Skip to content

Update module github.com/lestrrat-go/jwx to v3#1039

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/github.com-lestrrat-go-jwx-3.x
Open

Update module github.com/lestrrat-go/jwx to v3#1039
renovate[bot] wants to merge 1 commit intomainfrom
renovate/github.com-lestrrat-go-jwx-3.x

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 28, 2025 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/lestrrat-go/jwx v1.2.31 → v3.0.13 age confidence

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx)

v3.0.13

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.12...v3.0.13

v3.0.12

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.11...v3.0.12

v3.0.11

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.10...v3.0.11

v3.0.10

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.9...v3.0.10

v3.0.9

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.8...v3.0.9

v3.0.8

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.7...v3.0.8

v3.0.7

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.6...v3.0.7

v3.0.6

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.5...v3.0.6

v3.0.5

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.4...v3.0.5

v3.0.4

Compare Source

v3.0.3

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

  • DIRECT mode content encryption
  • Using A256CBC_HS512
  • With an erroneously created CEK of exactly 32-bytes.

New Contributors

Full Changelog: lestrrat-go/jwx@v3.0.0...v3.0.1

v3.0.0

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v2.1.0...v3.0.0

v2.1.6

Compare Source

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

  • DIRECT mode content encryption
  • Using A256CBC_HS512
  • With an erroneously created CEK of exactly 32-bytes.

Full Changelog: lestrrat-go/jwx@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v2.1.3...v2.1.4

v2.1.3

Compare Source

What's Changed

Full Changelog: lestrrat-go/jwx@v2.1.2...v2.1.3

v2.1.2

Compare Source

What's Changed

New Contributors

Full Changelog: lestrrat-go/jwx@v2.1.1...v2.1.2

v2.1.1

Compare Source

v2.1.1 Jul 28 2024
  * Update minimum required go version to go 1.20
  * Update tests to work on 32-bit systems.
  * [jwa] Add RSA_OAEP_384 and RSA_OAEP_512
  * [jwa] `jwa.SignatureAlgorithm` now has a `IsSymmetric` method.
  * [jwa] Add `jwa.RegisterSignatureAlgorithmOptions()` to register new algorithms while
    specifying extra options. Currently only `jwa.WithSymmetricAlgorithm()` is supported.
  * [jws] Clearly mark `jws.WithHeaders()` as deprecated

v2.1.0

Compare Source

v2.1.0 18 Jun 2024
[New Features]
  * [jwt] Added `jwt.ParseCookie()` function
  * [jwt] `jwt.ParseRequest()` can now accept a new option, jwt.WithCookieKey() to
    specify a cookie name to extract the token from.
  * [jwt] `jwt.ParseRequest()` and `jwt.ParseCookie()` can accept the `jwt.WithCookie()` option,
    which will, upon successful token parsing, make the functions assign the *http.Cookie
    used to parse the token. This allows users to further inspect the cookie where the
    token came from, should the need arise.
  * [jwt] (BREAKING CHANGE) `jwt.ParseRequest()` no longer automatically looks for "Authorization" header when
    only `jwt.WithFormKey()` is used. This behavior is the same for `jwt.WithCookieKey()` and
    any similar options that may be implemented in the future.

### previously
      jwt.ParseRequest(req) // looks under Authorization
      jwt.ParseReuqest(req, jwt.WithFormKey("foo")) // looks under foo AND Authorization
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

### since this release
      jwt.ParseRequest(req) // same as before
      jwt.ParseRequest(req, jwt.WithFormKey("foo")) // looks under foo
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

  * [jwt] Add `jwt.WithResetValidators()` option to `jwt.Validate()`. This option
    will allow you to tell `jwt.Validate()` to NOT automatically check the
    default validators (`iat`, `exp`, and `nbf`), so that you can completely customize
    the validation with the validators you specify using `jwt.WithValidator()`.

    This sort of behavior is useful for special cases such as 
    https://openid.net/specs/openid-connect-rpinitiated-1_0.html. However, you SHOULD NOT
    use this option unless you know exactly what you are doing, as this will pose
    significant security issues when used incorrectly.
 
   * [jwk] Provide a _stop-gap_ measure to work with PEM format ASN.1 DER encoded secp256k1 keys.
  
    In order to enable this feature, you must compile jwx with TWO build tags:
    `jwx_es256k` to enable ES256K/secp256k1, and `jwx_secp256k1_pem` to enable PEM handling.
    Not one, but BOTH tags need to be present.

    With this change, by suppliying the `WithPEM(true)` option, `jwk.Parse()` is now
    able to read sep256k1 keys. Also, `jwk.Pem()` should be able to handle `jwk.Key` objects
    that represent a secp256k1 key.

    Please do note that the implementation of this feature is dodgy at best. Currently
    Go's crypto/x509 does not allow handling additional EC curves, and thus in order to
    accomodate secp256k1 keys in PEM/ASN.1 DER format we need to "patch" the stdlib.
    We do this by copy-and-pasting relevant parts of go 1.22.2's crypto/x509 code and
    adding the minimum required code to make secp256k1 keys work.

    Because of the above, there are several important caveats for this feature:

    1. This feature is provided solely as a stop-gap measure until such time Go's stdlib
    provides a way to handle non-standard EC curves, or another external module
    is able to solve this issue. 

    2. This feature should be considered unstable and not guaranteed by semantic versioning
    backward compatibility. At any given point we may drop or modify this feature. It may be
    because we can no longer maintain the code, or perhaps a security issue is found in the
    version of the code that we ship with, etc.
 
     3. Please always remember that we are now bundling a static set of code for handling
    x509 formats. You are taking a possible security risk by code that could be outdated.
    Please always do your own research, and if possible, please notify us if the bundled
    code needs to be updated. Unless you know what you are doing, it is not recommended
    that you enable this feature.

    4. Please note that because we imported the code from go 1.22's src/crypto/x509,
    it has some go1.20-isms in its code. Therefore you will not be able to use the
    `jwx_secp256k1_pem` tag to enable secp256k1 key PEM handling against codebases
    that are built using go 1.19 and below (the build will succeed, but the feature
    will be unavailable).

    5. We have no plans to include more curves this way. One is already one too many.

  * [jwe] Fixed a bug when using encryption algorithms involving PBES2 along with the
    jwx.WithUseNumber() global option. Enabling this option would turn all values
    stored in the JSON content to be of type `json.Number`, but we did not account for
    it when checking for the value of `p2c` header, resulting in a conversion error.

v2.0.21

Compare Source

v2.0.21 07 Mar 2024

[Security]

  • [jwe] Added jwe.Settings(jwe.WithMaxDecompressBufferSize(int64)) to specify the
    maximum size of a decompressed JWE payload. The default value is 10MB. If you
    are compressing payloads greater than this and want to decompress it during
    a call to jwe.Decrypt, you need to explicitly set a value large enough to
    hold that data.

    The same option can be passed to jwe.Decrypt to control this behavior on
    a per-message basis.

  • [jwe] Added documentation stating that jwe.WithMaxBufferSize option will be
    renamed in future versions, i.e. v3

v2.0.20

Compare Source

v2.0.20 20 Feb 2024

[New Features]

  • [jwe] Added jwe.Settings(WithMaxBufferSize(int64)) to set the maximum size of
    internal buffers. The default value is 256MB. Most users do not need to change
    this value.
  • [jws] Allow jws.WithCompact() and jws.WithJSON() to be passed to jws.Parse() and
    jws.Verify(). These options control the expected serialization format for the
    JWS message.
  • [jwt] Add jwt.WithCompactOnly() to specify that only compact serialization can
    be used for jwt.Parse(). Previously, by virtue of jws.Parse() allowing either
    JSON or Compact serialization format, jwt.Parse() also alloed JSON serialization
    where as RFC7519 explicitly states that only compact serialization should be
    used. For backward compatibility the default behavior is not changed, but you
    can set this global option for jwt: jwt.Settings(jwt.WithCompactOnly(true))

[Miscellaneous]

  • Internal key conversions should now allow private keys to be used in place of
    public keys. This would allow you to pass private keys where public keys are
    expected.

v2.0.19

Compare Source

v2.0.19 09 Jan 2024
[New Features]
  * [jws] Added jws.IsVerificationError to check if the error returned by `jws.Verify`
    was caused by actual verification step or something else, for example, while fetching
    a key from datasource

[Security Fixes]
  * [jws] JWS messages formated in full JSON format (i.e. not the compact format, which
    consists of three base64 strings concatenated with a '.') with missing "protected"
    headers could cause a panic, thereby introducing a possiblity of a DoS.

    This has been fixed so that the `jws.Parse` function succeeds in parsing a JWS message
    lacking a protected header. Calling `jws.Verify` on this same JWS message will result
    in a failed verification attempt. Note that this behavior will differ slightly when
    parsing JWS messages in compact form, which result in an error.

v2.0.18

Compare Source

v2.0.18 03 Dec 2023
[Security Fixes]
  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users who use JWE via this
    package should upgrade. While the JOSE spec allows for encryption using JWE on JWTs, users of
    the `jwt` package are not immediately susceptible unless they explicitly try to decrypt
    JWTs -- by default the `jwt` package verifies signatures, but does not decrypt messages.
    [GHSA-7f9x-gw85-8grf]

v2.0.17

Compare Source

v2.0.17 20 Nov 2023
[Bug Fixes]
  * [jws] Previously, `jws.UnregisterSigner` did not remove the previ

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/piny940/portfolio).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xMzAuMSIsInVwZGF0ZWRJblZlciI6IjQyLjk1LjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 0f5a6f4 to c750b2d Compare September 28, 2025 13:12
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from c750b2d to 8cc6f49 Compare September 28, 2025 17:32
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 8cc6f49 to eb517c7 Compare September 28, 2025 21:01
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from eb517c7 to 73d0e61 Compare September 29, 2025 14:11
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 73d0e61 to 61c3ab1 Compare September 29, 2025 18:04
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 61c3ab1 to d4bfe01 Compare September 29, 2025 20:59
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from d4bfe01 to 6c66f28 Compare September 30, 2025 00:10
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 6c66f28 to 8ea399e Compare September 30, 2025 02:02
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 8ea399e to b680f22 Compare September 30, 2025 13:35
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from b680f22 to d8829a0 Compare September 30, 2025 21:00
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from d8829a0 to 96802e6 Compare October 1, 2025 21:37
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 96802e6 to 4558bc9 Compare October 2, 2025 01:50
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 4558bc9 to 762d3f5 Compare October 2, 2025 04:35
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 762d3f5 to 8b55459 Compare October 2, 2025 17:42
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 8b55459 to e87823d Compare October 2, 2025 21:11
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from d6678b9 to ddafd03 Compare October 4, 2025 09:56
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from ddafd03 to 9ff11b4 Compare October 6, 2025 16:51
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 9ff11b4 to dd1ae52 Compare October 7, 2025 00:34
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from dd1ae52 to 9694317 Compare October 7, 2025 16:52
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 9694317 to a002938 Compare October 8, 2025 07:06
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from a002938 to 2599487 Compare October 8, 2025 08:59
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 2599487 to 53046cc Compare October 23, 2025 16:16
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 53046cc to 15aac59 Compare November 7, 2025 11:49
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from 15aac59 to 26b435a Compare December 15, 2025 17:49
@renovate renovate bot changed the title Update module github.com/lestrrat-go/jwx to v3 Update module github.com/lestrrat-go/jwx to v3 - autoclosed Dec 30, 2025
@renovate renovate bot closed this Dec 30, 2025
@renovate renovate bot deleted the renovate/github.com-lestrrat-go-jwx-3.x branch December 30, 2025 12:37
@renovate renovate bot changed the title Update module github.com/lestrrat-go/jwx to v3 - autoclosed Update module github.com/lestrrat-go/jwx to v3 Dec 31, 2025
@renovate renovate bot reopened this Dec 31, 2025
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch 2 times, most recently from 26b435a to c71b8be Compare December 31, 2025 19:00
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from c71b8be to a2480f6 Compare January 12, 2026 08:56
@renovate renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-3.x branch from a2480f6 to a590ce6 Compare February 2, 2026 21:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants