[dependabot]

Bumps github.com/lestrrat-go/jwx/v3 from 3.3.0 to 3.4.0.

Release notes

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.4.0

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @​dependabot[bot] in lestrrat-go/jwx#2352
• build(deps): bump github/codeql-action from 4.38.0 to 4.38.2 by @​dependabot[bot] in lestrrat-go/jwx#2361
• build(deps): bump github.com/goccy/go-json from 0.10.6 to 0.11.0 by @​dependabot[bot] in lestrrat-go/jwx#2364
• build(deps): bump github.com/goccy/go-json from 0.11.0 to 0.11.2 by @​dependabot[bot] in lestrrat-go/jwx#2371
• [v3] keep trying jwe key providers after errors by @​lestrrat in lestrrat-go/jwx#2385
• [v3] allow empty jwe ciphertext in JSON form by @​lestrrat in lestrrat-go/jwx#2387
• [v3] write jwe unprotected header as JSON object by @​lestrrat in lestrrat-go/jwx#2389
• [v3] jwsbb: size SignBuffer per encoded part by @​lestrrat in lestrrat-go/jwx#2401
• [v3] jwe: find WithKeySet kid in protected header by @​lestrrat in lestrrat-go/jwx#2405
• [v3] jwt: honor NumericDate format precision by @​lestrrat in lestrrat-go/jwx#2410
• [v3] jwt: parse negative NumericDate values by @​lestrrat in lestrrat-go/jwx#2412
• [v3] jwt: parse decimal NumericDate values exactly by @​lestrrat in lestrrat-go/jwx#2414
• build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @​dependabot[bot] in lestrrat-go/jwx#2419
• [v3] jws: sign only the transmitted header by @​lestrrat in lestrrat-go/jwx#2416
• [v3] jws: add opt-in WithAlgorithmMatch by @​lestrrat in lestrrat-go/jwx#2423
• build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by @​dependabot[bot] in lestrrat-go/jwx#2427
• use crypto/pbkdf2 and drop x/crypto by @​lestrrat in lestrrat-go/jwx#2431
• [v3] jws: add WithVerifiedSignature verify option by @​lestrrat in lestrrat-go/jwx#2436
• [v3] jwe: add WithDecryptedRecipient decrypt option by @​lestrrat in lestrrat-go/jwx#2440
• [v3] jws: fix crit and multi-signature docs by @​lestrrat in lestrrat-go/jwx#2437
• [v3] jwe: document per-recipient headers by @​lestrrat in lestrrat-go/jwx#2441
• [v3] jws: fix comment in header example by @​lestrrat in lestrrat-go/jwx#2447
• [v3] release v3.4.0 by @​lestrrat in lestrrat-go/jwx#2449

Full Changelog: lestrrat-go/jwx@v3.3.0...v3.4.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

v3.4.0 23 Oct 2026

• [jwe] jwe.Decrypt now tries each key provider in turn and moves on to the next one when a provider returns an error, as jws.Verify does. For example, jwe.WithKeySet with a set that has no usable key, followed by a working jwe.WithKey, decrypts with the working key. If no key works, the returned error wraps the last failure, so errors.Is can find it. (#2385)

• [jwe] JSON serialization of a JWE now always includes the ciphertext member, jwe.Parse now accepts an empty ciphertext, and jwe.Decrypt now returns an empty payload for it. A JWE that encrypts an empty plaintext with AES-GCM therefore round-trips through jwe.Encrypt(..., jwe.WithJSON()), jwe.Parse, json.Marshal, and jwe.Decrypt. A missing, null, or non-string ciphertext is still rejected, and the iv and tag members must still be non-empty. (#2387)

• [jwe] jwe.Decrypt now rejects a message whose tag or iv is not exactly the length the content encryption algorithm uses. Bytes can no longer be moved between ciphertext and tag to produce a different message that still decrypts. (#2387)

• [jwe] JSON serialization of a JWE now writes the shared unprotected header as a JSON object, as RFC 7516 requires. A JWE with a shared unprotected header therefore round-trips through jwe.Parse, json.Marshal, jwe.Parse, and jwe.Decrypt. (#2389)

• [jwt] jwt.WithNumericDateFormatPrecision now applies when a token is serialized. It covers the exp, iat, and nbf claims of jwt.Token, and those claims plus updated_at in openid.Token. Previously the option never had any effect on serialized tokens, which always wrote these claims as whole seconds.

  With a precision above 0, a date that has a fraction is written as a JSON number with up to that many fractional digits. Extra digits are rounded down, toward the earlier time, and trailing zeros are removed. At precision 3, an iat of 2000000000.123456789 is written as 2000000000.123, and 2000000000.1 as 2000000000.1. A date with no fraction is written as an integer, and output at the default precision of 0 is unchanged. Callers who set a precision above 0 will see fractional dates in their tokens, in the bytes jwt.Sign signs, and in what jwt.Equal compares. (#2410)

• [jwt] NumericDate claims such as exp, iat, and nbf now parse negative values, which are dates before 1970, with or without jwt.WithNumericDateParsePedantic(true). The sign covers the fraction too, so -1.5 is one and a half seconds before the epoch. Fractional digits beyond jwt.WithNumericDateParsePrecision are rounded down, toward the earlier time, the same way serialization rounds: at the default precision of 0, -1.5 parses as -2. Positive values parse as before.

... (truncated)

Commits

• 86f71b2 Merge pull request #2449 from lestrrat-go/chore-v3-release-3.4.0
• c22fdc8 release v3.4.0
• eff2810 jws: fix signature index comment in header example (#2447)
• 4aa8e99 Merge pull request #2441 from lestrrat-go/docs-v3-jwe-per-recipient-headers
• 0b44bc9 Merge pull request #2437 from lestrrat-go/docs-v3-jws-crit-extension
• ac1ed67 merge develop/v3
• 33bd92f Merge pull request #2440 from lestrrat-go/feat-v3-jwe-decrypted-recipient
• a99856c merge develop/v3
• 9853f21 merge develop/v3
• 102b593 Merge pull request #2436 from lestrrat-go/feat-v3-jws-verified-signature
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)