v2.1.1

Fixed

• Signature verification reports only cryptographic validity. An expired token with a valid signature was shown as Signature: INVALID; claims validation no longer affects the verdict.
• Algorithm confusion is rejected outright. Verification restricts accepted alg values to those compatible with the provided key type (RS*/PS* for RSA, ES* for ECDSA, EdDSA for Ed25519, HS* for symmetric keys) and reports a clear reason.
• No more duplicate output for token-lookalike payloads. A decrypted JWE payload that merely looks like a nested JWT/JWE (e.g. text containing dots) no longer produces a stray nested label and partial output.
• JWE part metadata flags corrupt encoding. Parts that are not valid base64url are shown as invalid base64url instead of 0 bytes.
• go-jose updated to 4.1.4, fixing a high-severity panic in JWE decryption (GHSA advisory).

Added

• raw: key prefix. --key raw:<secret> (also via JWTD_KEY) passes a literal symmetric secret, bypassing file and base64 detection — previously a plain-text secret that happened to be valid base64 was silently decoded into the wrong bytes.
• Friendlier key files. Text key files get the trailing newline editors add trimmed; binary key material is used byte-for-byte.
• Line-wrapped tokens just work. Tokens copied from logs or emails with embedded newlines are accepted via argument, stdin, and the interactive prompt.

CI

• Releases are published immediately instead of as drafts, so the Homebrew formula never points at unpublished download URLs.
• CI now enforces gofmt and go vet.

Full Changelog: v2.1.0...v2.1.1