fix(deps): update module github.com/lestrrat-go/jwx/v3 to v3.1.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.0.13 → v3.1.1

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v3.1.1

Compare Source

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 2.2.1 by @​dependabot[bot] in #​2045
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2050
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2052
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2056
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2058
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2060
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2066
• build(deps): bump pozil/auto-assign-issue from f245a91 to 7bf9d82 by @​dependabot[bot] in #​2065
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2071
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2081
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2083
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2085
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2087
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2089
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2091
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2094
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2099
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2097
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2102
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2104
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2106
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2108
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2110
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2112
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2114
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2117
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2119
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2121
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2123
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2125
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2127
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2129
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2131
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2133
• jwk: wrap ParseKey errors with ParseError sentinel by @​lestrrat in #​2135
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2137
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2140
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2142
• Changes: draft v3.1.1 release notes by @​lestrrat in #​2155

Full Changelog: lestrrat-go/jwx@v3.1.0...v3.1.1

v3.1.0

Compare Source

See Changes file for curated list of changes

What's Changed

• Appease linter by @​lestrrat in #​1543
• Bump kentaro-m/auto-assign-action from 2.0.0 to 2.0.1 by @​dependabot[bot] in #​1538
• Bump actions/checkout from 6.0.1 to 6.0.2 by @​dependabot[bot] in #​1542
• Bump actions/setup-go from 6.1.0 to 6.2.0 by @​dependabot[bot] in #​1536
• Bump actions/cache from 5.0.1 to 5.0.2 by @​dependabot[bot] in #​1539
• Add AGENTS.md by @​lestrrat in #​1546
• exclude AGENTS.md by @​lestrrat in #​1548
• Bump actions/cache from 5.0.2 to 5.0.3 by @​dependabot[bot] in #​1545
• Bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​1535
• Add symlink by @​lestrrat in #​1549
• Fix jwk.Cache worker issues by @​lestrrat in #​1552
• Exclude CLAUDE.md from autodoc by @​lestrrat in #​1555
• Bump github.com/valyala/fastjson from 1.6.7 to 1.6.9 by @​dependabot[bot] in #​1561
• Bump actions/stale from 10.1.1 to 10.2.0 by @​dependabot[bot] in #​1559
• Bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @​dependabot[bot] in #​1557
• Reduce allocations in concatkdf Read by @​lestrrat in #​1562
• Eliminate redundant lock acquisitions in LookupKeyID by @​lestrrat in #​1563
• Replace make+copy with bytes.Clone by @​lestrrat in #​1564
• Use base64.Encode instead of EncodeToString in JWS marshal by @​lestrrat in #​1565
• Cache keyalg/ctalg String() in JWE encrypt/decrypt by @​lestrrat in #​1566
• Inline ndata() in concatkdf New by @​lestrrat in #​1567
• Fix dependabot workflow by @​lestrrat in #​1574
• Bump github.com/valyala/fastjson from 1.6.9 to 1.6.10 by @​dependabot[bot] in #​1568
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.4.0 to 4.4.1 by @​dependabot[bot] in #​1570
• Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 in /examples by @​dependabot[bot] in #​1571
• Bump actions/setup-go from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​1573
• harden dependabot workflow by @​lestrrat in #​1575
• fix inverted rlocker condition in RSA key export by @​lestrrat in #​1576
• Fix jwe decrypt typo by @​lestrrat in #​1577
• Fix example naming by @​lestrrat in #​1578
• Chore remove unused blank assigns by @​lestrrat in #​1579
• add WhitelistError sentinel, use errors.Is in test by @​lestrrat in #​1581
• standardize error helpers in jws and jwe by @​lestrrat in #​1582
• add fuzz testing infrastructure for jwt/jws/jwe/jwk by @​lestrrat in #​1583
• fix flaky cache and jwt validation tests by @​lestrrat in #​1585
• add .claude/docs and pre-read rules to AGENTS.md by @​lestrrat in #​1584
• Bump golang.org/x/crypto from 0.48.0 to 0.49.0 by @​dependabot[bot] in #​1587
• Bump github.com/emmansun/gmsm from 0.21.5 to 0.41.1 in /examples by @​dependabot[bot] in #​1590
• Bump actions/cache from 5.0.3 to 5.0.4 by @​dependabot[bot] in #​1593
• Bump github.com/goccy/go-json from 0.10.3 to 0.10.6 by @​dependabot[bot] in #​1589
• Bump kentaro-m/auto-assign-action from 2.0.1 to 2.0.2 by @​dependabot[bot] in #​1595
• use standard go deprecation markers in jws by @​lestrrat in #​1596
• fix probe field name in panic message by @​lestrrat in #​1597
• Bump github.com/lestrrat-go/httprc/v3 from 3.0.4 to 3.0.5 by @​dependabot[bot] in #​1599
• Bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​1600
• enforce crit header validation in jws.Verify per RFC 7515 by @​lestrrat in #​1601
• validate crit header in VerifyCompactFast by @​lestrrat in #​1602
• fix X25519 ECDH-ES to include apu/apv in KDF by @​lestrrat in #​1603
• enforce minimum PBES2 iteration count by @​lestrrat in #​1604
• reject null JSON values for string claims (#​1484) by @​lestrrat in #​1605
• add RFC 9864 fully-specified EdDSA signature algorithms by @​lestrrat in #​1606
• add extension APIs and KeyKind dispatch for external algorithm modules by @​lestrrat in #​1607
• add jwkunsafe package docs and tests by @​lestrrat in #​1609
• delegate custom algorithm registration to dsig by @​lestrrat in #​1610
• autodoc updates by @​github-actions[bot] in #​1611
• pin ed448 module to latest jwx by @​lestrrat in #​1612
• move ed448 to external jwx-circl-ed448 repo by @​lestrrat in #​1613
• autodoc updates by @​github-actions[bot] in #​1614
• pin jwx-circl-ed448 to latest commit by @​lestrrat in #​1615
• update Changes for v3.0.14 by @​lestrrat in #​1616
• use jwk.Import fallback in AlgorithmsForKey by @​lestrrat in #​1617
• fix OKP key export dispatch for Ed448 by @​lestrrat in #​1618
• fix misleading Ed448 dispatch comments in jwsbb by @​lestrrat in #​1619
• add RegisterAlgorithmForCurve, filter AlgorithmsForKey by curve by @​lestrrat in #​1620
• pin jwx-circl-ed448 to ce28e4b in examples by @​lestrrat in #​1621
• add WithMaxFetchBodySize to limit Fetch response body by @​lestrrat in #​1622
• add per-call PBES2 count overrides to jwe.Decrypt by @​lestrrat in #​1623
• fix X509CertChain() to return false when chain is nil by @​lestrrat in #​1624
• fix data race in x509 decoder registry iteration by @​lestrrat in #​1625
• add max key count limit to PEM parsing loop by @​lestrrat in #​1626
• reject negative WithAcceptableSkew in jwt.Validate by @​lestrrat in #​1627
• accept year 0000 in OIDC birthdate per spec by @​lestrrat in #​1628
• update Changes for #​1620-#​1628 by @​lestrrat in #​1629
• add max input size limit to jwt/jwe ParseReader by @​lestrrat in #​1630
• add global default for MaxFetchBodySize by @​lestrrat in #​1631
• fix parse size limit race, validation, and jws coverage by @​lestrrat in #​1632
• add max recipients limit for JWE messages by @​lestrrat in #​1633
• add default HTTP timeout for jwk.Fetch by @​lestrrat in #​1634
• document jti replay protection as caller responsibility by @​lestrrat in #​1635
• add max signatures limit for JWS messages by @​lestrrat in #​1636
• add default redirect policy for jwk.Fetch by @​lestrrat in #​1637
• add jwk.DefaultHTTPClient by @​lestrrat in #​1638
• check redirect scheme downgrade at every hop by @​lestrrat in #​1639
• apply default redirect policy to jwk.Cache by @​lestrrat in #​1640
• make null string claim rejection opt-in by @​lestrrat in #​1641
• add jwk.WrapHTTPClientDefaults by @​lestrrat in #​1642
• update Changes for #​1630-#​1640 by @​lestrrat in #​1643
• document WithHTTPClient bypass of defaults by @​lestrrat in #​1646
• use atomic wrappers for global settings by @​lestrrat in #​1647
• reuse shared HTTP client in Cache.Register by @​lestrrat in #​1648
• accept ParseOption in jws.ParseString by @​lestrrat in #​1650
• validate maxSignatures is positive by @​lestrrat in #​1649
• document body size limit approach in jwk.Fetch by @​lestrrat in #​1651
• remove minor entries from Changes by @​lestrrat in #​1653
• make WithStrictStringClaims per-call only by @​lestrrat in #​1654
• add per-call opt-out for crit header validation by @​lestrrat in #​1655
• protect global settings with mutex by @​lestrrat in #​1656
• document WithStrictStringClaims scope to JWT only by @​lestrrat in #​1657
• document WithStrictStringClaims scope includes JWK by @​lestrrat in #​1658
• deep-copy slice fields in generated Set methods by @​lestrrat in #​1659
• zero private key fields on UnmarshalJSON error by @​lestrrat in #​1660
• document x509 validation as out of scope by @​lestrrat in #​1661
• update Changes for #​1659 and #​1660 by @​lestrrat in #​1662
• fix inconsistent mutex locking in data structures by @​lestrrat in #​1666
• replace intermediate map in MarshalJSON with pair+pool by @​lestrrat in #​1667
• validate algorithm-key compatibility in WithKey by @​lestrrat in #​1668
• reduce allocations in JWE encrypt path by @​lestrrat in #​1676
• Bump golang.org/x/crypto from 0.49.0 to 0.50.0 by @​dependabot[bot] in #​1684
• clean up jws sign/verify code for legibility by @​lestrrat in #​1687
• clean up jws sign/verify key selection code by @​lestrrat in #​1689
• fix dependabot workflow for develop/v2 bazel by @​lestrrat in #​1691
• use squash merge in dependabot workflow by @​lestrrat in #​1692
• remove auto-approve and auto-merge from dependabot workflow by @​lestrrat in #​1693
• scrub full backing array in byte slice pool by @​lestrrat in #​1729
• clear fieldPair list before returning to pool by @​lestrrat in #​1732
• rework jws crit header validation by @​lestrrat in #​1733
• add jwe crit header validation by @​lestrrat in #​1735
• clone per-recipient headers, recycle via headerPool by @​lestrrat in #​1739
• reject ecdh keys in AlgorithmsForKey by @​lestrrat in #​1741
• stop pooling escaping big.Int in buildRSAPublicKey by @​lestrrat in #​1745
• auto-declare b64 crit when WithDetachedPayload is set by @​lestrrat in #​1748
• fail loudly on rand.Reader errors in key gen helpers by @​lestrrat in #​1751
• drop big.Int pool by @​lestrrat in #​1754
• fix race in jwk/ecdsa lookup functions by @​lestrrat in #​1756
• clone protected headers in signatureBuilder.Build by @​lestrrat in #​1759
• fix ValidationCtx extractors panicking on uninitialized contexts by @​lestrrat in #​1761
• docs: note ES256K low-S non-enforcement by @​lestrrat in #​1763
• reject empty ciphertext/iv/tag in jwe.Message.UnmarshalJSON by @​lestrrat in #​1768
• drop unprotected header merge from jwe.Decrypt by @​lestrrat in #​1770
• document VerifyCompactFast b64:true assumption by @​lestrrat in #​1773
• pin unprotected header merge fix with regression test by @​lestrrat in #​1776
• validate AES-CBC IV length in aescbc.Hmac.Open by @​lestrrat in #​1778
• reslice pooled jwe buffers before defer by @​lestrrat in #​1781
• reject sub-minimum input in RFC 3394 keywrap primitives by @​lestrrat in #​1784
• add jwe.WithPBES2Count encrypt option by @​lestrrat in #​1782
• jwe: use privkey.Size() for RSA PKCS1v1.5 length check by @​lestrrat in #​1788
• document default InsecureWhitelist on jwk.Fetch (JWK-001) by @​lestrrat in #​1790
• reject crit-bearing messages in jws.VerifyCompactFast by @​lestrrat in #​1793
• jwe: stop aliasing AAD backing slices when concatenating external aad by @​lestrrat in #​1796
• validate ECDSA point on curve (JWK-003) by @​lestrrat in #​1797
• copy recipientKey in KeyDecryptAESGCMKW to avoid caller aliasing (JWE-002) by @​lestrrat in #​1800
• strip key options in jwt.ParseInsecure by @​lestrrat in #​1802
• Bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​1795
• enforce jws signatures cap before decoding entries by @​lestrrat in #​1804
• cap SplitCompactReader non-finite reads at 10 MiB by @​lestrrat in #​1806
• copy rawKey in symmetricKey.Import to avoid caller aliasing by @​lestrrat in #​1808
• enforce max parse input size in jws.Parse and jwe.Parse by @​lestrrat in #​1809
• fix cert.Chain.Add to strip real PEM markers by @​lestrrat in #​1814
• fix jwk x509 decoder unregister index and race by @​lestrrat in #​1812
• fix jwt fast path json injection via unescaped kid by @​lestrrat in #​1817
• fix nil-aware ok return in jws header accessors by @​lestrrat in #​1818
• fix: jwk.PublicSetOf rejects symmetric keys by default (v3.1.0) by @​lestrrat in #​1829
• autodoc updates by @​github-actions[bot] in #​1832
• fix jwk rsa exponent truncation and thumbprint collision by @​lestrrat in #​1833
• fix cert.Chain MarshalJSON and validate Add input by @​lestrrat in #​1836
• fix jwt fast path json injection via unescaped alg by @​lestrrat in #​1838
• track aes-cbc-hmac tag length independently of key size by @​lestrrat in #​1841
• fix jwe aescbc open opaque errors by @​lestrrat in #​1843
• fix jwe keyset selecting keys without alg field by @​lestrrat in #​1845
• fix jwe ecdh-es invalid-curve attack surface by @​lestrrat in #​1847
• fix jwk.Set.AddKey panic on nil or struct keys by @​lestrrat in #​1852
• fix jwk parser to validate keys after unmarshal by @​lestrrat in #​1854
• wrap underlying error in jwk set single-key fallback by @​lestrrat in #​1856
• fix cmd/jwx output file mode and truncation by @​lestrrat in #​1858
• fix jwt.ParseHeader bearer scheme per rfc 6750 by @​lestrrat in #​1859
• make MissingRequiredClaimError.Is type-only by @​lestrrat in #​1862
• document WithUseNumber concurrency contract as startup-only by @​lestrrat in #​1864
• reject key-bearing options in jwt.ParseInsecure by @​lestrrat in #​1867
• bound jws keyset verification fan-out by header alg by @​lestrrat in #​1869
• add jwk.WithForceAssign to overwrite existing kid by @​lestrrat in #​1874
• tighten HeaderGetStringBytes lifetime doc by @​lestrrat in #​1876
• fix jwxio limited reader detection by @​lestrrat in #​1877
• fix jwa error truncation by @​lestrrat in #​1880
• fix jwa registry snapshots by @​lestrrat in #​1883
• tighten jws validateAlgorithmForKey escape by @​lestrrat in #​1887
• fix jws jku kid-miss silent nil by @​lestrrat in #​1888
• surface jku kid-miss error from jkuProvider by @​lestrrat in #​1891
• fix jws VerifyCompactFast header alg cross-check by @​lestrrat in #​1893
• fix okp key length checks by @​lestrrat in #​1896
• fix jwa builtin protection by @​lestrrat in #​1899
• fix v3 rsa jwk validation by @​lestrrat in #​1895
• fix compact sign errors by @​lestrrat in #​1902
• zero bytes.Buffer backing array on pool return by @​lestrrat in #​1905
• remove internal/json.Dump debug helper by @​lestrrat in #​1907
• fix SplitCompactReader LimitedReader size bypass by @​lestrrat in #​1909
• fix jwe godoc references by @​lestrrat in #​1911
• fix v3 jwt package docs by @​lestrrat in #​1915
• fix v3 jwe cek length checks by @​lestrrat in #​1918
• make x5c cert limits configurable by @​lestrrat in #​1919
• document v3 transform.AsMap aliasing by @​lestrrat in #​1920
• fix v3 ecdsa algorithms snapshot by @​lestrrat in #​1923
• fix jwxio limitedreader bounds by @​lestrrat in #​1924
• warn about jws WithKey misuse in v3 by @​lestrrat in #​1930
• fix v3 jws parse autodetect by @​lestrrat in #​1927
• fix empty compact jws signature by @​lestrrat in #​1933
• fix v3 jwe p2c validation by @​lestrrat in #​1935
• fix v3 jwe gcmkw header typing by @​lestrrat in #​1939
• fix v3 jwe aescbc append by @​lestrrat in #​1937
• document jwe compression caveats by @​lestrrat in #​1941
• warn about jwe rsa1_5 by @​lestrrat in #​1943
• document jwe WithKey pairs in v3 by @​lestrrat in #​1945
• fix PublicSetOf oct bypass in v3 by @​lestrrat in #​1946
• docs: warn about short symmetric keys by @​lestrrat in #​1949
• add jws.WithDetachedPayloadReader for streaming detached payloads by @​lestrrat in #​1663
• jws: return non-nil empty []byte from streaming Verify by @​lestrrat in #​1979
• clarify jwe decrypt unprotected-header scope by @​lestrrat in #​1983
• drop raw input-byte caps from parse apis by @​lestrrat in #​1985
• fix ClaimValueIs panic on non-comparable values by @​lestrrat in #​1987
• clarify EncryptStatic CEK for direct-CEK algs by @​lestrrat in #​1990
• jwk: add WithMaxKeys cap on JWKS entries by @​lestrrat in #​1991
• jws: expand WithDetachedPayloadReader encoder-missing error with install hint by @​lestrrat in #​1993
• jws: document goroutine-safety for WithDetachedPayloadReader by @​lestrrat in #​1997
• jws: explain RFC 8032 EdDSA streaming incompatibility in error message by @​lestrrat in #​1995
• jws: align streaming HMAC key-type error with non-streaming path by @​lestrrat in #​2000
• jwe: fix grammar in ECDH-ES/DIRECT multi-recipient error by @​lestrrat in #​2002
• jws: drop double-wrap on compact parse errors by @​lestrrat in #​2004
• jwt: guard Validate against nil token by @​lestrrat in #​2007
• jws: make jkuProvider surface missing-alg error by @​lestrrat in #​2009
• jws: surface per-key selectKey errors in keySetProvider by @​lestrrat in #​2011
• jws: surface use=enc mismatch as explicit error by @​lestrrat in #​2013
• jwt: stop using dynamic fmt.Errorf format string in ParseRequest by @​lestrrat in #​2017
• jws: document kid precedence on WithProtectedHeaders by @​lestrrat in #​2024
• jwk: add WithRejectDuplicateKID parse option by @​lestrrat in #​2027
• jwk: replace misleading RegisterKeyImporter godoc by @​lestrrat in #​2029
• jwt: wrap unsupported-time-claim error as ValidateError by @​lestrrat in #​2015
• changes: add jwk.WithRejectDuplicateKID entry by @​lestrrat in #​2033
• fix v3.1.0 changelog inaccuracies and add missing entries by @​lestrrat in #​2037

Full Changelog: lestrrat-go/jwx@v3.0.13...v3.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/decred/dcrd/dcrec/secp256k1/v4	v4.4.0 -> v4.4.1
github.com/goccy/go-json	v0.10.3 -> v0.10.6
golang.org/x/sys	v0.40.0 -> v0.43.0

[JAORMX]

Closing in favour of the v3→v4 migration (supersedes #167). Will jump straight to v4 rather than landing this v3 patch first.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v3.1.1). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

[JAORMX]

Reopening — we evaluated the v4 migration and decided to stay on v3 for now (jwx v4 requires GOEXPERIMENT=jsonv2 process-wide, which is more operational burden than the perf win justifies right now). This patch is good to land.