For more detailed release notes, see Changes.
What's Changed
- build(deps): bump github/codeql-action from 4.37.9 to 4.38.0 by @dependabot[bot] in #2354
- build(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in #2353
- update jwx v4 guide by @lestrrat in #2355
- require guide skill tests after API changes by @lestrrat in #2356
- build(deps): bump github/codeql-action from 4.38.0 to 4.38.1 by @dependabot[bot] in #2359
- build(deps): bump github/codeql-action from 4.38.1 to 4.38.2 by @dependabot[bot] in #2362
- jwt: reject overflowing NumericDate values by @lestrrat in #2368
- jwt: require numbers for pedantic NumericDate by @lestrrat in #2369
- jws: support strict ECDSA curve checking during verification by @skarm in #2367
- [v4] replace fastjson header probes with jsontext by @lestrrat in #2379
- [v4] allow jwk set mutation during iteration by @lestrrat in #2380
- [v4] fix jwt.Parse fast path with multiple keys by @lestrrat in #2382
- [v4] fix jwt.Equal for map claims and member order by @lestrrat in #2383
- [v4] keep trying jwe key providers after errors by @lestrrat in #2384
- [v4] allow empty jwe ciphertext in JSON form by @lestrrat in #2386
- [v4] write jwe unprotected header as JSON object by @lestrrat in #2388
- handle shrinking JWK sets in verify and decrypt by @lestrrat in #2394
- [v4] jwsbb: size SignBuffer per encoded part by @lestrrat in #2400
- [v4] docs: fix wrong names and links in jwe/jwt by @lestrrat in #2403
- [v4] guide: add nested JWT section by @lestrrat in #2404
- [v4] jwt: honor NumericDate format precision by @lestrrat in #2409
- [v4] jwt: parse negative NumericDate values by @lestrrat in #2411
- [v4] jwt: parse decimal NumericDate values exactly by @lestrrat in #2413
- build(deps): bump github/codeql-action from 4.38.2 to 4.38.3 by @dependabot[bot] in #2421
- build(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in #2420
- [v4] jws: sign only the protected header in JSON by @lestrrat in #2415
- [v4] jwt: retry missing alg through jws.Verify by @lestrrat in #2422
- Fix typo in migration documentation link by @frostmar in #2425
- build(deps): bump github/codeql-action from 4.38.3 to 4.39.0 by @dependabot[bot] in #2428
- use crypto/pbkdf2 and drop x/crypto by @lestrrat in #2430
- require latest go patch release by @lestrrat in #2432
- use shields.io for the deepwiki badge by @lestrrat in #2433
- [v4] jws: add WithVerifiedSignature verify option by @lestrrat in #2434
- [v4] jwe: add WithDecryptedRecipient decrypt option by @lestrrat in #2438
- [v4] jws: fix crit and multi-signature docs by @lestrrat in #2435
- [v4] jwe: document per-recipient headers by @lestrrat in #2439
- [v4] ci: run autodoc only for develop/v4 by @lestrrat in #2446
- [v4] release v4.6.0 by @lestrrat in #2448
New Contributors
Full Changelog: v4.5.0...v4.6.0