Bump github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0

[dependabot]

Bumps github.com/lestrrat-go/jwx/v3 from 3.2.0 to 3.3.0.

Release notes

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.3.0

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing " could close its own member and add members the application never set. For example, calling Set with the name x":0,"admin produced a signed token containing "admin":true. Every name now yields exactly one member, and names that need no escaping serialize exactly as before.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in lestrrat-go/jwx#2280
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in lestrrat-go/jwx#2283
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in lestrrat-go/jwx#2287
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in lestrrat-go/jwx#2290
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in lestrrat-go/jwx#2293
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in lestrrat-go/jwx#2301
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in lestrrat-go/jwx#2299
• build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @​dependabot[bot] in lestrrat-go/jwx#2306
• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @​dependabot[bot] in lestrrat-go/jwx#2316
• build(deps): bump github.com/lestrrat-go/dsig from 1.3.0 to 1.4.0 by @​dependabot[bot] in lestrrat-go/jwx#2319
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @​dependabot[bot] in lestrrat-go/jwx#2321
• [v3] deprecate AlgorithmsForKey, move to internal by @​lestrrat in lestrrat-go/jwx#2326
• [v3] add jws.WithStrictECDSA sign option by @​lestrrat in lestrrat-go/jwx#2328
• [v3] fix curve inference claim in docs by @​lestrrat in lestrrat-go/jwx#2330
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @​dependabot[bot] in lestrrat-go/jwx#2332
• add example for bounded WithWaitReady wait by @​lestrrat in lestrrat-go/jwx#2343
• show fetch failure cause via error sink by @​lestrrat in lestrrat-go/jwx#2344
• [v3] escape JSON object member names on output by @​lestrrat in lestrrat-go/jwx#2349

Full Changelog: lestrrat-go/jwx@v3.2.0...v3.3.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

Changes

v4 has many incompatibilities with v3. To see the full list of differences between v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.5.0 8 September 2026

• [jwt][jws][jwe][jwk] Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing " could close its own member and add members the application never set. For example, calling Set with the name x":0,"admin produced a signed token containing "admin":true. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw.

  If your application accepts custom names from callers, an exact-match allowlist was never affected. A blocklist of reserved names, or an allowlist by namespace prefix, could be bypassed by this defect. Both are reasonable designs; the bug was in the serializer. Prefer an exact-match allowlist, and if you accept a prefix, require the rest of the name to be a plain identifier.

  Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 contain the same code and are unmaintained; see SECURITY.md. (GHSA-4cf7-xm37-g63h)

• [jws] Added jws.WithStrictECDSA(bool), a jws.Sign option that rejects anything RFC 7518 forbids for an ECDSA signature. Today that is Section 3.4's binding of ES256 to P-256, ES384 to P-384, and ES512 to P-521, so signing a P-521 key under jwa.ES256() fails instead of producing a JWS that other JOSE implementations reject.

  The default is unchanged: without the option, a mismatched curve and algorithm still sign exactly as before. jws.Verify is unaffected either way. jwt.Sign callers can reach the option through jwt.WithSignOption(jws.WithStrictECDSA(true)). (#2323)

v4.4.0 20 August 2026

• [jwa][jwk][jws] ML-DSA (FIPS 204) is now implemented natively when jwx is built with Go 1.27 or later, where crypto/mldsa is part of the standard library. jwa.MLDSA44(), jwa.MLDSA65() and jwa.MLDSA87() are registered automatically, and *mldsa.PrivateKey / *mldsa.PublicKey values from crypto/mldsa work directly with jws.Sign, jws.Verify, jwk.Import and jwk.Export. No extension module and no side-effect import are required.

  On Go 1.26 the algorithms are not registered at all, so jws.Sign and jws.Verify report them as unsupported instead of failing later with a confusing key error. ML-DSA on Go 1.26 still needs github.com/jwx-go/mldsa/v4. That extension remains safe to import on

... (truncated)

Commits

• 0bbd1a7 release v3.3.0
• 0fdfe98 [v3] escape JSON object member names on output (#2349)
• bc19585 show fetch failure cause via error sink (#2344)
• fbb3514 add example for bounded WithWaitReady wait (#2343)
• 601b51b build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#2332)
• 4de1087 fix curve inference claim in classifier docs (#2330)
• 1d28f61 [v3] add jws.WithStrictECDSA sign option (#2328)
• a52656d Merge pull request #2326 from lestrrat-go/refactor-v3-jws-keyalg-internal
• e6236d3 deprecate AlgorithmsForKey, move to internal
• e931dd0 build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 (#2321)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)