Skip to content

Build(deps): bump jsonwebtoken from 10.3.0 to 11.1.0 - #374

Merged
MichaelOultram-pexip merged 4 commits into
masterfrom
dependabot/cargo/jsonwebtoken-11.1.0
Oct 6, 2026
Merged

MichaelOultram-pexip merged 4 commits into
masterfrom
dependabot/cargo/jsonwebtoken-11.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Bumps jsonwebtoken from 10.3.0 to 11.1.0.

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

  • Add dangerous::insecure_decode_claims

11.0.0 (2026-07-24)

  • Add conversions between Algorithm and KeyAlgorithm
  • JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
  • JWKs with unknown key types are now deserializable
  • BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
  • BREAKING: Jwk.thumbprint now returns a Result<_>
  • BREAKING: Header.extras is now a struct that allows for deserialization to any T
  • BREAKING: Implicit features resulting from optional crates have been removed
  • BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
  • BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
  • BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

  • When constructing HMAC signers, the algorithm family must now be verified on construction
  • JwkUtils has been renamed to KeyUtils
    • compute_digest now returns a Result<_>
    • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
    • rsa_pub_components_from_public_key has been added
    • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
    • ed_pub_components_from_private_key has been added

10.4.0 (2026-05-11)

  • Fix incorrect encoding for Ed25519 JWK thumbprints
  • Make Algorithm.family public and add Validation.new_for_family
  • EncodingKey and DecodingKey are now partially zeroized on drop (the intermediate PemEncodedKey isn't so far)
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [jsonwebtoken](https://github.com/Keats/jsonwebtoken) from 10.3.0 to 11.1.0.
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.3.0...v11.1.0)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 1, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 1, 2026 04:40
@dependabot dependabot Bot added the rust Pull requests that update rust code label Oct 1, 2026
Fixes RUSTSEC-2026-0285
To resolve double_must_use clippy lint in generated code. Also fixes useless
else block in our code.
It is used to parse rust code. Not all of our dependencies have moved to the new
major version yet.
@MichaelOultram-pexip
MichaelOultram-pexip added this pull request to the merge queue Oct 6, 2026
Merged via the queue into master with commit 233cc42 Oct 6, 2026
15 checks passed
@MichaelOultram-pexip
MichaelOultram-pexip deleted the dependabot/cargo/jsonwebtoken-11.1.0 branch October 6, 2026 11:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant