Skip to content

Bump github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0 - #77

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.3.0
Closed

Bump github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0#77
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0.

Release notes

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.3.0

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing " could close its own member and add members the application never set. For example, calling Set with the name x":0,"admin produced a signed token containing "admin":true. Every name now yields exactly one member, and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix.

For more detailed release notes, see Changes.

What's Changed

Full Changelog: lestrrat-go/jwx@v3.2.0...v3.3.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

Changes

v4 has many incompatibilities with v3. To see the full list of differences between v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.5.0 8 September 2026

  • [jwt][jws][jwe][jwk] Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing " could close its own member and add members the application never set. For example, calling Set with the name x":0,"admin produced a signed token containing "admin":true. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw.

    If your application accepts custom names from callers, an exact-match allowlist was never affected. A blocklist of reserved names, or an allowlist by namespace prefix, could be bypassed by this defect. Both are reasonable designs; the bug was in the serializer. Prefer an exact-match allowlist, and if you accept a prefix, require the rest of the name to be a plain identifier.

    Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 contain the same code and are unmaintained; see SECURITY.md. (GHSA-4cf7-xm37-g63h)

  • [jws] Added jws.WithStrictECDSA(bool), a jws.Sign option that rejects anything RFC 7518 forbids for an ECDSA signature. Today that is Section 3.4's binding of ES256 to P-256, ES384 to P-384, and ES512 to P-521, so signing a P-521 key under jwa.ES256() fails instead of producing a JWS that other JOSE implementations reject.

    The default is unchanged: without the option, a mismatched curve and algorithm still sign exactly as before. jws.Verify is unaffected either way. jwt.Sign callers can reach the option through jwt.WithSignOption(jws.WithStrictECDSA(true)). (#2323)

v4.4.0 20 August 2026

  • [jwa][jwk][jws] ML-DSA (FIPS 204) is now implemented natively when jwx is built with Go 1.27 or later, where crypto/mldsa is part of the standard library. jwa.MLDSA44(), jwa.MLDSA65() and jwa.MLDSA87() are registered automatically, and *mldsa.PrivateKey / *mldsa.PublicKey values from crypto/mldsa work directly with jws.Sign, jws.Verify, jwk.Import and jwk.Export. No extension module and no side-effect import are required.

    On Go 1.26 the algorithms are not registered at all, so jws.Sign and jws.Verify report them as unsupported instead of failing later with a confusing key error. ML-DSA on Go 1.26 still needs github.com/jwx-go/mldsa/v4. That extension remains safe to import on

... (truncated)

Commits
  • 0bbd1a7 release v3.3.0
  • 0fdfe98 [v3] escape JSON object member names on output (#2349)
  • bc19585 show fetch failure cause via error sink (#2344)
  • fbb3514 add example for bounded WithWaitReady wait (#2343)
  • 601b51b build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#2332)
  • 4de1087 fix curve inference claim in classifier docs (#2330)
  • 1d28f61 [v3] add jws.WithStrictECDSA sign option (#2328)
  • a52656d Merge pull request #2326 from lestrrat-go/refactor-v3-jws-keyalg-internal
  • e6236d3 deprecate AlgorithmsForKey, move to internal
  • e931dd0 build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#2321)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0
35b6121 
Bumps [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/lestrrat-go/jwx/releases)
- [Changelog](https://github.com/lestrrat-go/jwx/blob/develop/v4/Changes)
- [Commits](lestrrat-go/jwx@v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: github.com/lestrrat-go/jwx/v3
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Looks like github.com/lestrrat-go/jwx/v3 is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 1, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/lestrrat-go/jwx/v3-3.3.0 branch October 1, 2026 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants