yml by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1353](https://github.com/lestrrat-go/jwx/pull/1353) - Update github.com/lestrrat-go/blackmagic by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1352](https://github.com/lestrrat-go/jwx/pull/1352) - disable dependabot for develop/v1 branch by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1358](https://github.com/lestrrat-go/jwx/pull/1358) - jws: improve performance for SplitCompact/SplitCompactString by [@&#8203;drakkan](https://github.com/drakkan) in [#&#8203;1360](https://github.com/lestrrat-go/jwx/pull/1360) - jwe: use strings.Cut in parseCompact by [@&#8203;drakkan](https://github.com/drakkan) in [#&#8203;1362](https://github.com/lestrrat-go/jwx/pull/1362) - Update httprc to v3.0.0-beta2 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1364](https://github.com/lestrrat-go/jwx/pull/1364) - Create SECURITY.md by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1365](https://github.com/lestrrat-go/jwx/pull/1365) - \[v3] Explcitly check key sizes before passing to aes.NewCipher by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1367](https://github.com/lestrrat-go/jwx/pull/1367) #### New Contributors - [@&#8203;jmalloc](https://github.com/jmalloc) made their first contribution in [#&#8203;1347](https://github.com/lestrrat-go/jwx/pull/1347) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v3.0.0...v3.0.1> ### [`v3.0.0`](https://github.com/lestrrat-go/jwx/releases/tag/v3.0.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v2.1.7...v3.0.0) #### What's Changed - Add support for RSA-OAEP-384 and RSA-OAEP-512 by [@&#8203;Hannes-Kunnen](https://github.com/Hannes-Kunnen) in [#&#8203;1142](https://github.com/lestrrat-go/jwx/pull/1142) - fix: typos by [@&#8203;maro114510](https://github.com/maro114510) in [#&#8203;1145](https://github.com/lestrrat-go/jwx/pull/1145) - Update httprc to v1.0.6 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1150](https://github.com/lestrrat-go/jwx/pull/1150) - Improve API for checking algorithm characteristics around symmetry by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1151](https://github.com/lestrrat-go/jwx/pull/1151) - Fix typos/mistakes/wording/links in documentation/comments by [@&#8203;Hannes-Kunnen](https://github.com/Hannes-Kunnen) in [#&#8203;1152](https://github.com/lestrrat-go/jwx/pull/1152) - Apply changes from [#&#8203;1156](https://github.com/lestrrat-go/jwx/issues/1156) to v2 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1158](https://github.com/lestrrat-go/jwx/pull/1158) - Avoid problems on 32-bit systems by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1159](https://github.com/lestrrat-go/jwx/pull/1159) - Update minimum required go version to 1.20 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1161](https://github.com/lestrrat-go/jwx/pull/1161) - Run CI with minimum go version 1.20 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1162](https://github.com/lestrrat-go/jwx/pull/1162) - Bump golang.org/x/crypto from 0.24.0 to 0.25.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1149](https://github.com/lestrrat-go/jwx/pull/1149) - Deprecate jws.WithHeaders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1163](https://github.com/lestrrat-go/jwx/pull/1163) - Bump golang.org/x/crypto from 0.25.0 to 0.26.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1168](https://github.com/lestrrat-go/jwx/pull/1168) - Fix document of how to parse PEM via CLI by [@&#8203;kg0r0](https://github.com/kg0r0) in [#&#8203;1174](https://github.com/lestrrat-go/jwx/pull/1174) - Wrap the errors from functions called within ParseRequest by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1176](https://github.com/lestrrat-go/jwx/pull/1176) - V3 modernize infra by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1180](https://github.com/lestrrat-go/jwx/pull/1180) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1181](https://github.com/lestrrat-go/jwx/pull/1181) - V3 dependabot by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1184](https://github.com/lestrrat-go/jwx/pull/1184) - Completely rework jwk.Cache using github.com/lestrrat-go/httprc/v3 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1189](https://github.com/lestrrat-go/jwx/pull/1189) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1190](https://github.com/lestrrat-go/jwx/pull/1190) - Use import by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1191](https://github.com/lestrrat-go/jwx/pull/1191) - include an extra attribute in the trace log for debugging by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1192](https://github.com/lestrrat-go/jwx/pull/1192) - remove old references and unused files by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1193](https://github.com/lestrrat-go/jwx/pull/1193) - Bump golang.org/x/crypto from 0.26.0 to 0.27.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1185](https://github.com/lestrrat-go/jwx/pull/1185) - cleanup docs, options around cache by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1194](https://github.com/lestrrat-go/jwx/pull/1194) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1195](https://github.com/lestrrat-go/jwx/pull/1195) - fix docs by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1196](https://github.com/lestrrat-go/jwx/pull/1196) - Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1197](https://github.com/lestrrat-go/jwx/pull/1197) - Allow flexible key usage values by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1198](https://github.com/lestrrat-go/jwx/pull/1198) - Remove assert by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1200](https://github.com/lestrrat-go/jwx/pull/1200) - Convert jwa constants to function calls returning objects by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1203](https://github.com/lestrrat-go/jwx/pull/1203) - Mention RegisterKeyUsage by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1201](https://github.com/lestrrat-go/jwx/pull/1201) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1206](https://github.com/lestrrat-go/jwx/pull/1206) - Change accessors in jwk to return (T, bool) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1207](https://github.com/lestrrat-go/jwx/pull/1207) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1211](https://github.com/lestrrat-go/jwx/pull/1211) - Bump golang.org/x/crypto from 0.27.0 to 0.28.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1210](https://github.com/lestrrat-go/jwx/pull/1210) - Change JWT accessors from returning T to returning (T, bool) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1212](https://github.com/lestrrat-go/jwx/pull/1212) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1213](https://github.com/lestrrat-go/jwx/pull/1213) - update comments to include iat ([#&#8203;1216](https://github.com/lestrrat-go/jwx/issues/1216)) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1217](https://github.com/lestrrat-go/jwx/pull/1217) - Rename the old WithMaxBufferSize option as previously warned by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1218](https://github.com/lestrrat-go/jwx/pull/1218) - Streamline errors by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1220](https://github.com/lestrrat-go/jwx/pull/1220) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1221](https://github.com/lestrrat-go/jwx/pull/1221) - allow passing context.Contex to jwe.Decrypt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1222](https://github.com/lestrrat-go/jwx/pull/1222) - Remove non-applicable comment by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1224](https://github.com/lestrrat-go/jwx/pull/1224) - fix document by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1226](https://github.com/lestrrat-go/jwx/pull/1226) - Remove jws.WithHeaders by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1227](https://github.com/lestrrat-go/jwx/pull/1227) - tweak badge URL by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1228](https://github.com/lestrrat-go/jwx/pull/1228) - Add quid pro quo in README by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1225](https://github.com/lestrrat-go/jwx/pull/1225) - Update serialize.go by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1234](https://github.com/lestrrat-go/jwx/pull/1234) - Lint fix by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1235](https://github.com/lestrrat-go/jwx/pull/1235) - Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1231](https://github.com/lestrrat-go/jwx/pull/1231) - Change random big value to math.MaxInt by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1241](https://github.com/lestrrat-go/jwx/pull/1241) - Bump pozil/auto-assign-issue from 2.0.0 to 2.0.1 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1238](https://github.com/lestrrat-go/jwx/pull/1238) - Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1245](https://github.com/lestrrat-go/jwx/pull/1245) - Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1269](https://github.com/lestrrat-go/jwx/pull/1269) - Bump pozil/auto-assign-issue from 2.0.1 to 2.1.2 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1261](https://github.com/lestrrat-go/jwx/pull/1261) - Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1263](https://github.com/lestrrat-go/jwx/pull/1263) - Bump actions/stale from 9.0.0 to 9.1.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1272](https://github.com/lestrrat-go/jwx/pull/1272) - \[v3] Fixes to work with go1.24 by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1299](https://github.com/lestrrat-go/jwx/pull/1299) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1300](https://github.com/lestrrat-go/jwx/pull/1300) - Bump pozil/auto-assign-issue from 2.1.2 to 2.2.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1279](https://github.com/lestrrat-go/jwx/pull/1279) - Develop v3 actions cache by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1303](https://github.com/lestrrat-go/jwx/pull/1303) - Bump golangci/golangci-lint-action from 6.2.0 to 6.5.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1290](https://github.com/lestrrat-go/jwx/pull/1290) - Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1293](https://github.com/lestrrat-go/jwx/pull/1293) - Bump golang.org/x/crypto from 0.32.0 to 0.34.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1297](https://github.com/lestrrat-go/jwx/pull/1297) - Bump golang.org/x/crypto from 0.34.0 to 0.35.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1307](https://github.com/lestrrat-go/jwx/pull/1307) - jws/jwe: split token into fixed number of parts by [@&#8203;drakkan](https://github.com/drakkan) in [#&#8203;1308](https://github.com/lestrrat-go/jwx/pull/1308) - \[jwk] Change ecdh importer/exporter by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1315](https://github.com/lestrrat-go/jwx/pull/1315) - Bump golang.org/x/crypto from 0.35.0 to 0.36.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1312](https://github.com/lestrrat-go/jwx/pull/1312) - Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1316](https://github.com/lestrrat-go/jwx/pull/1316) - Change default behavior around truncation of time fields by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1318](https://github.com/lestrrat-go/jwx/pull/1318) - Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1320](https://github.com/lestrrat-go/jwx/pull/1320) - Tweaks on [#&#8203;1322](https://github.com/lestrrat-go/jwx/issues/1322) by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1323](https://github.com/lestrrat-go/jwx/pull/1323) - Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot) in [#&#8203;1325](https://github.com/lestrrat-go/jwx/pull/1325) - Implement AWS ALB User Claims parser by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1328](https://github.com/lestrrat-go/jwx/pull/1328) - Add docs for WithBase64Encoder by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1329](https://github.com/lestrrat-go/jwx/pull/1329) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1330](https://github.com/lestrrat-go/jwx/pull/1330) - avoid internal module by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1331](https://github.com/lestrrat-go/jwx/pull/1331) - Clear key.Precomputed values before testing equality by [@&#8203;lestrrat](https://github.com/lestrrat) in [#&#8203;1333](https://github.com/lestrrat-go/jwx/pull/1333) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1332](https://github.com/lestrrat-go/jwx/pull/1332) - autodoc updates by [@&#8203;github-actions](https://github.com/github-actions) in [#&#8203;1334](https://github.com/lestrrat-go/jwx/pull/1334) #### New Contributors - [@&#8203;Hannes-Kunnen](https://github.com/Hannes-Kunnen) made their first contribution in [#&#8203;1142](https://github.com/lestrrat-go/jwx/pull/1142) - [@&#8203;maro114510](https://github.com/maro114510) made their first contribution in [#&#8203;1145](https://github.com/lestrrat-go/jwx/pull/1145) - [@&#8203;kg0r0](https://github.com/kg0r0) made their first contribution in [#&#8203;1174](https://github.com/lestrrat-go/jwx/pull/1174) - [@&#8203;drakkan](https://github.com/drakkan) made their first contribution in [#&#8203;1308](https://github.com/lestrrat-go/jwx/pull/1308) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v2.1.0...v3.0.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "on the first day of the month" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNC45IiwidXBkYXRlZEluVmVyIjoiNDQuMTQuOSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

svc-renovate added 1 commit 2026-10-01 23:03:13 +10:00

chore(deps): update module github.com/lestrrat-go/jwx/v2 to v4 15a873a1ae

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/github.com-lestrrat-go-jwx-v2-4.x:renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch renovate/github.com-lestrrat-go-jwx-v2-4.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch renovate/github.com-lestrrat-go-jwx-v2-4.x

git rebase main

git switch main

git merge --ff-only renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch renovate/github.com-lestrrat-go-jwx-v2-4.x

git rebase main

git switch main

git merge --no-ff renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch main

git merge --squash renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch main

git merge --ff-only renovate/github.com-lestrrat-go-jwx-v2-4.x

git switch main

git merge renovate/github.com-lestrrat-go-jwx-v2-4.x

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sophie/test-token-service!10

No description provided.