[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-jose/go-jose/v4	v4.1.4 → v4.1.7

---

Release Notes

go-jose/go-jose (github.com/go-jose/go-jose/v4)

v4.1.7

Compare Source

Fixed Security Issues

• Thumbprint: reject invalid RSA key (#​317) - GHSA-r39w-98wm-9pp6
• json: backport stdlib fix for embedded unexported field (#​318) - GHSA-27pc-rm86-68pq
• Detect if headers are set by presence in the map (#​319) - GHSA-p9j4-2j95-j4rv
• limit RSA size in certificate verify (#​315) - GHSA-v6h2-qj3f-2h6v
• Limit recipients and signatures in JWE/JWS (#​316) - GHSA-c67m-wr4h-2ccg

Fixed

• jwk: fix bug in x5c parsing (#​311)
• reject base64-encoded "null" in protected headers (#​309)

Deprecated

• deprecate ParseEncrypted / ParseSigned (#​222)

v4.1.6

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

• Reject mismatched JWE CEK lengths by @​akshithg in #​266
• Add a tests containerfile and threat model by @​mcpherrinm in #​300
• Fix error message for future issued tokens by @​inahga in #​303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

v4.1.5

Compare Source

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#​292)
• cipher/cbc_hmac: don't panic on invalid key (#​291)
• json: limit stack depth (#​290)
• jwt: reject out-of-range NumericDate values (#​278)
• Check alg against pubkey curve during verify. (#​293)
• Reject malformed Ed25519 JWKs (#​250)
• jws: choose verification key per-signature (#​243)

Breaking Changes

In #​226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

• Verify OpaqueSigner's Public() return is public (#​260)
• jws: skip signature on ErrJWKSKidNotFound (#​248)
• Handle JWE JSON without protected header (#​240)
• jws: don't strip internal whitespace before parsing JSON (#​239)
• jws: fewer calls to OpaqueSigner.Public() (#​224)
• Return a specific error when parsing empty string (#​216)
• Reject typed nil at Verify time (#​285)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.