fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.1.0 #361

2026-07-04T05:01:27Z

renovate commented

2026-07-04 05:01:27 +00:00

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v4	`v4.0.2` → `v4.1.0`

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)

`v4.1.0`

Compare Source

For more detailed release notes, see Changes.

What's Changed

docs: refresh CONTRIBUTING examples link and branch example by @lestrrat in #2156
autodoc updates by @github-actions[bot] in #2157
add dependabot updates for develop/v4 by @lestrrat in #2160
build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #2161
build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by @dependabot[bot] in #2162
build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by @dependabot[bot] in #2163
docs: drop dead jwt error helper references by @lestrrat in #2164
add claude code plugin and supporting docs by @lestrrat in #2165
tighten companion-bulk skill rules by @lestrrat in #2166
docs: add claude code skill install instructions by @lestrrat in #2167
docs: add DeepWiki badge to README by @lestrrat in #2168
ci: make v4 fuzz workflow actually run by @lestrrat in #2169
ci: rotate companion fuzz cache via per-run key by @lestrrat in #2170
docs: explain fuzz template skip-list by @lestrrat in #2171
build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @dependabot[bot] in #2175
build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2181
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2182
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2185
build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by @dependabot[bot] in #2186
docs: warn about anchoring RegexpWhitelist patterns by @lestrrat in #2187
autodoc updates by @github-actions[bot] in #2188
build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #2193
build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by @dependabot[bot] in #2194
clear pooled error slice before reuse by @lestrrat in #2195
avoid full-string rune alloc in alg error by @lestrrat in #2196
release json registry lock before decoder call by @lestrrat in #2197
compute cbc-hmac aad bit length in uint64 by @lestrrat in #2198
error on nil curve and oversized d at import by @lestrrat in #2199
error on unavailable thumbprint hash by @lestrrat in #2200
handle nil clock and validator in validate by @lestrrat in #2202
reset private claims on token unmarshal by @lestrrat in #2203
apply jwt settings only when supplied by @lestrrat in #2204
validate use field at jwk parse time by @lestrrat in #2205
document intentional ecdsa high-s acceptance by @lestrrat in #2213
read jwe zip only from protected header by @lestrrat in #2206
enforce aead wire tag and iv length on decrypt by @lestrrat in #2207
require 8-octet minimum pbes2 salt by @lestrrat in #2208
require empty encrypted_key for direct cek by @lestrrat in #2209
error on wrong-length ed25519 key by @lestrrat in #2201
enforce protected alg match in jws verify by @lestrrat in #2212
document intentional lenient base64 in verify by @lestrrat in #2214
reject detached payload when payload present by @lestrrat in #2211
document jwk alg is informational, not validated by @lestrrat in #2215
document symmetric key length not validated by @lestrrat in #2216
document rsa private params not validated by @lestrrat in #2217
note AlgorithmsForKey does not validate key length by @lestrrat in #2222
document okp public key not bound to scalar by @lestrrat in #2219
document Chain.Get returns aliased read-only slice by @lestrrat in #2220
fix WithPedantic doc: typ is not checked by @lestrrat in #2221
document ec private scalar not bound to point by @lestrrat in #2218
extend direct-mode empty key guard to ml-kem by @lestrrat in #2223
add bazel test target for internal/json by @lestrrat in #2224
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2227
build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @dependabot[bot] in #2232
build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #2233
fix: reject duplicate JOSE headers on fast path by @lestrrat in #2236
build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @dependabot[bot] in #2239
docs: add unreleased Changes entries by @lestrrat in #2240
chore: run jwkfetch in companion test sweep by @lestrrat in #2244

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [github.com/lestrrat-go/jwx/v4](https://github.com/lestrrat-go/jwx) | `v4.0.2` → `v4.1.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flestrrat-go%2fjwx%2fv4/v4.0.2/v4.1.0?slim=true) | --- ### Release Notes <details> <summary>lestrrat-go/jwx (github.com/lestrrat-go/jwx/v4)</summary> ### [`v4.1.0`](https://github.com/lestrrat-go/jwx/releases/tag/v4.1.0) [Compare Source](https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0) For more detailed release notes, see [Changes](https://github.com/lestrrat-go/jwx/blob/v4.1.0/Changes). #### What's Changed - docs: refresh CONTRIBUTING examples link and branch example by [@lestrrat](https://github.com/lestrrat) in [#2156](https://github.com/lestrrat-go/jwx/pull/2156) - autodoc updates by [@github-actions](https://github.com/github-actions)\[bot] in [#2157](https://github.com/lestrrat-go/jwx/pull/2157) - add dependabot updates for develop/v4 by [@lestrrat](https://github.com/lestrrat) in [#2160](https://github.com/lestrrat-go/jwx/pull/2160) - build(deps): bump actions/cache from 5.0.4 to 5.0.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#2161](https://github.com/lestrrat-go/jwx/pull/2161) - build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2162](https://github.com/lestrrat-go/jwx/pull/2162) - build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2163](https://github.com/lestrrat-go/jwx/pull/2163) - docs: drop dead jwt error helper references by [@lestrrat](https://github.com/lestrrat) in [#2164](https://github.com/lestrrat-go/jwx/pull/2164) - add claude code plugin and supporting docs by [@lestrrat](https://github.com/lestrrat) in [#2165](https://github.com/lestrrat-go/jwx/pull/2165) - tighten companion-bulk skill rules by [@lestrrat](https://github.com/lestrrat) in [#2166](https://github.com/lestrrat-go/jwx/pull/2166) - docs: add claude code skill install instructions by [@lestrrat](https://github.com/lestrrat) in [#2167](https://github.com/lestrrat-go/jwx/pull/2167) - docs: add DeepWiki badge to README by [@lestrrat](https://github.com/lestrrat) in [#2168](https://github.com/lestrrat-go/jwx/pull/2168) - ci: make v4 fuzz workflow actually run by [@lestrrat](https://github.com/lestrrat) in [#2169](https://github.com/lestrrat-go/jwx/pull/2169) - ci: rotate companion fuzz cache via per-run key by [@lestrrat](https://github.com/lestrrat) in [#2170](https://github.com/lestrrat-go/jwx/pull/2170) - docs: explain fuzz template skip-list by [@lestrrat](https://github.com/lestrrat) in [#2171](https://github.com/lestrrat-go/jwx/pull/2171) - build(deps): bump actions/stale from 10.2.0 to 10.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2175](https://github.com/lestrrat-go/jwx/pull/2175) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2181](https://github.com/lestrrat-go/jwx/pull/2181) - build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#2182](https://github.com/lestrrat-go/jwx/pull/2182) - build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#2185](https://github.com/lestrrat-go/jwx/pull/2185) - build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2186](https://github.com/lestrrat-go/jwx/pull/2186) - docs: warn about anchoring RegexpWhitelist patterns by [@lestrrat](https://github.com/lestrrat) in [#2187](https://github.com/lestrrat-go/jwx/pull/2187) - autodoc updates by [@github-actions](https://github.com/github-actions)\[bot] in [#2188](https://github.com/lestrrat-go/jwx/pull/2188) - build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2193](https://github.com/lestrrat-go/jwx/pull/2193) - build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#2194](https://github.com/lestrrat-go/jwx/pull/2194) - clear pooled error slice before reuse by [@lestrrat](https://github.com/lestrrat) in [#2195](https://github.com/lestrrat-go/jwx/pull/2195) - avoid full-string rune alloc in alg error by [@lestrrat](https://github.com/lestrrat) in [#2196](https://github.com/lestrrat-go/jwx/pull/2196) - release json registry lock before decoder call by [@lestrrat](https://github.com/lestrrat) in [#2197](https://github.com/lestrrat-go/jwx/pull/2197) - compute cbc-hmac aad bit length in uint64 by [@lestrrat](https://github.com/lestrrat) in [#2198](https://github.com/lestrrat-go/jwx/pull/2198) - error on nil curve and oversized d at import by [@lestrrat](https://github.com/lestrrat) in [#2199](https://github.com/lestrrat-go/jwx/pull/2199) - error on unavailable thumbprint hash by [@lestrrat](https://github.com/lestrrat) in [#2200](https://github.com/lestrrat-go/jwx/pull/2200) - handle nil clock and validator in validate by [@lestrrat](https://github.com/lestrrat) in [#2202](https://github.com/lestrrat-go/jwx/pull/2202) - reset private claims on token unmarshal by [@lestrrat](https://github.com/lestrrat) in [#2203](https://github.com/lestrrat-go/jwx/pull/2203) - apply jwt settings only when supplied by [@lestrrat](https://github.com/lestrrat) in [#2204](https://github.com/lestrrat-go/jwx/pull/2204) - validate use field at jwk parse time by [@lestrrat](https://github.com/lestrrat) in [#2205](https://github.com/lestrrat-go/jwx/pull/2205) - document intentional ecdsa high-s acceptance by [@lestrrat](https://github.com/lestrrat) in [#2213](https://github.com/lestrrat-go/jwx/pull/2213) - read jwe zip only from protected header by [@lestrrat](https://github.com/lestrrat) in [#2206](https://github.com/lestrrat-go/jwx/pull/2206) - enforce aead wire tag and iv length on decrypt by [@lestrrat](https://github.com/lestrrat) in [#2207](https://github.com/lestrrat-go/jwx/pull/2207) - require 8-octet minimum pbes2 salt by [@lestrrat](https://github.com/lestrrat) in [#2208](https://github.com/lestrrat-go/jwx/pull/2208) - require empty encrypted\_key for direct cek by [@lestrrat](https://github.com/lestrrat) in [#2209](https://github.com/lestrrat-go/jwx/pull/2209) - error on wrong-length [`ed25519`](https://github.com/lestrrat-go/jwx/commit/ed25519) key by [@lestrrat](https://github.com/lestrrat) in [#2201](https://github.com/lestrrat-go/jwx/pull/2201) - enforce protected alg match in jws verify by [@lestrrat](https://github.com/lestrrat) in [#2212](https://github.com/lestrrat-go/jwx/pull/2212) - document intentional lenient base64 in verify by [@lestrrat](https://github.com/lestrrat) in [#2214](https://github.com/lestrrat-go/jwx/pull/2214) - reject detached payload when payload present by [@lestrrat](https://github.com/lestrrat) in [#2211](https://github.com/lestrrat-go/jwx/pull/2211) - document jwk alg is informational, not validated by [@lestrrat](https://github.com/lestrrat) in [#2215](https://github.com/lestrrat-go/jwx/pull/2215) - document symmetric key length not validated by [@lestrrat](https://github.com/lestrrat) in [#2216](https://github.com/lestrrat-go/jwx/pull/2216) - document rsa private params not validated by [@lestrrat](https://github.com/lestrrat) in [#2217](https://github.com/lestrrat-go/jwx/pull/2217) - note AlgorithmsForKey does not validate key length by [@lestrrat](https://github.com/lestrrat) in [#2222](https://github.com/lestrrat-go/jwx/pull/2222) - document okp public key not bound to scalar by [@lestrrat](https://github.com/lestrrat) in [#2219](https://github.com/lestrrat-go/jwx/pull/2219) - document Chain.Get returns aliased read-only slice by [@lestrrat](https://github.com/lestrrat) in [#2220](https://github.com/lestrrat-go/jwx/pull/2220) - fix WithPedantic doc: typ is not checked by [@lestrrat](https://github.com/lestrrat) in [#2221](https://github.com/lestrrat-go/jwx/pull/2221) - document ec private scalar not bound to point by [@lestrrat](https://github.com/lestrrat) in [#2218](https://github.com/lestrrat-go/jwx/pull/2218) - extend direct-mode empty key guard to ml-kem by [@lestrrat](https://github.com/lestrrat) in [#2223](https://github.com/lestrrat-go/jwx/pull/2223) - add bazel test target for internal/json by [@lestrrat](https://github.com/lestrrat) in [#2224](https://github.com/lestrrat-go/jwx/pull/2224) - build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2227](https://github.com/lestrrat-go/jwx/pull/2227) - build(deps): bump actions/cache from 5.0.5 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2232](https://github.com/lestrrat-go/jwx/pull/2232) - build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2233](https://github.com/lestrrat-go/jwx/pull/2233) - fix: reject duplicate JOSE headers on fast path by [@lestrrat](https://github.com/lestrrat) in [#2236](https://github.com/lestrrat-go/jwx/pull/2236) - build(deps): bump actions/cache from 6.0.0 to 6.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#2239](https://github.com/lestrrat-go/jwx/pull/2239) - docs: add unreleased Changes entries by [@lestrrat](https://github.com/lestrrat) in [#2240](https://github.com/lestrrat-go/jwx/pull/2240) - chore: run jwkfetch in companion test sweep by [@lestrrat](https://github.com/lestrrat) in [#2244](https://github.com/lestrrat-go/jwx/pull/2244) **Full Changelog**: <https://github.com/lestrrat-go/jwx/compare/v4.0.2...v4.1.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added 1 commit 2026-07-04 05:01:28 +00:00

fix(deps): update module github.com/lestrrat-go/jwx/v4 to v4.1.0

renovate/stability-days Updates have met minimum release age requirement

Details

auth0mock / build (pull_request) Successful in 1m6s

Details

05b61b4c52

renovate scheduled this pull request to auto merge when all checks succeed 2026-07-04 05:01:29 +00:00

renovate merged commit 714d67d093 into main

2026-07-04 05:05:36 +00:00

renovate deleted branch renovate/github.com-lestrrat-go-jwx-v4-4.x

2026-07-04 05:05:38 +00:00