[dependabot]

Bumps github.com/lestrrat-go/jwx/v4 from 4.5.0 to 4.6.0.

Release notes

Sourced from github.com/lestrrat-go/jwx/v4's releases.

v4.6.0

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @​dependabot[bot] in lestrrat-go/jwx#2354
• build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @​dependabot[bot] in lestrrat-go/jwx#2353
• update jwx v4 guide by @​lestrrat in lestrrat-go/jwx#2355
• require guide skill tests after API changes by @​lestrrat in lestrrat-go/jwx#2356
• build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 by @​dependabot[bot] in lestrrat-go/jwx#2359
• build(deps): bump github/codeql-action from 4.38.1 to 4.38.2 by @​dependabot[bot] in lestrrat-go/jwx#2362
• jwt: reject overflowing NumericDate values by @​lestrrat in lestrrat-go/jwx#2368
• jwt: require numbers for pedantic NumericDate by @​lestrrat in lestrrat-go/jwx#2369
• jws: support strict ECDSA curve checking during verification by @​skarm in lestrrat-go/jwx#2367
• [v4] replace fastjson header probes with jsontext by @​lestrrat in lestrrat-go/jwx#2379
• [v4] allow jwk set mutation during iteration by @​lestrrat in lestrrat-go/jwx#2380
• [v4] fix jwt.Parse fast path with multiple keys by @​lestrrat in lestrrat-go/jwx#2382
• [v4] fix jwt.Equal for map claims and member order by @​lestrrat in lestrrat-go/jwx#2383
• [v4] keep trying jwe key providers after errors by @​lestrrat in lestrrat-go/jwx#2384
• [v4] allow empty jwe ciphertext in JSON form by @​lestrrat in lestrrat-go/jwx#2386
• [v4] write jwe unprotected header as JSON object by @​lestrrat in lestrrat-go/jwx#2388
• handle shrinking JWK sets in verify and decrypt by @​lestrrat in lestrrat-go/jwx#2394
• [v4] jwsbb: size SignBuffer per encoded part by @​lestrrat in lestrrat-go/jwx#2400
• [v4] docs: fix wrong names and links in jwe/jwt by @​lestrrat in lestrrat-go/jwx#2403
• [v4] guide: add nested JWT section by @​lestrrat in lestrrat-go/jwx#2404
• [v4] jwt: honor NumericDate format precision by @​lestrrat in lestrrat-go/jwx#2409
• [v4] jwt: parse negative NumericDate values by @​lestrrat in lestrrat-go/jwx#2411
• [v4] jwt: parse decimal NumericDate values exactly by @​lestrrat in lestrrat-go/jwx#2413
• build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @​dependabot[bot] in lestrrat-go/jwx#2421
• build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @​dependabot[bot] in lestrrat-go/jwx#2420
• [v4] jws: sign only the protected header in JSON by @​lestrrat in lestrrat-go/jwx#2415
• [v4] jwt: retry missing alg through jws.Verify by @​lestrrat in lestrrat-go/jwx#2422
• Fix typo in migration documentation link by @​frostmar in lestrrat-go/jwx#2425
• build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by @​dependabot[bot] in lestrrat-go/jwx#2428
• use crypto/pbkdf2 and drop x/crypto by @​lestrrat in lestrrat-go/jwx#2430
• require latest go patch release by @​lestrrat in lestrrat-go/jwx#2432
• use shields.io for the deepwiki badge by @​lestrrat in lestrrat-go/jwx#2433
• [v4] jws: add WithVerifiedSignature verify option by @​lestrrat in lestrrat-go/jwx#2434
• [v4] jwe: add WithDecryptedRecipient decrypt option by @​lestrrat in lestrrat-go/jwx#2438
• [v4] jws: fix crit and multi-signature docs by @​lestrrat in lestrrat-go/jwx#2435
• [v4] jwe: document per-recipient headers by @​lestrrat in lestrrat-go/jwx#2439
• [v4] ci: run autodoc only for develop/v4 by @​lestrrat in lestrrat-go/jwx#2446
• [v4] release v4.6.0 by @​lestrrat in lestrrat-go/jwx#2448

New Contributors

• @​skarm made their first contribution in lestrrat-go/jwx#2367
• @​frostmar made their first contribution in lestrrat-go/jwx#2425

Full Changelog: lestrrat-go/jwx@v4.5.0...v4.6.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v4's changelog.

v4.6.0 23 October 2026

• [jws][jwk] github.com/valyala/fastjson is no longer a dependency. The header probes in jws/jwsbb and jwk/jwkbb now use encoding/json/v2 and jsontext.

  jwsbb.HeaderParse, jwsbb.HeaderParseCompact, and jwkbb.HeaderParse now reject a header whose strings contain a raw control character, invalid UTF-8, or a lone surrogate escape such as \ud800. The first HeaderGet* call returns the error, and HeaderHas reports false. jws.VerifyCompactFast, and therefore jwt.Parse, now also reject a protected header with a raw control character or invalid UTF-8 in a string, as jws.Verify does. (#2372)

• [jwk] jwk.Set.All() and jwk.Set.Fields() now loop over a copy of the keys or fields taken when each loop starts. The set can therefore be changed inside the loop, for example with AddKey, RemoveKey, Set, or Remove, and those changes do not affect the running loop. (#2373)

• [jwt] jwt.Parse called with exactly two jwt.WithKey options and no other options now tries both keys, so a token signed with either key verifies. Calls with three or more options already tried every key. (#2374)

• [jwt] jwt.Equal now sorts the members of every JSON object, including nested ones, before comparing, so two tokens holding the same map-valued claim always compare equal. This is needed because v4 serializes with encoding/json/v2, which writes map keys in random order (v3's encoding/json sorted them). Raw JSON claims holding the same members in a different order also compare equal. Arrays keep their order and numbers keep their exact digits, so integers above 2^53 that differ still compare unequal. (#2375)

• [jwe] jwe.Decrypt now tries each key provider in turn and moves on to the next one when a provider returns an error, as jws.Verify does. For example, jwe.WithKeySet with a set that has no usable key, followed by a working jwe.WithKey, decrypts with the working key. If no key works, the provider errors are included in the returned error. (#2376)

• [jwe] JSON serialization of a JWE now always includes the ciphertext member, and jwe.Parse now accepts an empty ciphertext. A JWE that encrypts an empty plaintext with AES-GCM therefore round-trips through jwe.Encrypt(..., jwe.WithJSON()), jwe.Parse, and json.Marshal. A missing, null, or non-string ciphertext is still rejected, and the iv and tag members must still be non-empty. (#2377)

• [jwe] JSON serialization of a JWE now writes the shared unprotected header as a JSON object, as RFC 7516 requires. A JWE with a shared unprotected header therefore round-trips through jwe.Parse, json.Marshal, jwe.Parse, and jwe.Decrypt. (#2378)

... (truncated)

Commits

• 4fd7c22 Merge pull request #2448 from lestrrat-go/chore-v4-release-4.6.0
• 6594705 release v4.6.0
• f458a10 ci: run autodoc only for develop/v4 (#2446)
• 968ee04 Merge pull request #2439 from lestrrat-go/docs-v4-jwe-per-recipient-headers
• 786a0db Merge pull request #2435 from lestrrat-go/docs-v4-jws-crit-extension
• ea176ca merge develop/v4
• b220ffa Merge pull request #2438 from lestrrat-go/feat-v4-jwe-decrypted-recipient
• 9492da1 merge develop/v4
• 5f629b8 merge develop/v4
• b011454 Merge pull request #2434 from lestrrat-go/feat-v4-jws-verified-signature
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)