lestrrat-go/jwx v2.0.9

on GitHub

v2.0.9 - 21 Mar 2023
[Security Fixes]
  * Updated use of golang.org/x/crypto to v0.7.0
[Bug fixes]
  * Emitted PEM file for EC private key types used the wrong PEM armor (#875)
[Miscellaneous]
  * Banners for generated files have been modified to allow tools to pick them up (#867)
  * Remove unused variables around ReadFileOption (#866)
  * Fix test failures
  * Support bazel out of the box
  * Now you can create JWS messages using `{"alg":"none"}`, by calling `jws.Sign()`
    with `jws.WithInsecureNoSignature()` option. (#888, #890).

    Note that there is no way to call
    `jws.Verify()` while allowing `{"alg":"none"}` as you wouldn't be _verifying_
    the message if we allowed the "none" algorithm. `jws.Parse()` will parse such
    messages witout verification.

    `jwt` also allows you to sign using alg="none", but there's no symmetrical
    way to verify such messages.