Update module github.com/lestrrat-go/jwx/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.2.0 → v4.2.0

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: point jwkcache references to jwkfetch by @​lestrrat in #​2245
• chore: bump golangci-lint-action to 9.3.0 + sync action versions by @​lestrrat in #​2246
• fix misspellings in code comments by @​lestrrat in #​2248
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by @​dependabot[bot] in #​2256
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2255
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2252
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2259
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2262
• [v4] retain unparseable JWKS entries as UnsupportedKey by @​lestrrat in #​2264
• fix CodeQL autobuild for encoding/json/v2 by @​lestrrat in #​2268
• [v4] let per-call WithRejectDuplicateKID override global by @​lestrrat in #​2269
• [v4] test jwe rejects UnsupportedKey placeholders by @​lestrrat in #​2271
• [v4] doc: warn that global strict JWK set parsing breaks on PQC keys by @​lestrrat in #​2273

Full Changelog: lestrrat-go/jwx@v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: refresh CONTRIBUTING examples link and branch example by @​lestrrat in #​2156
• autodoc updates by @​github-actions[bot] in #​2157
• add dependabot updates for develop/v4 by @​lestrrat in #​2160
• build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​2161
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​2162
• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by @​dependabot[bot] in #​2163
• docs: drop dead jwt error helper references by @​lestrrat in #​2164
• add claude code plugin and supporting docs by @​lestrrat in #​2165
• tighten companion-bulk skill rules by @​lestrrat in #​2166
• docs: add claude code skill install instructions by @​lestrrat in #​2167
• docs: add DeepWiki badge to README by @​lestrrat in #​2168
• ci: make v4 fuzz workflow actually run by @​lestrrat in #​2169
• ci: rotate companion fuzz cache via per-run key by @​lestrrat in #​2170
• docs: explain fuzz template skip-list by @​lestrrat in #​2171
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2175
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2181
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2182
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2185
• build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by @​dependabot[bot] in #​2186
• docs: warn about anchoring RegexpWhitelist patterns by @​lestrrat in #​2187
• autodoc updates by @​github-actions[bot] in #​2188
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2193
• build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​2194
• clear pooled error slice before reuse by @​lestrrat in #​2195
• avoid full-string rune alloc in alg error by @​lestrrat in #​2196
• release json registry lock before decoder call by @​lestrrat in #​2197
• compute cbc-hmac aad bit length in uint64 by @​lestrrat in #​2198
• error on nil curve and oversized d at import by @​lestrrat in #​2199
• error on unavailable thumbprint hash by @​lestrrat in #​2200
• handle nil clock and validator in validate by @​lestrrat in #​2202
• reset private claims on token unmarshal by @​lestrrat in #​2203
• apply jwt settings only when supplied by @​lestrrat in #​2204
• validate use field at jwk parse time by @​lestrrat in #​2205
• document intentional ecdsa high-s acceptance by @​lestrrat in #​2213
• read jwe zip only from protected header by @​lestrrat in #​2206
• enforce aead wire tag and iv length on decrypt by @​lestrrat in #​2207
• require 8-octet minimum pbes2 salt by @​lestrrat in #​2208
• require empty encrypted_key for direct cek by @​lestrrat in #​2209
• error on wrong-length ed25519 key by @​lestrrat in #​2201
• enforce protected alg match in jws verify by @​lestrrat in #​2212
• document intentional lenient base64 in verify by @​lestrrat in #​2214
• reject detached payload when payload present by @​lestrrat in #​2211
• document jwk alg is informational, not validated by @​lestrrat in #​2215
• document symmetric key length not validated by @​lestrrat in #​2216
• document rsa private params not validated by @​lestrrat in #​2217
• note AlgorithmsForKey does not validate key length by @​lestrrat in #​2222
• document okp public key not bound to scalar by @​lestrrat in #​2219
• document Chain.Get returns aliased read-only slice by @​lestrrat in #​2220
• fix WithPedantic doc: typ is not checked by @​lestrrat in #​2221
• document ec private scalar not bound to point by @​lestrrat in #​2218
• extend direct-mode empty key guard to ml-kem by @​lestrrat in #​2223
• add bazel test target for internal/json by @​lestrrat in #​2224
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2227
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2232
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2233
• fix: reject duplicate JOSE headers on fast path by @​lestrrat in #​2236
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2239
• docs: add unreleased Changes entries by @​lestrrat in #​2240
• chore: run jwkfetch in companion test sweep by @​lestrrat in #​2244

Full Changelog: lestrrat-go/jwx@v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

• ci: print coverage summary in GitHub Actions run summary by @​lestrrat in #​2078
• ci: also run on push to target branches by @​lestrrat in #​2079
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2080
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2082
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2084
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2086
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2088
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2090
• jwt: Settings rejects out-of-range NumericDate precision by @​lestrrat in #​2092
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2093
• jwt: reshape base64-corruption hint as diagnosis-first by @​lestrrat in #​2095
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2098
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2096
• jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @​lestrrat in #​2100
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2101
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2103
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2105
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2107
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2109
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2111
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2113
• jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @​lestrrat in #​2115
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2116
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2118
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2120
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2122
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2124
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2126
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2128
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2130
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2132
• jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @​lestrrat in #​2134
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2136
• jwk: probe tolerates duplicate JSON field names by @​lestrrat in #​2138
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2139
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2141
• jwk: add UnknownKeyTypeError typed error by @​lestrrat in #​2143
• jwk: document AKP-specific Thumbprint canonicalization on public methods by @​lestrrat in #​2144
• docs/jwk: use jwk.WithX509(true) in PEM section prose by @​lestrrat in #​2145
• docs/jwk: document EncodePEM emit-to-PEM path by @​lestrrat in #​2146
• MIGRATION: document PublicSetOf default-reject for symmetric keys by @​lestrrat in #​2147
• jwk: clarify that any value <= 0 disables the RSA strength floor by @​lestrrat in #​2148
• jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @​lestrrat in #​2149
• jwk: correct Import godoc for crypto/ecdh dispatch by @​lestrrat in #​2150
• jwk: surface Export type mismatch as KeyTypeMismatchError by @​lestrrat in #​2151
• jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @​lestrrat in #​2152
• Changes: draft v4.0.2 release notes by @​lestrrat in #​2154

Full Changelog: lestrrat-go/jwx@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in #​2041
• autodoc updates by @​github-actions[bot] in #​2042
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in #​2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2051
• autodoc updates by @​github-actions[bot] in #​2053
• docs: document PrivateClaims concurrency contract by @​lestrrat in #​2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in #​2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in #​2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in #​2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2070
• autodoc updates by @​github-actions[bot] in #​2069
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in #​2076

Full Changelog: lestrrat-go/jwx@v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26 -> 1.26.0

no patch pinning of the go version

[jhrozek]

blocking this comes with an incompatible change