fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.0.2 #319

2026-05-10T01:01:59Z

renovate commented

2026-05-10 01:01:59 +00:00

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v4	`v4.0.1` → `v4.0.2`

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)

`v4.0.2`

Compare Source

For more detailed release notes, see Changes.

What's Changed

ci: print coverage summary in GitHub Actions run summary by @lestrrat in #2078
ci: also run on push to target branches by @lestrrat in #2079
jws: refuse "b64" header in VerifyCompactFast by @lestrrat in #2080
jws: VerifyCompactFast refusals match jws.VerifyError() class by @lestrrat in #2082
jws: name loose keySet options in fan-out verify error by @lestrrat in #2084
jws: honor RFC 7797 b64=false in Message.MarshalJSON by @lestrrat in #2086
jws: reject literal-JSON "protected" in general-form JWS by @lestrrat in #2088
jwt: ParseRequest: don't skip form body on chunked transfer by @lestrrat in #2090
jwt: Settings rejects out-of-range NumericDate precision by @lestrrat in #2092
jwt: pedantic mode enforces cty=JWT nested-envelope shape by @lestrrat in #2093
jwt: reshape base64-corruption hint as diagnosis-first by @lestrrat in #2095
jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @lestrrat in #2098
jwt: ParseInsecure: parse loop-local payload, not original input by @lestrrat in #2096
jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @lestrrat in #2100
jws: Verify rejects b64=false without "b64" listed in "crit" by @lestrrat in #2101
jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @lestrrat in #2103
jws: declare "b64" as typed bool header field by @lestrrat in #2105
jws: reject general-form JWS with top-level "header" sibling of "signatures" by @lestrrat in #2107
jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @lestrrat in #2109
jws: VerifyMessage observes ctx cancellation between loop iterations by @lestrrat in #2111
jws: cleanup follow-ups from recent review (low-severity batch) by @lestrrat in #2113
jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @lestrrat in #2115
jwe: DecryptMessage observes ctx cancellation between loop iterations by @lestrrat in #2116
jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @lestrrat in #2118
jwe: WithKey validates alg-vs-key shape at option-time by @lestrrat in #2120
jwe: compression cap error names "decompressed" payload, the option, and the size by @lestrrat in #2122
jwe: bound joined-error count and drop redundant outer Decrypt prefix by @lestrrat in #2124
jwe: keySetProvider surfaces per-key errors via errors.Join by @lestrrat in #2126
jwe: add WithDisabledKeyAlgorithms global policy hook by @lestrrat in #2128
jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @lestrrat in #2130
jwk: stop duplicating JWK fields at JWKS top level on parse by @lestrrat in #2132
jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @lestrrat in #2134
jwk: stream the keys array with cap-before-allocate by @lestrrat in #2136
jwk: probe tolerates duplicate JSON field names by @lestrrat in #2138
jwk: treat nil key from custom KeyParser as continue, not success by @lestrrat in #2139
jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @lestrrat in #2141
jwk: add UnknownKeyTypeError typed error by @lestrrat in #2143
jwk: document AKP-specific Thumbprint canonicalization on public methods by @lestrrat in #2144
docs/jwk: use jwk.WithX509(true) in PEM section prose by @lestrrat in #2145
docs/jwk: document EncodePEM emit-to-PEM path by @lestrrat in #2146
MIGRATION: document PublicSetOf default-reject for symmetric keys by @lestrrat in #2147
jwk: clarify that any value <= 0 disables the RSA strength floor by @lestrrat in #2148
jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @lestrrat in #2149
jwk: correct Import godoc for crypto/ecdh dispatch by @lestrrat in #2150
jwk: surface Export type mismatch as KeyTypeMismatchError by @lestrrat in #2151
jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @lestrrat in #2152
Changes: draft v4.0.2 release notes by @lestrrat in #2154

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v4](https://github.com/lestrrat-go/jwx) | `v4.0.1` → `v4.0.2` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.0.1/v4.0.2?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)</summary> ### [`v4.0.2`](https://github.com/lestrrat-go/jwx/releases/tag/v4.0.2) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.0.2/Changes). #### What's Changed - ci: print coverage summary in GitHub Actions run summary by [@lestrrat](https://github.com/lestrrat) in [#2078](https://github.com/lestrrat-go/jwx/pull/2078) - ci: also run on push to target branches by [@lestrrat](https://github.com/lestrrat) in [#2079](https://github.com/lestrrat-go/jwx/pull/2079) - jws: refuse "b64" header in VerifyCompactFast by [@lestrrat](https://github.com/lestrrat) in [#2080](https://github.com/lestrrat-go/jwx/pull/2080) - jws: VerifyCompactFast refusals match jws.VerifyError() class by [@lestrrat](https://github.com/lestrrat) in [#2082](https://github.com/lestrrat-go/jwx/pull/2082) - jws: name loose keySet options in fan-out verify error by [@lestrrat](https://github.com/lestrrat) in [#2084](https://github.com/lestrrat-go/jwx/pull/2084) - jws: honor RFC 7797 b64=false in Message.MarshalJSON by [@lestrrat](https://github.com/lestrrat) in [#2086](https://github.com/lestrrat-go/jwx/pull/2086) - jws: reject literal-JSON "protected" in general-form JWS by [@lestrrat](https://github.com/lestrrat) in [#2088](https://github.com/lestrrat-go/jwx/pull/2088) - jwt: ParseRequest: don't skip form body on chunked transfer by [@lestrrat](https://github.com/lestrrat) in [#2090](https://github.com/lestrrat-go/jwx/pull/2090) - jwt: Settings rejects out-of-range NumericDate precision by [@lestrrat](https://github.com/lestrrat) in [#2092](https://github.com/lestrrat-go/jwx/pull/2092) - jwt: pedantic mode enforces cty=JWT nested-envelope shape by [@lestrrat](https://github.com/lestrrat) in [#2093](https://github.com/lestrrat-go/jwx/pull/2093) - jwt: reshape base64-corruption hint as diagnosis-first by [@lestrrat](https://github.com/lestrrat) in [#2095](https://github.com/lestrrat-go/jwx/pull/2095) - jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by [@lestrrat](https://github.com/lestrrat) in [#2098](https://github.com/lestrrat-go/jwx/pull/2098) - jwt: ParseInsecure: parse loop-local payload, not original input by [@lestrrat](https://github.com/lestrrat) in [#2096](https://github.com/lestrrat-go/jwx/pull/2096) - jwt: align Validate fast/slow paths to same iat,exp,nbf check order by [@lestrrat](https://github.com/lestrrat) in [#2100](https://github.com/lestrrat-go/jwx/pull/2100) - jws: Verify rejects b64=false without "b64" listed in "crit" by [@lestrrat](https://github.com/lestrrat) in [#2101](https://github.com/lestrrat-go/jwx/pull/2101) - jws: Sign auto-declares "b64" in "crit" when emitting b64=false by [@lestrrat](https://github.com/lestrrat) in [#2103](https://github.com/lestrrat-go/jwx/pull/2103) - jws: declare "b64" as typed bool header field by [@lestrrat](https://github.com/lestrrat) in [#2105](https://github.com/lestrrat-go/jwx/pull/2105) - jws: reject general-form JWS with top-level "header" sibling of "signatures" by [@lestrrat](https://github.com/lestrrat) in [#2107](https://github.com/lestrrat-go/jwx/pull/2107) - jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by [@lestrrat](https://github.com/lestrrat) in [#2109](https://github.com/lestrrat-go/jwx/pull/2109) - jws: VerifyMessage observes ctx cancellation between loop iterations by [@lestrrat](https://github.com/lestrrat) in [#2111](https://github.com/lestrrat-go/jwx/pull/2111) - jws: cleanup follow-ups from recent review (low-severity batch) by [@lestrrat](https://github.com/lestrrat) in [#2113](https://github.com/lestrrat-go/jwx/pull/2113) - jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by [@lestrrat](https://github.com/lestrrat) in [#2115](https://github.com/lestrrat-go/jwx/pull/2115) - jwe: DecryptMessage observes ctx cancellation between loop iterations by [@lestrrat](https://github.com/lestrrat) in [#2116](https://github.com/lestrrat-go/jwx/pull/2116) - jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by [@lestrrat](https://github.com/lestrrat) in [#2118](https://github.com/lestrrat-go/jwx/pull/2118) - jwe: WithKey validates alg-vs-key shape at option-time by [@lestrrat](https://github.com/lestrrat) in [#2120](https://github.com/lestrrat-go/jwx/pull/2120) - jwe: compression cap error names "decompressed" payload, the option, and the size by [@lestrrat](https://github.com/lestrrat) in [#2122](https://github.com/lestrrat-go/jwx/pull/2122) - jwe: bound joined-error count and drop redundant outer Decrypt prefix by [@lestrrat](https://github.com/lestrrat) in [#2124](https://github.com/lestrrat-go/jwx/pull/2124) - jwe: keySetProvider surfaces per-key errors via errors.Join by [@lestrrat](https://github.com/lestrrat) in [#2126](https://github.com/lestrrat-go/jwx/pull/2126) - jwe: add WithDisabledKeyAlgorithms global policy hook by [@lestrrat](https://github.com/lestrrat) in [#2128](https://github.com/lestrrat-go/jwx/pull/2128) - jwe: document WithMaxDecompressBufferSize behavior at non-positive values by [@lestrrat](https://github.com/lestrrat) in [#2130](https://github.com/lestrrat-go/jwx/pull/2130) - jwk: stop duplicating JWK fields at JWKS top level on parse by [@lestrrat](https://github.com/lestrrat) in [#2132](https://github.com/lestrrat-go/jwx/pull/2132) - jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by [@lestrrat](https://github.com/lestrrat) in [#2134](https://github.com/lestrrat-go/jwx/pull/2134) - jwk: stream the keys array with cap-before-allocate by [@lestrrat](https://github.com/lestrrat) in [#2136](https://github.com/lestrrat-go/jwx/pull/2136) - jwk: probe tolerates duplicate JSON field names by [@lestrrat](https://github.com/lestrrat) in [#2138](https://github.com/lestrrat-go/jwx/pull/2138) - jwk: treat nil key from custom KeyParser as continue, not success by [@lestrrat](https://github.com/lestrrat) in [#2139](https://github.com/lestrrat-go/jwx/pull/2139) - jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by [@lestrrat](https://github.com/lestrrat) in [#2141](https://github.com/lestrrat-go/jwx/pull/2141) - jwk: add UnknownKeyTypeError typed error by [@lestrrat](https://github.com/lestrrat) in [#2143](https://github.com/lestrrat-go/jwx/pull/2143) - jwk: document AKP-specific Thumbprint canonicalization on public methods by [@lestrrat](https://github.com/lestrrat) in [#2144](https://github.com/lestrrat-go/jwx/pull/2144) - docs/jwk: use jwk.WithX509(true) in PEM section prose by [@lestrrat](https://github.com/lestrrat) in [#2145](https://github.com/lestrrat-go/jwx/pull/2145) - docs/jwk: document EncodePEM emit-to-PEM path by [@lestrrat](https://github.com/lestrrat) in [#2146](https://github.com/lestrrat-go/jwx/pull/2146) - MIGRATION: document PublicSetOf default-reject for symmetric keys by [@lestrrat](https://github.com/lestrrat) in [#2147](https://github.com/lestrrat-go/jwx/pull/2147) - jwk: clarify that any value <= 0 disables the RSA strength floor by [@lestrrat](https://github.com/lestrrat) in [#2148](https://github.com/lestrrat-go/jwx/pull/2148) - jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by [@lestrrat](https://github.com/lestrrat) in [#2149](https://github.com/lestrrat-go/jwx/pull/2149) - jwk: correct Import godoc for crypto/ecdh dispatch by [@lestrrat](https://github.com/lestrrat) in [#2150](https://github.com/lestrrat-go/jwx/pull/2150) - jwk: surface Export type mismatch as KeyTypeMismatchError by [@lestrrat](https://github.com/lestrrat) in [#2151](https://github.com/lestrrat-go/jwx/pull/2151) - jwk: RegisterKeyImporter takes KeyImporter, not a typed function by [@lestrrat](https://github.com/lestrrat) in [#2152](https://github.com/lestrrat-go/jwx/pull/2152) - Changes: draft v4.0.2 release notes by [@lestrrat](https://github.com/lestrrat) in [#2154](https://github.com/lestrrat-go/jwx/pull/2154) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.1...v4.0.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-05-10 01:02:03 +00:00

fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.0.2

renovate/stability-days Updates have met minimum release age requirement

Details

auth0mock / build (pull_request) Successful in 1m28s

Details

ec0c1c8961

renovate scheduled this pull request to auto merge when all checks succeed 2026-05-10 01:02:07 +00:00

renovate merged commit 84402f996a into main

2026-05-10 01:07:38 +00:00

renovate deleted branch renovate/github.com-lestrrat-go-jwx-v4-4.x

2026-05-10 01:07:39 +00:00