fix(deps): update go modules (major) #364
Open
+99
−105
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.3.0->v5.0.3v4.5.2->v5.3.0v0.0.4->v1.0.0v1.0.0->v2.24.0v4.18.3->v5.8.0v1.0.0->v2.0.0v1.0.1->v2.0.2v0.1.0->v1.0.2Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
cenkalti/backoff (github.com/cenkalti/backoff/v4)
v5.0.3Compare Source
v5.0.2Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
golang-jwt/jwt (github.com/golang-jwt/jwt/v4)
v5.3.0Compare Source
This release is almost identical to to
v5.2.3but now correctly indicates Go 1.21 as minimum requirement.What's Changed
Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0
v5.2.3Compare Source
What's Changed
New Contributors
Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3
v5.2.2Compare Source
What's Changed
jwt.Parseexample to usejwt.WithValidMethodsby @mattt in #425New Contributors
Full Changelog: golang-jwt/jwt@v5.2.1...v5.2.2
v5.2.1Compare Source
What's Changed
New Contributors
Full Changelog: golang-jwt/jwt@v5.2.0...v5.2.1
v5.2.0Compare Source
What's Changed
NewValidatorby @oxisto in #349New Contributors
Full Changelog: golang-jwt/jwt@v5.1.0...v5.2.0
v5.1.0Compare Source
What's Changed
ErrInvalidTypeinstead ofjson.UnsupportedTypeErrorby @oxisto in #316New Contributors
Full Changelog: golang-jwt/jwt@v5.0.0...v5.1.0
v5.0.0Compare Source
🚀 New Major Version
v5🚀It's finally here, the release you have been waiting for! We don't take breaking changes lightly, but the changes outlined below were necessary to address some of the challenges of the previous API. A big thanks for @mfridman for all the reviews, all contributors for their commits and of course @dgrijalva for the original code. I hope we kept some of the spirit of your original
v4branch alive in the approach we have taken here.~@oxisto, on behalf of @golang-jwt/maintainers
Version
v5contains a major rework of core functionalities in thejwt-golibrary. This includes support for several validation options as well as a re-design of theClaimsinterface. Lastly, we reworked how errors work under the hood, which should provide a better overall developer experience.Starting from v5.0.0, the import path will be:
For most users, changing the import path should suffice. However, since we intentionally changed and cleaned some of the public API, existing programs might need to be updated. The following sections describe significant changes and corresponding updates for existing programs.
Parsing and Validation Options
Under the hood, a new
validatorstruct takes care of validating the claims. A long awaited feature has been the option to fine-tune the validation of tokens. This is now possible with severalParserOptionfunctions that can be appended to mostParsefunctions, such asParseWithClaims. The most important options and changes are:WithLeewayto support specifying the leeway that is allowed when validating time-based claims, such asexpornbf.iatclaim. Usage of this claim is OPTIONAL according to the JWT RFC. The claim itself is also purely informational according to the RFC, so a strict validation failure is not recommended. If you want to check for sensible values in these claims, please use theWithIssuedAtparser option.WithAudience,WithSubjectandWithIssuerto support checking for expectedaud,subandiss.WithStrictDecodingandWithPaddingAllowedoptions to allow previously global settings to enable base64 strict encoding and the parsing of base64 strings with padding. The latter is strictly speaking against the standard, but unfortunately some of the major identity providers issue some of these incorrect tokens. Both options are disabled by default.Changes to the
ClaimsinterfaceComplete Restructuring
Previously, the claims interface was satisfied with an implementation of a
Valid() errorfunction. This had several issues:Since all the validation functionality is now extracted into the validator, all
VerifyXXXandValidfunctions have been removed from theClaimsinterface. Instead, the interface now represents a list of getters to retrieve values with a specific meaning. This allows us to completely decouple the validation logic with the underlying storage representation of the claim, which could be a struct, a map or even something stored in a database.Supported Claim Types and Removal of
StandardClaimsThe two standard claim types supported by this library,
MapClaimsandRegisteredClaimsboth implement the necessary functions of this interface. The oldStandardClaimsstruct, which has already been deprecated inv4is now removed.Users using custom claims, in most cases, will not experience any changes in the behavior as long as they embedded
RegisteredClaims. If they created a new claim type from scratch, they now need to implemented the proper getter functions.Migrating Application Specific Logic of the old
ValidPreviously, users could override the
Validmethod in a custom claim, for example to extend the validation with application-specific claims. However, this was always very dangerous, since once could easily disable the standard validation and signature checking.In order to avoid that, while still supporting the use-case, a new
ClaimsValidatorinterface has been introduced. This interface consists of theValidate() errorfunction. If the validator sees, that aClaimsstruct implements this interface, the errors returned to theValidatefunction will be appended to the regular standard validation. It is not possible to disable the standard validation anymore (even only by accident).Usage examples can be found in example_test.go, to build claims structs like the following.
Changes to the
TokenandParserstructThe previously global functions
DecodeSegmentandEncodeSegmentwere moved to theParserandTokenstruct respectively. This will allow us in the future to configure the behavior of these two based on options supplied on the parser or the token (creation). This also removes two previously global variables and moves them to parser optionsWithStrictDecodingandWithPaddingAllowed.In order to do that, we had to adjust the way signing methods work. Previously they were given a base64 encoded signature in
Verifyand were expected to return a base64 encoded version of the signature inSign, both as astring. However, this made it necessary to haveDecodeSegmentandEncodeSegmentglobal and was a less than perfect design because we were repeating encoding/decoding steps for all signing methods. Now,SignandVerifyoperate on a decoded signature as a[]byte, which feels more natural for a cryptographic operation anyway. Lastly,ParseandSignedStringtake care of the final encoding/decoding part.In addition to that, we also changed the
Signaturefield onTokenfrom astringto[]byteand this is also now populated with the decoded form. This is also more consistent, because the other parts of the JWT, mainlyHeaderandClaimswere already stored in decoded form inToken. Only the signature was stored in base64 encoded form, which was redundant with the information in theRawfield, which contains the complete token as base64.Most (if not all) of these changes should not impact the normal usage of this library. Only users directly accessing the
Signaturefield as well as developers of custom signing methods should be affected.What's Changed
StandardClaimsin favor ofRegisteredClaimsby @oxisto in #235v5Pre-Release by @oxisto in #234DecodeSegementtoParserby @oxisto in #278Verify&Signto detail why string is not an advisable input for key by @dillonstreator in #249v5release by @oxisto in #291New Contributors
Full Changelog: golang-jwt/jwt@v4.5.0...v5.0.0
golang/snappy (github.com/golang/snappy)
v1.0.0Compare Source
Latest stable version, as of March 2025.
hashicorp/hcl (github.com/hashicorp/hcl)
v2.24.0Compare Source
Enhancements
gohcl. (#703)Bugs Fixed
v2.23.0Compare Source
Bugs Fixed
v2.22.0Compare Source
Enhancements
v2.21.0Compare Source
Enhancements
ParseTraversalPartial, which allows traversals that include the splat ([*]) index operator. (#673)for_each, and will transfer those marks (as much as technically possible) to values in the generated blocks. (#679)Bugs Fixed
v2.20.1Compare Source
Bugs Fixed
ExprSyntaxErrorwhen an invalid namespaced function is encountered during parsing (#668)Internal
v2.20.0Compare Source
Enhancements
Bugs Fixed
iteratoris invalid return this error instead of consequential errors (#656)v2.19.1Compare Source
What's Changed
Full Changelog: hashicorp/hcl@v2.19.0...v2.19.1
v2.19.0Compare Source
Enhancements
dynblock.Expandnow supports an optional hook for calling applications to check and potentially veto (by returning error diagnostics) particularfor_eachvalues. The behavior is unchanged for callers that don't set the new option. (#634)Bugs Fixed
v2.18.1Compare Source
Bugs Fixed
v2.18.0Compare Source
Enhancements
HCL now uses the tables from Unicode 15 when performing string normalization and character segmentation. HCL was previously using the Unicode 13 tables.
For calling applications where consistent Unicode support is important, consider also upgrading to Go 1.21 at the same time as adopting HCL v2.18.0 so that the standard library unicode tables (used for case folding, etc) will also be from Unicode 15.
v2.17.1Compare Source
Enhancements
https://at the start of a URL known to use that scheme. (#617)Bugs Fixed
anykeyword, avoiding an incorrect panic at runtime. (#625)v2.17.0Compare Source
Enhancements
HCL now uses a newer version of the upstream
ctylibrary which has improved treatment of unknown values: it can now track additional optional information that reduces the range of an unknown value, which allows some operations against unknown values to return known or partially-known results. (#590)Note: This change effectively passes on
cty's notion of backward compatibility whereby unknown values can become "more known" in later releases. In particular, if your caller is usingcty.Value.RawEqualsin its tests against the results of operations with unknown values then you may see those tests begin failing after upgrading, due to the values now being more "refined".If so, you should review the refinements with consideration to the
ctyrefinements docs and update your expected results to match only if the reported refinements seem correct for the given situation. TheRawEqualsmethod is intended only for making exact value comparisons in test cases, so main application code should not use it; useEqualsinstead for real logic, which will take refinements into account automatically.v2.16.2Compare Source
Bugs Fixed
v2.16.1Compare Source
Bugs Fixed
Range.EndforFunctionCallwith incomplete argument (#588)v2.16.0Compare Source
Enhancements
ext/typeexpr: Modify the
Defaultsfunctionality to implement additional flexibility. HCL will now upcast lists and sets into tuples, and maps into objects, when applying default values if the applied defaults cause the elements within a target collection to have differing types. Previously, this would have resulted in a panic, now HCL will return a modified overall type. (#574)Users should return to the advice provided by v2.14.0, and apply the go-cty convert functionality after setting defaults on a given
cty.Value, rather than before.hclfmt: Avoid rewriting unchanged files. (#576)
hclsyntax: Simplify the AST for certain string expressions. (#584)
Bugs Fixed
formatSpaces. (#511)v2.15.0Compare Source
Bugs Fixed
Enhancements
Defaultsstruct and associated functions can apply additional and more flexible 'unsafe' conversions (examples include tuples into collections such as lists and sets, and additional safety around null and dynamic values). (#564)cty.Value, rather than after, if they require a specificcty.Type. (#564)v2.14.1Compare Source
Bugs Fixed
v2.14.0Compare Source
Enhancements
TypeConstraint. Attributes can be wrapped in the specialoptional(…)modifier, allowing the attribute to be omitted while still meeting the type constraint. For more information, cty's documentation on conversion between object types. (#549)TypeConstraintWithDefaults. In this mode, theoptional(…)modifier accepts a second argument which can be used as the default value for omitted object attributes. The function returns both acty.Typeand associatedDefaults, the latter of which has anApplymethod to apply defaults to a given value. (#549)v2.13.0Compare Source
Enhancements
hcl.Diagnosticnow has an additional fieldExtrawhich is intended for carrying arbitrary supporting data ("extra information") related to the diagnostic message, intended to allow diagnostic renderers to optionally tailor the presentation of messages for particular situations. (#539)errorvalue without any post-processing. (#539)Bugs Fixed
hclwrite.Formatruns concurrently with itself. (#534)v2.12.0Compare Source
Enhancements
TokensForTuple,TokensForObject, andTokensForFunctionCallallow for more easily constructing the three constructs which are supported for static analysis and which HCL-based languages typically use in contexts where an expression is used only for its syntax, and not evaluated to produce a real value. For example, these new functions together are sufficient to construct all valid type constraint expressions from the Type Expressions Extension, which is the basis of variable type constraints in the Terraform language at the time of writing. (#502)IsJSONExpressionandIsJSONBodyto determine if a given expression or body was created by the JSON syntax parser. In normal situations it's better not to worry about what syntax a particular expression/body originated in, but this can be useful in some trickier cases where an application needs to shim for backwards-compatibility or for static analysis that needs to have special handling of the JSON syntax's embedded expression/template conventions. (#524)Bugs Fixed
v2.11.1Compare Source
Bugs Fixed
v2.11.0Compare Source
Enhancements
Bugs Fixed
v2.10.1Compare Source
function.ArgErrorwhose argument index is out of range for the length of the arguments. Previously this would often lead to a panic, but now it'll return a less-precice error message instead. Functions that return out-of-bounds argument indices still ought to be fixed so that the resulting error diagnostics can be as precise as possible. (#472)hcl.Indexandhcl.GetAttr. These are part of the implementation of indexing and attribute lookup in the native syntax expression language too, so the new error messages will apply to problems using those operators. (#474)v2.10.0Compare Source
Enhancements
${...}template interpolation sequences will now produce an extra hint message about the need to escape as$${when trying to include interpolation syntax for other languages like shell scripting, AWS IAM policies, etc. (#462)v2.9.1Compare Source
Bugs Fixed
v2.9.0Compare Source
Enhancements
v2.8.2Compare Source
Bugs Fixed
forexpression marked conditional. (#438)v2.8.1Compare Source
Bugs Fixed
v2.8.0Compare Source
Enhancements
Bugs Fixed
(and)tokens when an expression is surrounded by parentheses. Previously it would incorrectly recognize those tokens as being extraneous tokens outside of the expression. (#426)!(unary boolean "not") operator and its subsequent operand. (#403)v2.7.2Compare Source
Bugs Fixed
null[*]was previously always returning an unknown value, even though the rules for[*]normally call for it to return an empty tuple when applied to a null. As well as being a surprising result, it was particularly problematic because it violated the rule that a calling application may assume that an expression result will always be known unless the application itself introduces unknown values via the evaluation context.null[*]will now produce an empty tuple. (#416)v2.7.1Compare Source
Bugs Fixed
v2.7.0Compare Source
Enhancements
ParseWithStartPos, which allows overriding the starting position for parsing in case the given JSON bytes are a fragment of a larger document, such as might happen when decoding withencoding/jsoninto ajson.RawMessage. (#389)ParseExpression, which allows parsing a JSON string directly in expression mode, whereas previously it was only possible to parse a JSON string in body mode. (#381)Blocktype now supportsSetTypeandSetLabels, allowing surgical changes to the type and labels of an existing block without having to reconstruct the entire block. (#340)Bugs Fixed
v2.6.0Compare Source
Enhancements
Spec,ValidateSpec, which allows custom validation of values at decode-time. (#387)Bugs Fixed
v2.5.1Compare Source
Bugs Fixed
foo.*) (#374)v2.5.0Compare Source
Enhancements
v2.4.0[Compar
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.