Security fix for GHSA-4cf7-xm37-g63h.
Custom claim, header, and JWK field names are now JSON-escaped on output.
Previously a name was written between the quotes as is, so a name containing
" could close its own member and add members the application never set.
For example, calling Set with the name x":0,"admin produced a signed
token containing "admin":true. Every name now yields exactly one member,
and names that need no escaping serialize exactly as before. A name that is
not valid UTF-8 now fails serialization instead of being written raw.
See the Changes file for guidance on screening caller-supplied names.
Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not
receive a fix.
For more detailed release notes, see Changes.
What's Changed
- build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #2318
- build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @dependabot[bot] in #2322
- [v4] deprecate AlgorithmsForKey, move to internal by @lestrrat in #2325
- [v4] add jws.WithStrictECDSA sign option by @lestrrat in #2327
- [v4] fix curve inference claim in docs by @lestrrat in #2329
- build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @dependabot[bot] in #2333
- fix jwk.ParseKey generic guidance in guide skill by @lestrrat in #2335
- fix JWKS algorithm inference claim in guide by @lestrrat in #2336
- document exact alg match rule in guide by @lestrrat in #2337
- note RFC 9864 EdDSA deprecation in guide by @lestrrat in #2338
- drop nonexistent v3 and v2 plugin pointers by @lestrrat in #2339
- correct ML-DSA import panic claim in guide by @lestrrat in #2340
- add jwxfilter to guide companion table by @lestrrat in #2341
- build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #2347
- [v4] escape JSON object member names on output by @lestrrat in #2348
Full Changelog: v4.4.0...v4.5.0