v2.1.6

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

• DIRECT mode content encryption
• Using A256CBC_HS512
• With an erroneously created CEK of exactly 32-bytes.

---

• jws: backport jws parsing ehancements by @lestrrat in #1363
• [v2] Backport #1367 by @lestrrat in #1368

Full Changelog: v2.1.5...v2.1.6

v2.1.5

What's Changed

• jws/jwe: split token into fixed number of parts (#1308) by @lestrrat in #1309
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @dependabot in #1317
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @dependabot in #1319
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @dependabot in #1327
• Remove use of go1.22 in CI by @lestrrat in #1356
• v2: jws/jwe: split token into fixed number of parts (#1308) by @lestrrat in #1355
• Bump github.com/lestrrat-go/blackmagic from 1.0.2 to 1.0.3 by @dependabot in #1354
• autodoc updates by @github-actions in #1359

Full Changelog: v2.1.4...v2.1.5

v1.2.31

What's Changed

This release was made to officially deprecate v1 series of github.com/lestrrat-go/jwx. Please use github.com/lestrrat-go/jwx/v3 or newer

• Bump golang.org/x/crypto from 0.25.0 to 0.26.0 by @dependabot in #1169
• Bump golang.org/x/crypto from 0.26.0 to 0.28.0 by @dependabot in #1209
• Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1230
• Bump codecov/codecov-action from 4 to 5 by @dependabot in #1236
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1244
• Latchset workaround by @lestrrat in #1270
• Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by @dependabot in #1264
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by @dependabot in #1292
• Bump golangci/golangci-lint-action from 6 to 7 by @dependabot in #1326
• [v1] Add deprecation notice in go.mod by @lestrrat in #1346

Full Changelog: v1.2.30...v1.2.31

v3.0.0

What's Changed

• Add support for RSA-OAEP-384 and RSA-OAEP-512 by @Hannes-Kunnen in #1142
• fix: typos by @maro114510 in #1145
• Update httprc to v1.0.6 by @lestrrat in #1150
• Improve API for checking algorithm characteristics around symmetry by @lestrrat in #1151
• Fix typos/mistakes/wording/links in documentation/comments by @Hannes-Kunnen in #1152
• Apply changes from #1156 to v2 by @lestrrat in #1158
• Avoid problems on 32-bit systems by @lestrrat in #1159
• Update minimum required go version to 1.20 by @lestrrat in #1161
• Run CI with minimum go version 1.20 by @lestrrat in #1162
• Bump golang.org/x/crypto from 0.24.0 to 0.25.0 by @dependabot in #1149
• Deprecate jws.WithHeaders by @lestrrat in #1163
• Bump golang.org/x/crypto from 0.25.0 to 0.26.0 by @dependabot in #1168
• Fix document of how to parse PEM via CLI by @kg0r0 in #1174
• Wrap the errors from functions called within ParseRequest by @lestrrat in #1176
• V3 modernize infra by @lestrrat in #1180
• autodoc updates by @github-actions in #1181
• V3 dependabot by @lestrrat in #1184
• Completely rework jwk.Cache using github.com/lestrrat-go/httprc/v3 by @lestrrat in #1189
• autodoc updates by @github-actions in #1190
• Use import by @lestrrat in #1191
• include an extra attribute in the trace log for debugging by @lestrrat in #1192
• remove old references and unused files by @lestrrat in #1193
• Bump golang.org/x/crypto from 0.26.0 to 0.27.0 by @dependabot in #1185
• cleanup docs, options around cache by @lestrrat in #1194
• autodoc updates by @github-actions in #1195
• fix docs by @lestrrat in #1196
• Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #1197
• Allow flexible key usage values by @lestrrat in #1198
• Remove assert by @lestrrat in #1200
• Convert jwa constants to function calls returning objects by @lestrrat in #1203
• Mention RegisterKeyUsage by @lestrrat in #1201
• autodoc updates by @github-actions in #1206
• Change accessors in jwk to return (T, bool) by @lestrrat in #1207
• autodoc updates by @github-actions in #1211
• Bump golang.org/x/crypto from 0.27.0 to 0.28.0 by @dependabot in #1210
• Change JWT accessors from returning T to returning (T, bool) by @lestrrat in #1212
• autodoc updates by @github-actions in #1213
• update comments to include iat (#1216) by @lestrrat in #1217
• Rename the old WithMaxBufferSize option as previously warned by @lestrrat in #1218
• Streamline errors by @lestrrat in #1220
• autodoc updates by @github-actions in #1221
• allow passing context.Contex to jwe.Decrypt by @lestrrat in #1222
• Remove non-applicable comment by @lestrrat in #1224
• fix document by @lestrrat in #1226
• Remove jws.WithHeaders by @lestrrat in #1227
• tweak badge URL by @lestrrat in #1228
• Add quid pro quo in README by @lestrrat in #1225
• Update serialize.go by @lestrrat in #1234
• Lint fix by @lestrrat in #1235
• Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1231
• Change random big value to math.MaxInt by @lestrrat in #1241
• Bump pozil/auto-assign-issue from 2.0.0 to 2.0.1 by @dependabot in #1238
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1245
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #1269
• Bump pozil/auto-assign-issue from 2.0.1 to 2.1.2 by @dependabot in #1261
• Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by @dependabot in #1263
• Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #1272
• [v3] Fixes to work with go1.24 by @lestrrat in #1299
• autodoc updates by @github-actions in #1300
• Bump pozil/auto-assign-issue from 2.1.2 to 2.2.0 by @dependabot in #1279
• Develop v3 actions cache by @lestrrat in #1303
• Bump golangci/golangci-lint-action from 6.2.0 to 6.5.0 by @dependabot in #1290
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by @dependabot in #1293
• Bump golang.org/x/crypto from 0.32.0 to 0.34.0 by @dependabot in #1297
• Bump golang.org/x/crypto from 0.34.0 to 0.35.0 by @dependabot in #1307
• jws/jwe: split token into fixed number of parts by @drakkan in #1308
• [jwk] Change ecdh importer/exporter by @lestrrat in #1315
• Bump golang.org/x/crypto from 0.35.0 to 0.36.0 by @dependabot in #1312
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @dependabot in #1316
• Change default behavior around truncation of time fields by @lestrrat in #1318
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @dependabot in #1320
• Tweaks on #1322 by @lestrrat in #1323
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @dependabot in #1325
• Implement AWS ALB User Claims parser by @lestrrat in #1328
• Add docs for WithBase64Encoder by @lestrrat in #1329
• autodoc updates by @github-actions in #1330
• avoid internal module by @lestrrat in #1331
• Clear key.Precomputed values before testing equality by @lestrrat in #1333
• autodoc updates by @github-actions in #1332
• autodoc updates by @github-actions in #1334

New Contributors

• @Hannes-Kunnen made their first contribution in #1142
• @maro114510 made their first contribution in #1145
• @kg0r0 made their first contribution in #1174
• @drakkan made their first contribution in #1308

Full Changelog: v2.1.0...v3.0.0

v3.0.0-beta2

What's Changed

• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @dependabot in #1320
• Tweaks on #1322 by @lestrrat in #1323
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @dependabot in #1325
• Implement AWS ALB User Claims parser by @lestrrat in #1328

Full Changelog: v3.0.0-beta1...v3.0.0-beta2

v3.0.0-beta1

What's Changed

• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @dependabot in #1316
• Change default behavior around truncation of time fields by @lestrrat in #1318

Full Changelog: v3.0.0-alpha3...v3.0.0-beta1

v3.0.0-alpha3

What's Changed

• jws/jwe: split token into fixed number of parts by @drakkan in #1308
• [jwk] Change ecdh importer/exporter by @lestrrat in #1315
• Bump golang.org/x/crypto from 0.35.0 to 0.36.0 by @dependabot in #1312

New Contributors

• @drakkan made their first contribution in #1308

Full Changelog: v3.0.0-alpha2...v3.0.0-alpha3

v3.0.0-alpha2

What's Changed

• Update serialize.go by @lestrrat in #1234
• Lint fix by @lestrrat in #1235
• Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1231
• Change random big value to math.MaxInt by @lestrrat in #1241
• Bump pozil/auto-assign-issue from 2.0.0 to 2.0.1 by @dependabot in #1238
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1245
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #1269
• Bump pozil/auto-assign-issue from 2.0.1 to 2.1.2 by @dependabot in #1261
• Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by @dependabot in #1263
• Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #1272
• [v3] Fixes to work with go1.24 by @lestrrat in #1299
• autodoc updates by @github-actions in #1300
• Bump pozil/auto-assign-issue from 2.1.2 to 2.2.0 by @dependabot in #1279
• Develop v3 actions cache by @lestrrat in #1303
• Bump golangci/golangci-lint-action from 6.2.0 to 6.5.0 by @dependabot in #1290
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by @dependabot in #1293
• Bump golang.org/x/crypto from 0.32.0 to 0.34.0 by @dependabot in #1297
• Bump golang.org/x/crypto from 0.34.0 to 0.35.0 by @dependabot in #1307

Full Changelog: v3.0.0-alpha1...v3.0.0-alpha2

v2.1.4

What's Changed

• Bump pozil/auto-assign-issue from 2.0.0 to 2.0.1 by @dependabot in #1237
• Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 by @dependabot in #1243
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #1268
• Bump pozil/auto-assign-issue from 2.0.1 to 2.1.2 by @dependabot in #1260
• Bump golang.org/x/crypto from 0.29.0 to 0.32.0 by @dependabot in #1262
• Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #1271
• [v2] Fixes to work with go1.24 by @lestrrat in #1298
• autodoc updates by @github-actions in #1301
• Bump pozil/auto-assign-issue from 2.1.2 to 2.2.0 by @dependabot in #1276
• Develop v2 actions cache by @lestrrat in #1302
• Bump golangci/golangci-lint-action from 6.2.0 to 6.5.0 by @dependabot in #1289
• Bump github.com/decred/dcrd/dcrec/secp256k1/v4 from 4.3.0 to 4.4.0 by @dependabot in #1291

Full Changelog: v2.1.3...v2.1.4

v2.1.3

What's Changed

• Remove non-applicable comment by @lestrrat in #1223
• Bump golang.org/x/crypto from 0.28.0 to 0.29.0 by @dependabot in #1232
• Change random big value to math.MaxInt by @lestrrat in #1242

Full Changelog: v2.1.2...v2.1.3