chore(deps): bump jsonwebtoken from 10.4.0 to 11.0.0

[dependabot]

Bumps jsonwebtoken from 10.4.0 to 11.0.0.

Changelog

Sourced from jsonwebtoken's changelog.

11.0.0 (2026-07-24)

• Add conversions between Algorithm and KeyAlgorithm
• JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
• JWKs with unknown key types are now deserializable
• BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
• BREAKING: Jwk.thumbprint now returns a Result<_>
• BREAKING: Header.extras is now a struct that allows for deserialization to any T
• BREAKING: Implicit features resulting from optional crates have been removed
• BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
• BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
• BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

• When constructing HMAC signers, the algorithm family must now be verified on construction
• JwkUtils has been renamed to KeyUtils
  • compute_digest now returns a Result<_>
  • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
  • rsa_pub_components_from_public_key has been added
  • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
  • ed_pub_components_from_private_key has been added

Commits

• 900010f Bump v11
• 6aac5ae Allow deserializing unknown key type JWKs (#530)
• e7ea8f0 Implement Default on JwkSet (#527)
• 249f5f7 Don't panic when computing thumbprint (#524)
• b5d9c38 Prepare for v11 release (#522)
• 6086da7 Unify encoding and decoding key APIs (#515)
• 474728f Remove deprecated insecure_disable_signature_validation (#521)
• 31a1dc6 Feat: Added support for JWK decoding Ed25519 keys (#506)
• e681247 feat: add Jwk::from_decoding_key (#475)
• bba16eb Allow conversion between Algorithm and KeyAlgorithm (#516)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Tuntii]

Held on purpose during repo hygiene (2026-09-05). This is a major/breaking bump, not a drive-by merge. We'll take it in a dedicated PR after main is green again (#266). Please don't squash-merge this as-is.

[Tuntii]

Superseded by #270 (single lockfile PR for all remaining majors). Closing this Dependabot bump.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.