Update module github.com/lestrrat-go/jwx/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.2.0 → v4.4.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.4.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• implement ML-DSA natively on Go 1.27 by @​lestrrat in #​2309
• use released Go 1.27 in CI by @​lestrrat in #​2308
• move ML-DSA primitives to dsig by @​lestrrat in #​2310
• generate ML-DSA from jwa/objects.yml by @​lestrrat in #​2311
• show both ML-DSA paths in the extensions doc by @​lestrrat in #​2312
• make GOEXPERIMENT conditional on Go 1.26 by @​lestrrat in #​2313
• point ML-DSA doc cache at generated jwa file by @​lestrrat in #​2314
• strip inherited jsonv2 on Go 1.27 by @​lestrrat in #​2315

Full Changelog: lestrrat-go/jwx@v4.3.0...v4.4.0

v4.3.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by @​sueun-dev in #​2275
• add JWE authenticated data option by @​lestrrat in #​2277
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in #​2281
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in #​2284
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in #​2286
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in #​2291
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in #​2294
• fuzz every package, not just the module root by @​lestrrat in #​2295
• retry a fuzz target that fails with no crasher by @​lestrrat in #​2296
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in #​2303
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​2302
• fix build under Go 1.27 by @​lestrrat in #​2304

New Contributors

• @​sueun-dev made their first contribution in #​2275

Full Changelog: lestrrat-go/jwx@v4.2.0...v4.3.0

v4.2.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: point jwkcache references to jwkfetch by @​lestrrat in #​2245
• chore: bump golangci-lint-action to 9.3.0 + sync action versions by @​lestrrat in #​2246
• fix misspellings in code comments by @​lestrrat in #​2248
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 in /internal/jwxcodegen by @​dependabot[bot] in #​2256
• build(deps): bump actions/stale from 10.3.0 to 10.4.0 by @​dependabot[bot] in #​2255
• build(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @​dependabot[bot] in #​2252
• build(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by @​dependabot[bot] in #​2259
• build(deps): bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​2262
• [v4] retain unparseable JWKS entries as UnsupportedKey by @​lestrrat in #​2264
• fix CodeQL autobuild for encoding/json/v2 by @​lestrrat in #​2268
• [v4] let per-call WithRejectDuplicateKID override global by @​lestrrat in #​2269
• [v4] test jwe rejects UnsupportedKey placeholders by @​lestrrat in #​2271
• [v4] doc: warn that global strict JWK set parsing breaks on PQC keys by @​lestrrat in #​2273

Full Changelog: lestrrat-go/jwx@v4.1.0...v4.2.0

v4.1.0

Compare Source

For more detailed release notes, see Changes.

What's Changed

• docs: refresh CONTRIBUTING examples link and branch example by @​lestrrat in #​2156
• autodoc updates by @​github-actions[bot] in #​2157
• add dependabot updates for develop/v4 by @​lestrrat in #​2160
• build(deps): bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in #​2161
• build(deps): bump golang.org/x/crypto from 0.49.0 to 0.51.0 by @​dependabot[bot] in #​2162
• build(deps): bump pozil/auto-assign-issue from 2.2.0 to 3.0.0 by @​dependabot[bot] in #​2163
• docs: drop dead jwt error helper references by @​lestrrat in #​2164
• add claude code plugin and supporting docs by @​lestrrat in #​2165
• tighten companion-bulk skill rules by @​lestrrat in #​2166
• docs: add claude code skill install instructions by @​lestrrat in #​2167
• docs: add DeepWiki badge to README by @​lestrrat in #​2168
• ci: make v4 fuzz workflow actually run by @​lestrrat in #​2169
• ci: rotate companion fuzz cache via per-run key by @​lestrrat in #​2170
• docs: explain fuzz template skip-list by @​lestrrat in #​2171
• build(deps): bump actions/stale from 10.2.0 to 10.3.0 by @​dependabot[bot] in #​2175
• build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @​dependabot[bot] in #​2181
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​2182
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​2185
• build(deps): bump pozil/auto-assign-issue from 3.0.0 to 4.0.0 by @​dependabot[bot] in #​2186
• docs: warn about anchoring RegexpWhitelist patterns by @​lestrrat in #​2187
• autodoc updates by @​github-actions[bot] in #​2188
• build(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @​dependabot[bot] in #​2193
• build(deps): bump pozil/auto-assign-issue from 4.0.0 to 4.0.1 by @​dependabot[bot] in #​2194
• clear pooled error slice before reuse by @​lestrrat in #​2195
• avoid full-string rune alloc in alg error by @​lestrrat in #​2196
• release json registry lock before decoder call by @​lestrrat in #​2197
• compute cbc-hmac aad bit length in uint64 by @​lestrrat in #​2198
• error on nil curve and oversized d at import by @​lestrrat in #​2199
• error on unavailable thumbprint hash by @​lestrrat in #​2200
• handle nil clock and validator in validate by @​lestrrat in #​2202
• reset private claims on token unmarshal by @​lestrrat in #​2203
• apply jwt settings only when supplied by @​lestrrat in #​2204
• validate use field at jwk parse time by @​lestrrat in #​2205
• document intentional ecdsa high-s acceptance by @​lestrrat in #​2213
• read jwe zip only from protected header by @​lestrrat in #​2206
• enforce aead wire tag and iv length on decrypt by @​lestrrat in #​2207
• require 8-octet minimum pbes2 salt by @​lestrrat in #​2208
• require empty encrypted_key for direct cek by @​lestrrat in #​2209
• error on wrong-length ed25519 key by @​lestrrat in #​2201
• enforce protected alg match in jws verify by @​lestrrat in #​2212
• document intentional lenient base64 in verify by @​lestrrat in #​2214
• reject detached payload when payload present by @​lestrrat in #​2211
• document jwk alg is informational, not validated by @​lestrrat in #​2215
• document symmetric key length not validated by @​lestrrat in #​2216
• document rsa private params not validated by @​lestrrat in #​2217
• note AlgorithmsForKey does not validate key length by @​lestrrat in #​2222
• document okp public key not bound to scalar by @​lestrrat in #​2219
• document Chain.Get returns aliased read-only slice by @​lestrrat in #​2220
• fix WithPedantic doc: typ is not checked by @​lestrrat in #​2221
• document ec private scalar not bound to point by @​lestrrat in #​2218
• extend direct-mode empty key guard to ml-kem by @​lestrrat in #​2223
• add bazel test target for internal/json by @​lestrrat in #​2224
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​2227
• build(deps): bump actions/cache from 5.0.5 to 6.0.0 by @​dependabot[bot] in #​2232
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​2233
• fix: reject duplicate JOSE headers on fast path by @​lestrrat in #​2236
• build(deps): bump actions/cache from 6.0.0 to 6.1.0 by @​dependabot[bot] in #​2239
• docs: add unreleased Changes entries by @​lestrrat in #​2240
• chore: run jwkfetch in companion test sweep by @​lestrrat in #​2244

Full Changelog: lestrrat-go/jwx@v4.0.2...v4.1.0

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

• ci: print coverage summary in GitHub Actions run summary by @​lestrrat in #​2078
• ci: also run on push to target branches by @​lestrrat in #​2079
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2080
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2082
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2084
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2086
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2088
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2090
• jwt: Settings rejects out-of-range NumericDate precision by @​lestrrat in #​2092
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2093
• jwt: reshape base64-corruption hint as diagnosis-first by @​lestrrat in #​2095
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2098
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2096
• jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @​lestrrat in #​2100
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2101
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2103
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2105
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2107
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2109
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2111
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2113
• jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @​lestrrat in #​2115
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2116
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2118
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2120
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2122
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2124
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2126
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2128
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2130
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2132
• jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @​lestrrat in #​2134
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2136
• jwk: probe tolerates duplicate JSON field names by @​lestrrat in #​2138
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2139
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2141
• jwk: add UnknownKeyTypeError typed error by @​lestrrat in #​2143
• jwk: document AKP-specific Thumbprint canonicalization on public methods by @​lestrrat in #​2144
• docs/jwk: use jwk.WithX509(true) in PEM section prose by @​lestrrat in #​2145
• docs/jwk: document EncodePEM emit-to-PEM path by @​lestrrat in #​2146
• MIGRATION: document PublicSetOf default-reject for symmetric keys by @​lestrrat in #​2147
• jwk: clarify that any value <= 0 disables the RSA strength floor by @​lestrrat in #​2148
• jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @​lestrrat in #​2149
• jwk: correct Import godoc for crypto/ecdh dispatch by @​lestrrat in #​2150
• jwk: surface Export type mismatch as KeyTypeMismatchError by @​lestrrat in #​2151
• jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @​lestrrat in #​2152
• Changes: draft v4.0.2 release notes by @​lestrrat in #​2154

Full Changelog: lestrrat-go/jwx@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in #​2041
• autodoc updates by @​github-actions[bot] in #​2042
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in #​2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2051
• autodoc updates by @​github-actions[bot] in #​2053
• docs: document PrivateClaims concurrency contract by @​lestrrat in #​2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in #​2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in #​2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in #​2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2070
• autodoc updates by @​github-actions[bot] in #​2069
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in #​2076

Full Changelog: lestrrat-go/jwx@v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26 -> 1.26.0

no patch pinning of the go version

[jhrozek]

blocking this comes with an incompatible change

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.