Update module github.com/lestrrat-go/jwx/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.2.0 → v4.5.0

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.5.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​2318
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​2322
• [v4] deprecate AlgorithmsForKey, move to internal by @​lestrrat in #​2325
• [v4] add jws.WithStrictECDSA sign option by @​lestrrat in #​2327
• [v4] fix curve inference claim in docs by @​lestrrat in #​2329
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​2333
• fix jwk.ParseKey generic guidance in guide skill by @​lestrrat in #​2335
• fix JWKS algorithm inference claim in guide by @​lestrrat in #​2336
• document exact alg match rule in guide by @​lestrrat in #​2337
• note RFC 9864 EdDSA deprecation in guide by @​lestrrat in #​2338
• drop nonexistent v3 and v2 plugin pointers by @​lestrrat in #​2339
• correct ML-DSA import panic claim in guide by @​lestrrat in #​2340
• add jwxfilter to guide companion table by @​lestrrat in #​2341
• build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @​dependabot[bot] in #​2347
• [v4] escape JSON object member names on output by @​lestrrat in #​2348

Full Changelog: lestrrat-go/jwx@v4.4.0...v4.5.0

v4.4.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• implement ML-DSA natively on Go 1.27 by @​lestrrat in #​2309
• use released Go 1.27 in CI by @​lestrrat in #​2308
• move ML-DSA primitives to dsig by @​lestrrat in #​2310
• generate ML-DSA from jwa/objects.yml by @​lestrrat in #​2311
• show both ML-DSA paths in the extensions doc by @​lestrrat in #​2312
• make GOEXPERIMENT conditional on Go 1.26 by @​lestrrat in #​2313
• point ML-DSA doc cache at generated jwa file by @​lestrrat in #​2314
• strip inherited jsonv2 on Go 1.27 by @​lestrrat in #​2315

Full Changelog: lestrrat-go/jwx@v4.3.0...v4.4.0

v4.3.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by @​sueun-dev in #​2275
• add JWE authenticated data option by @​lestrrat in #​2277
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2281
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2284
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2286
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2291
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2294
• fuzz every package, not just the module root by @​lestrrat in #​2295
• retry a fuzz target that fails with no crasher by @​lestrrat in #​2296
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2303
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2302
• fix build under Go 1.27 by @​lestrrat in #​2304

New Contributors

• @​sueun-dev made their first contribution in #​2275

Full Changelog: lestrrat-go/jwx@v4.2.0...v4.3.0

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: point jwkcache references to jwkfetch by @​lestrrat in #​2245
• chore: bump golangci-lint-action to 9.3.0 + sync action versions by @​lestrrat in #​2246
• fix misspellings in code comments by @​lestrrat in #​2248
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by @​dependabot[bot] in #​2256
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2255
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2252
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2259
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2262
• [v4] retain unparseable JWKS entries as UnsupportedKey by @​lestrrat in #​2264
• fix CodeQL autobuild for encoding/json/v2 by @​lestrrat in #​2268
• [v4] let per-call WithRejectDuplicateKID override global by @​lestrrat in #​2269
• [v4] test jwe rejects UnsupportedKey placeholders by @​lestrrat in #​2271
• [v4] doc: warn that global strict JWK set parsing breaks on PQC keys by @​lestrrat in #​2273

Full Changelog: lestrrat-go/jwx@v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: refresh CONTRIBUTING examples link and branch example by @​lestrrat in #​2156
• autodoc updates by @​github-actions[bot] in #​2157
• add dependabot updates for develop/v4 by @​lestrrat in #​2160
• build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​2161
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​2162
• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by @​dependabot[bot] in #​2163
• docs: drop dead jwt error helper references by @​lestrrat in #​2164
• add claude code plugin and supporting docs by @​lestrrat in #​2165
• tighten companion-bulk skill rules by @​lestrrat in #​2166
• docs: add claude code skill install instructions by @​lestrrat in #​2167
• docs: add DeepWiki badge to README by @​lestrrat in #​2168
• ci: make v4 fuzz workflow actually run by @​lestrrat in #​2169
• ci: rotate companion fuzz cache via per-run key by @​lestrrat in #​2170
• docs: explain fuzz template skip-list by @​lestrrat in #​2171
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2175
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2181
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2182
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2185
• build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by @​dependabot[bot] in #​2186
• docs: warn about anchoring RegexpWhitelist patterns by @​lestrrat in #​2187
• autodoc updates by @​github-actions[bot] in #​2188
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2193
• build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​2194
• clear pooled error slice before reuse by @​lestrrat in #​2195
• avoid full-string rune alloc in alg error by @​lestrrat in #​2196
• release json registry lock before decoder call by @​lestrrat in #​2197
• compute cbc-hmac aad bit length in uint64 by @​lestrrat in #​2198
• error on nil curve and oversized d at import by @​lestrrat in #​2199
• error on unavailable thumbprint hash by @​lestrrat in #​2200
• handle nil clock and validator in validate by @​lestrrat in #​2202
• reset private claims on token unmarshal by @​lestrrat in #​2203
• apply jwt settings only when supplied by @​lestrrat in #​2204
• validate use field at jwk parse time by @​lestrrat in #​2205
• document intentional ecdsa high-s acceptance by @​lestrrat in #​2213
• read jwe zip only from protected header by @​lestrrat in #​2206
• enforce aead wire tag and iv length on decrypt by @​lestrrat in #​2207
• require 8-octet minimum pbes2 salt by @​lestrrat in #​2208
• require empty encrypted_key for direct cek by @​lestrrat in #​2209
• error on wrong-length ed25519 key by @​lestrrat in #​2201
• enforce protected alg match in jws verify by @​lestrrat in #​2212
• document intentional lenient base64 in verify by @​lestrrat in #​2214
• reject detached payload when payload present by @​lestrrat in #​2211
• document jwk alg is informational, not validated by @​lestrrat in #​2215
• document symmetric key length not validated by @​lestrrat in #​2216
• document rsa private params not validated by @​lestrrat in #​2217
• note AlgorithmsForKey does not validate key length by @​lestrrat in #​2222
• document okp public key not bound to scalar by @​lestrrat in #​2219
• document Chain.Get returns aliased read-only slice by @​lestrrat in #​2220
• fix WithPedantic doc: typ is not checked by @​lestrrat in #​2221
• document ec private scalar not bound to point by @​lestrrat in #​2218
• extend direct-mode empty key guard to ml-kem by @​lestrrat in #​2223
• add bazel test target for internal/json by @​lestrrat in #​2224
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2227
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2232
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2233
• fix: reject duplicate JOSE headers on fast path by @​lestrrat in #​2236
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2239
• docs: add unreleased Changes entries by @​lestrrat in #​2240
• chore: run jwkfetch in companion test sweep by @​lestrrat in #​2244

Full Changelog: lestrrat-go/jwx@v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

• ci: print coverage summary in GitHub Actions run summary by @​lestrrat in #​2078
• ci: also run on push to target branches by @​lestrrat in #​2079
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2080
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2082
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2084
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2086
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2088
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2090
• jwt: Settings rejects out-of-range NumericDate precision by @​lestrrat in #​2092
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2093
• jwt: reshape base64-corruption hint as diagnosis-first by @​lestrrat in #​2095
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2098
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2096
• jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @​lestrrat in #​2100
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2101
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2103
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2105
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2107
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2109
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2111
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2113
• jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @​lestrrat in #​2115
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2116
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2118
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2120
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2122
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2124
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2126
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2128
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2130
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2132
• jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @​lestrrat in #​2134
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2136
• jwk: probe tolerates duplicate JSON field names by @​lestrrat in #​2138
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2139
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2141
• jwk: add UnknownKeyTypeError typed error by @​lestrrat in #​2143
• jwk: document AKP-specific Thumbprint canonicalization on public methods by @​lestrrat in #​2144
• docs/jwk: use jwk.WithX509(true) in PEM section prose by @​lestrrat in #​2145
• docs/jwk: document EncodePEM emit-to-PEM path by @​lestrrat in #​2146
• MIGRATION: document PublicSetOf default-reject for symmetric keys by @​lestrrat in #​2147
• jwk: clarify that any value <= 0 disables the RSA strength floor by @​lestrrat in #​2148
• jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @​lestrrat in #​2149
• jwk: correct Import godoc for crypto/ecdh dispatch by @​lestrrat in #​2150
• jwk: surface Export type mismatch as KeyTypeMismatchError by @​lestrrat in #​2151
• jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @​lestrrat in #​2152
• Changes: draft v4.0.2 release notes by @​lestrrat in #​2154

Full Changelog: lestrrat-go/jwx@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in #​2041
• autodoc updates by @​github-actions[bot] in #​2042
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in #​2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2051
• autodoc updates by @​github-actions[bot] in #​2053
• docs: document PrivateClaims concurrency contract by @​lestrrat in #​2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in #​2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in #​2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in #​2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2070
• autodoc updates by @​github-actions[bot] in #​2069
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in #​2076

Full Changelog: lestrrat-go/jwx@v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

v3.3.0

Compare Source

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2280
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2283
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2287
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2290
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2293
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2301
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2299
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @​dependabot[bot] in #​2306
• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in #​2316
• build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @​dependabot[bot] in #​2319
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​2321
• [v3] deprecate AlgorithmsForKey, move to internal by @​lestrrat in #​2326
• [v3] add jws.WithStrictECDSA sign option by @​lestrrat in #​2328
• [v3] fix curve inference claim in docs by @​lestrrat in #​2330
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​2332
• add example for bounded WithWaitReady wait by @​lestrrat in #​2343
• show fetch failure cause via error sink by @​lestrrat in #​2344
• [v3] escape JSON object member names on output by @​lestrrat in #​2349

Full Changelog: lestrrat-go/jwx@v3.2.0...v3.3.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

no patch pinning of the go version

[jhrozek]

blocking this comes with an incompatible change