v4.2.0

For more detailed release notes, see Changes.

What's Changed

• docs: point jwkcache references to jwkfetch by @lestrrat in #2245
• chore: bump golangci-lint-action to 9.3.0 + sync action versions by @lestrrat in #2246
• fix misspellings in code comments by @lestrrat in #2248
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by @dependabot[bot] in #2256
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @dependabot[bot] in #2255
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #2252
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in #2259
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #2262
• [v4] retain unparseable JWKS entries as UnsupportedKey by @lestrrat in #2264
• fix CodeQL autobuild for encoding/json/v2 by @lestrrat in #2268
• [v4] let per-call WithRejectDuplicateKID override global by @lestrrat in #2269
• [v4] test jwe rejects UnsupportedKey placeholders by @lestrrat in #2271
• [v4] doc: warn that global strict JWK set parsing breaks on PQC keys by @lestrrat in #2273

Full Changelog: v4.1.0...v4.2.0