From 38a4679ebe90e9dd9e7ad3c9c6e4085034f120d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 02:26:04 +0000
Subject: [PATCH] build(deps): bump jsonwebtoken from 9.3.1 to 10.4.0

Bumps [jsonwebtoken](https://github.com/Keats/jsonwebtoken) from 9.3.1 to 10.4.0.
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Keats/jsonwebtoken/compare/v9.3.1...v10.4.0)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 Cargo.lock                    | 34 +++++++++++++++++++++++++++++++---
 crates/hone-server/Cargo.toml |  2 +-
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 2f28e84..6adf64c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1102,17 +1102,19 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.3.1"
+version = "10.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
 dependencies = [
  "base64",
+ "getrandom 0.2.16",
  "js-sys",
  "pem",
- "ring",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
+ "zeroize",
 ]
 
 [[package]]
@@ -1581,6 +1583,9 @@ name = "rand_core"
 version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.16",
+]
 
 [[package]]
 name = "rand_core"
@@ -2018,6 +2023,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.8"
@@ -3031,6 +3045,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "zerotrie"
diff --git a/crates/hone-server/Cargo.toml b/crates/hone-server/Cargo.toml
index 36f6074..f6c51f0 100644
--- a/crates/hone-server/Cargo.toml
+++ b/crates/hone-server/Cargo.toml
@@ -25,7 +25,7 @@ serde_json.workspace = true      # JSON API bodies
 sha2.workspace = true            # Content hashing
 base64 = "0.22"                  # Receipt image encoding
 subtle = "2.5"                   # Constant-time comparison for API keys
-jsonwebtoken = "9.3"             # Cloudflare Access JWT validation
+jsonwebtoken = "10.4"             # Cloudflare Access JWT validation
 
 # HTTP client (for fetching CF public keys)
 reqwest.workspace = true         # Fetch Cloudflare Access public keys