Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed #182

renovate · 2023-06-14T11:19:54Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/lestrrat-go/jwx/v2	`v2.0.10` -> `v2.1.4`

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v2.1.1 Jul 28 2024
  * Update minimum required go version to go 1.20
  * Update tests to work on 32-bit systems.
  * [jwa] Add RSA_OAEP_384 and RSA_OAEP_512
  * [jwa] `jwa.SignatureAlgorithm` now has a `IsSymmetric` method.
  * [jwa] Add `jwa.RegisterSignatureAlgorithmOptions()` to register new algorithms while
    specifying extra options. Currently only `jwa.WithSymmetricAlgorithm()` is supported.
  * [jws] Clearly mark `jws.WithHeaders()` as deprecated

`v2.1.0`

Compare Source

v2.1.0 18 Jun 2024
[New Features]
  * [jwt] Added `jwt.ParseCookie()` function
  * [jwt] `jwt.ParseRequest()` can now accept a new option, jwt.WithCookieKey() to
    specify a cookie name to extract the token from.
  * [jwt] `jwt.ParseRequest()` and `jwt.ParseCookie()` can accept the `jwt.WithCookie()` option,
    which will, upon successful token parsing, make the functions assign the *http.Cookie
    used to parse the token. This allows users to further inspect the cookie where the
    token came from, should the need arise.
  * [jwt] (BREAKING CHANGE) `jwt.ParseRequest()` no longer automatically looks for "Authorization" header when
    only `jwt.WithFormKey()` is used. This behavior is the same for `jwt.WithCookieKey()` and
    any similar options that may be implemented in the future.
### previously
      jwt.ParseRequest(req) // looks under Authorization
      jwt.ParseReuqest(req, jwt.WithFormKey("foo")) // looks under foo AND Authorization
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization
### since this release
      jwt.ParseRequest(req) // same as before
      jwt.ParseRequest(req, jwt.WithFormKey("foo")) // looks under foo
      jwt.ParseReuqest(req, jwt.WithHeaderKey("Authorization"), jwt.WithFormKey("foo")) // looks under foo AND Authorization

  * [jwt] Add `jwt.WithResetValidators()` option to `jwt.Validate()`. This option
    will allow you to tell `jwt.Validate()` to NOT automatically check the
    default validators (`iat`, `exp`, and `nbf`), so that you can completely customize
    the validation with the validators you specify using `jwt.WithValidator()`.

    This sort of behavior is useful for special cases such as 
    https://openid.net/specs/openid-connect-rpinitiated-1_0.html. However, you SHOULD NOT
    use this option unless you know exactly what you are doing, as this will pose
    significant security issues when used incorrectly.
 
   * [jwk] Provide a _stop-gap_ measure to work with PEM format ASN.1 DER encoded secp256k1 keys.
  
    In order to enable this feature, you must compile jwx with TWO build tags:
    `jwx_es256k` to enable ES256K/secp256k1, and `jwx_secp256k1_pem` to enable PEM handling.
    Not one, but BOTH tags need to be present.

    With this change, by suppliying the `WithPEM(true)` option, `jwk.Parse()` is now
    able to read sep256k1 keys. Also, `jwk.Pem()` should be able to handle `jwk.Key` objects
    that represent a secp256k1 key.

    Please do note that the implementation of this feature is dodgy at best. Currently
    Go's crypto/x509 does not allow handling additional EC curves, and thus in order to
    accomodate secp256k1 keys in PEM/ASN.1 DER format we need to "patch" the stdlib.
    We do this by copy-and-pasting relevant parts of go 1.22.2's crypto/x509 code and
    adding the minimum required code to make secp256k1 keys work.

    Because of the above, there are several important caveats for this feature:

    1. This feature is provided solely as a stop-gap measure until such time Go's stdlib
    provides a way to handle non-standard EC curves, or another external module
    is able to solve this issue. 

    2. This feature should be considered unstable and not guaranteed by semantic versioning
    backward compatibility. At any given point we may drop or modify this feature. It may be
    because we can no longer maintain the code, or perhaps a security issue is found in the
    version of the code that we ship with, etc.
 
     3. Please always remember that we are now bundling a static set of code for handling
    x509 formats. You are taking a possible security risk by code that could be outdated.
    Please always do your own research, and if possible, please notify us if the bundled
    code needs to be updated. Unless you know what you are doing, it is not recommended
    that you enable this feature.

    4. Please note that because we imported the code from go 1.22's src/crypto/x509,
    it has some go1.20-isms in its code. Therefore you will not be able to use the
    `jwx_secp256k1_pem` tag to enable secp256k1 key PEM handling against codebases
    that are built using go 1.19 and below (the build will succeed, but the feature
    will be unavailable).

    5. We have no plans to include more curves this way. One is already one too many.

  * [jwe] Fixed a bug when using encryption algorithms involving PBES2 along with the
    jwx.WithUseNumber() global option. Enabling this option would turn all values
    stored in the JSON content to be of type `json.Number`, but we did not account for
    it when checking for the value of `p2c` header, resulting in a conversion error.

`v2.0.21`

Compare Source

v2.0.21 07 Mar 2024

[Security]

[jwe] Added jwe.Settings(jwe.WithMaxDecompressBufferSize(int64)) to specify the
maximum size of a decompressed JWE payload. The default value is 10MB. If you
are compressing payloads greater than this and want to decompress it during
a call to jwe.Decrypt, you need to explicitly set a value large enough to
hold that data.

The same option can be passed to jwe.Decrypt to control this behavior on
a per-message basis.
[jwe] Added documentation stating that jwe.WithMaxBufferSize option will be
renamed in future versions, i.e. v3

`v2.0.20`

Compare Source

v2.0.20 20 Feb 2024

[New Features]

[jwe] Added jwe.Settings(WithMaxBufferSize(int64)) to set the maximum size of
internal buffers. The default value is 256MB. Most users do not need to change
this value.
[jws] Allow jws.WithCompact() and jws.WithJSON() to be passed to jws.Parse() and
jws.Verify(). These options control the expected serialization format for the
JWS message.
[jwt] Add jwt.WithCompactOnly() to specify that only compact serialization can
be used for jwt.Parse(). Previously, by virtue of jws.Parse() allowing either
JSON or Compact serialization format, jwt.Parse() also alloed JSON serialization
where as RFC7519 explicitly states that only compact serialization should be
used. For backward compatibility the default behavior is not changed, but you
can set this global option for jwt: jwt.Settings(jwt.WithCompactOnly(true))

[Miscellaneous]

Internal key conversions should now allow private keys to be used in place of
public keys. This would allow you to pass private keys where public keys are
expected.

`v2.0.19`

Compare Source

v2.0.19 09 Jan 2024
[New Features]
  * [jws] Added jws.IsVerificationError to check if the error returned by `jws.Verify`
    was caused by actual verification step or something else, for example, while fetching
    a key from datasource

[Security Fixes]
  * [jws] JWS messages formated in full JSON format (i.e. not the compact format, which
    consists of three base64 strings concatenated with a '.') with missing "protected"
    headers could cause a panic, thereby introducing a possiblity of a DoS.

    This has been fixed so that the `jws.Parse` function succeeds in parsing a JWS message
    lacking a protected header. Calling `jws.Verify` on this same JWS message will result
    in a failed verification attempt. Note that this behavior will differ slightly when
    parsing JWS messages in compact form, which result in an error.

`v2.0.18`

Compare Source

v2.0.18 03 Dec 2023
[Security Fixes]
  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users who use JWE via this
    package should upgrade. While the JOSE spec allows for encryption using JWE on JWTs, users of
    the `jwt` package are not immediately susceptible unless they explicitly try to decrypt
    JWTs -- by default the `jwt` package verifies signatures, but does not decrypt messages.
    [GHSA-7f9x-gw85-8grf]

`v2.0.17`

Compare Source

v2.0.17 20 Nov 2023
[Bug Fixes]
  * [jws] Previously, `jws.UnregisterSigner` did not remove the previous signer instance when
    the signer was registered and unregistered multiple times (#&#8203;1016). This has been fixed.

[New Features]
  * [jwe] (EXPERIMENTAL) `jwe.WithCEK` has been added to extract the content encryption key (CEK) from the Decrypt operation.
  * [jwe] (EXPERIMENTAL) `jwe.EncryptStatic` has been added to encrypt content using a static CEK.
    Using static CEKs has serious security implications, and you should not use
    this unless you completely understand the risks involved.

`v2.0.16`

Compare Source

v2.0.16 31 Oct 2023
[Security]
  * [jws] ECDSA signature verification requires us to check if the signature
    is of the desired length of bytes, but this check that used to exist before
    had been removed in #&#8203;65, resulting in certain malformed signatures to pass
    verification.

    One of the ways this could happen if R is a 31 byte integer and S is 32 byte integer,
    both containing the correct signature values, but R is not zero-padded.

       Correct = R: [ 0 , ... ] (32 bytes) S: [ ... ] (32 bytes)
       Wrong   = R: [ ... ] (31 bytes)     S: [ ... ] (32 bytes)

    In order for this check to pass, you would still need to have all 63 bytes
    populated with the correct signature. The only modification a bad actor
    may be able to do is to add one more byte at the end, in which case the
    first 32 bytes (including what would have been S's first byte) is used for R,
    and S would contain the rest. But this will only result in the verification to
    fail. Therefore this in itself should not pose any security risk, albeit
    allowing some illegally formated messages to be verified.

  * [jwk] `jwk.Key` objects now have a `Validate()` method to validate the data
    stored in the keys. However, this still does not necessarily mean that the key's
        are valid for use in cryptographic operations. If `Validate()` is successful,
    it only means that the keys are in the right _format_, including the presence
    of required fields and that certain fields have proper length, etc.

[New Features]
  * [jws] Added `jws.WithValidateKey()` to force calling `key.Validate()` before
    signing or verification.

  * [jws] `jws.Sign()` now returns a special type of error that can hold the
    individual errors from the signers. The stringification is still the same
    as before to preserve backwards compatibility.

  * [jwk] Added `jwk.IsKeyValidationError` that checks if an error is an error
    from `key.Validate()`.

[Bug Fixes]
  * [jwt] `jwt.ParseInsecure()` was running verification if you provided a key
    via `jwt.WithKey()` or `jwt.WithKeySet()` (#&#8203;1007)

`v2.0.15`

Compare Source

v2.0.15 19 20 Oct 2023
[Bug fixes]
  * [jws] jws.Sign() now properly check for valid algorithm / key type pair when
    the key implements crypto.Signer. This was caused by the fact that when 
    jws.WithKey() accepted keys that implemented crypto.Signer, there really
    is no way to robustly check what algorithm the crypto.Signer implements.

    The code has now been modified to check for KNOWN key types, i.e. those
    that are defined in Go standard library, and those that are defined in
    this library. For example, now calling jws.Sign() with jws.WithKey(jwa.RS256, ecdsaKey)
    where ecdsaKey is either an instance of *ecdsa.PrivateKey or jwk.ECDSAPrivateKey
    will produce an error.

    However, if you use a separate library that wraps some KMS library which implements
    crypto.Signer, this same check will not be performed due to the fact that
    it is an unknown library to us. And there's no way to query a crypto.Signer
    for its algorithm family.

`v2.0.14`

Compare Source

v2.0.14 17 Oct 2023
  [New Features]
  * [jwk] jwk.IsPrivateKey(), as well as jwk.AsymmetricKey has been added.
    The function can be used to tell if a jwk.Key is a private key of an
    asymmetric key pair.
  [Security]
  * golang.org/x/crypto has been updated to 0.14.0. The update contains a fix for HTTP/2
    rapid reset DoS vulnerability, which some security scanning softwares may flag.
    However, do note that this library is NOT affected by the issue, as it does not have
    the capability to serve as an HTTP/2 server. This is included in this release
    document so that users will be able to tell why this library may be flagged
    when/if their scanning software do so.

`v2.0.13`

Compare Source

v2.0.13 26 Sep 2023
[New Features]
  * [jwk] jwk.Equal has been added. Please note that this is equivalent to
  comparing the keys' thumbprints, therefore it does NOT take in consideration
  non-essential fields.

[Miscellaneous]
  * Various documentation fixes and additions.

`v2.0.12`

Compare Source

v2.0.12 - 11 Aug 2023
[Bug fixes]
  * [jwt] jwt.Serializer was ignoring JWE flags (#&#8203;951)

[Miscellaneous]
  * [jwk] Check for seed length on OKP JWKs to avoid panics (#&#8203;947)
  * [jws] Documentation for jws.WithKeySet()

`v2.0.11`: [SECURITY] v2.0.11

Compare Source

v2.0.11 - 14 Jun 2023
[Security]
  * Potential Padding Oracle Attack Vulnerability and Timing Attack Vulnerability
    for JWE AES-CBC encrypted payloads affecting all v2 releases up to v2.0.10,
    all v1 releases up to v1.2.25, and all v0 releases up to v0.9.2 have been reported by
    @&#8203;shogo82148.

    Please note that v0 versions will NOT receive fixes.
    This release fixes these vulnerabilities for the v2 series.

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-06-18T02:11:48Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

9 additional dependencies were updated

Details:

Package	Change
`github.com/decred/dcrd/dcrec/secp256k1/v4`	`v4.2.0` -> `v4.4.0`
`github.com/goccy/go-json`	`v0.10.2` -> `v0.10.3`
`github.com/lestrrat-go/blackmagic`	`v1.0.1` -> `v1.0.2`
`github.com/lestrrat-go/httprc`	`v1.0.4` -> `v1.0.6`
`golang.org/x/crypto`	`v0.9.0` -> `v0.32.0`
`golang.org/x/net`	`v0.10.0` -> `v0.21.0`
`golang.org/x/sys`	`v0.8.0` -> `v0.29.0`
`golang.org/x/term`	`v0.8.0` -> `v0.28.0`
`golang.org/x/text`	`v0.9.0` -> `v0.21.0`

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.11~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.12 Aug 10, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 1520e28 to bde55a3 Compare August 10, 2023 05:05

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.12~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.13 Sep 26, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from bde55a3 to d3c8688 Compare September 26, 2023 10:10

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.13~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.14 Oct 17, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from d3c8688 to c8ea5e8 Compare October 17, 2023 01:59

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.14~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.15 Oct 20, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from c8ea5e8 to e73c2e2 Compare October 20, 2023 01:09

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.15~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.16 Oct 31, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from e73c2e2 to 80fd06b Compare October 31, 2023 01:31

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.16~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.17 Nov 20, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 80fd06b to 221d8c2 Compare November 20, 2023 05:10

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.17~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.18 Dec 3, 2023

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 221d8c2 to 1bd315c Compare December 3, 2023 12:06

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 1bd315c to 447c3e7 Compare January 9, 2024 03:38

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.18~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.19 Jan 9, 2024

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.19~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.20 Feb 20, 2024

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 447c3e7 to 9840358 Compare February 20, 2024 01:01

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 9840358 to a2eee40 Compare March 7, 2024 04:31

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.20~~ Update module github.com/lestrrat-go/jwx/v2 to v2.0.21 Mar 7, 2024

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from a2eee40 to fb89580 Compare June 18, 2024 02:11

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.0.21~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.0 Jun 18, 2024

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from fb89580 to f4851b3 Compare July 28, 2024 01:45

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.1.0~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.1 Jul 28, 2024

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from f4851b3 to ffe59a2 Compare October 25, 2024 07:51

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.1.1~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.2 Oct 25, 2024

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from ffe59a2 to 8ba4301 Compare November 24, 2024 10:58

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.1.2~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.3 Nov 24, 2024

Update module github.com/lestrrat-go/jwx/v2 to v2.1.4

534f4e6

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.1.3~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 Feb 25, 2025

renovate bot force-pushed the renovate/github.com-lestrrat-go-jwx-v2-2.x branch from 8ba4301 to 534f4e6 Compare February 25, 2025 11:47

renovate bot changed the title ~~Update module github.com/lestrrat-go/jwx/v2 to v2.1.4~~ Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed Mar 4, 2025

renovate bot closed this Mar 4, 2025

renovate bot deleted the renovate/github.com-lestrrat-go-jwx-v2-2.x branch March 4, 2025 15:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed #182

Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed #182

Uh oh!

renovate bot commented Jun 14, 2023 •

edited

Loading

Uh oh!

renovate bot commented Jun 18, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed #182

Update module github.com/lestrrat-go/jwx/v2 to v2.1.4 - autoclosed #182

Uh oh!

Conversation

renovate bot commented Jun 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

What's Changed

New Contributors

v2.0.21 07 Mar 2024

[Security]

v2.0.20 20 Feb 2024

[New Features]

[Miscellaneous]

v2.0.11: [SECURITY] v2.0.11

Configuration

Uh oh!

renovate bot commented Jun 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Jun 14, 2023 •

edited

Loading

`v2.0.11`: [SECURITY] v2.0.11

renovate bot commented Jun 18, 2024 •

edited

Loading