From c414d75c3d3cf20018e4370cf1f9f4d98e5891eb Mon Sep 17 00:00:00 2001
From: Joakim Olsson <joakim@unbound.se>
Date: Wed, 22 Apr 2026 10:18:21 +0200
Subject: [PATCH] fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4

Migrate to jwx v4 per MIGRATION.md:
- jwk.Import now generic; use jwk.Import[jwk.Key](raw)
- Set GOEXPERIMENT=jsonv2 (v4 uses encoding/json/v2)
---
 Dockerfile  | 1 +
 auth/jwt.go | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index e0ff7ab..c53e660 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,6 +6,7 @@ ARG GITLAB_TOKEN
 WORKDIR /build
 ENV CGO_ENABLED=0
 ENV GOPRIVATE=gitlab.com/unboundsoftware/*
+ENV GOEXPERIMENT=jsonv2
 
 COPY go.mod go.sum ./
 RUN go mod download
diff --git a/auth/jwt.go b/auth/jwt.go
index e990519..cf10fc0 100644
--- a/auth/jwt.go
+++ b/auth/jwt.go
@@ -38,7 +38,7 @@ func NewJWTService(issuer, audience, adminClaim, emailClaim string) (*JWTService
 	}
 
 	// Create JWK from private key
-	key, err := jwk.Import(privateKey)
+	key, err := jwk.Import[jwk.Key](privateKey)
 	if err != nil {
 		return nil, fmt.Errorf("create JWK from private key: %w", err)
 	}
@@ -98,7 +98,7 @@ func (s *JWTService) SignToken(claims map[string]interface{}) (string, error) {
 	}
 
 	// Create JWK from private key for signing
-	key, err := jwk.Import(s.privateKey)
+	key, err := jwk.Import[jwk.Key](s.privateKey)
 	if err != nil {
 		return "", fmt.Errorf("create signing key: %w", err)
 	}