fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/lestrrat-go/jwx/v3	v3.1.1 → v4.0.2

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.0.2

Compare Source

For more detailed release notes, see Changes.

What's Changed

• ci: print coverage summary in GitHub Actions run summary by @​lestrrat in #​2078
• ci: also run on push to target branches by @​lestrrat in #​2079
• jws: refuse "b64" header in VerifyCompactFast by @​lestrrat in #​2080
• jws: VerifyCompactFast refusals match jws.VerifyError() class by @​lestrrat in #​2082
• jws: name loose keySet options in fan-out verify error by @​lestrrat in #​2084
• jws: honor RFC 7797 b64=false in Message.MarshalJSON by @​lestrrat in #​2086
• jws: reject literal-JSON "protected" in general-form JWS by @​lestrrat in #​2088
• jwt: ParseRequest: don't skip form body on chunked transfer by @​lestrrat in #​2090
• jwt: Settings rejects out-of-range NumericDate precision by @​lestrrat in #​2092
• jwt: pedantic mode enforces cty=JWT nested-envelope shape by @​lestrrat in #​2093
• jwt: reshape base64-corruption hint as diagnosis-first by @​lestrrat in #​2095
• jwt: defensively reject missing claims in MaxDeltaIs / MinDeltaIs by @​lestrrat in #​2098
• jwt: ParseInsecure: parse loop-local payload, not original input by @​lestrrat in #​2096
• jwt: align Validate fast/slow paths to same iat,exp,nbf check order by @​lestrrat in #​2100
• jws: Verify rejects b64=false without "b64" listed in "crit" by @​lestrrat in #​2101
• jws: Sign auto-declares "b64" in "crit" when emitting b64=false by @​lestrrat in #​2103
• jws: declare "b64" as typed bool header field by @​lestrrat in #​2105
• jws: reject general-form JWS with top-level "header" sibling of "signatures" by @​lestrrat in #​2107
• jws: typed sentinel for AlgorithmsForKey unclassifiable-key failures by @​lestrrat in #​2109
• jws: VerifyMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2111
• jws: cleanup follow-ups from recent review (low-severity batch) by @​lestrrat in #​2113
• jwe/jwebb: document Register{HPKE,MLKEM,MLKEMDirect}Algorithm as privileged extension points by @​lestrrat in #​2115
• jwe: DecryptMessage observes ctx cancellation between loop iterations by @​lestrrat in #​2116
• jwe: parse and bound-check PBES2 p2c in int64 space; name the violated bound by @​lestrrat in #​2118
• jwe: WithKey validates alg-vs-key shape at option-time by @​lestrrat in #​2120
• jwe: compression cap error names "decompressed" payload, the option, and the size by @​lestrrat in #​2122
• jwe: bound joined-error count and drop redundant outer Decrypt prefix by @​lestrrat in #​2124
• jwe: keySetProvider surfaces per-key errors via errors.Join by @​lestrrat in #​2126
• jwe: add WithDisabledKeyAlgorithms global policy hook by @​lestrrat in #​2128
• jwe: document WithMaxDecompressBufferSize behavior at non-positive values by @​lestrrat in #​2130
• jwk: stop duplicating JWK fields at JWKS top level on parse by @​lestrrat in #​2132
• jwk: wrap ParseKey/ParseKeyAs errors with ParseError sentinel by @​lestrrat in #​2134
• jwk: stream the keys array with cap-before-allocate by @​lestrrat in #​2136
• jwk: probe tolerates duplicate JSON field names by @​lestrrat in #​2138
• jwk: treat nil key from custom KeyParser as continue, not success by @​lestrrat in #​2139
• jwk: fix phantom ContinueParseError refs and unmarshaler typo in docs by @​lestrrat in #​2141
• jwk: add UnknownKeyTypeError typed error by @​lestrrat in #​2143
• jwk: document AKP-specific Thumbprint canonicalization on public methods by @​lestrrat in #​2144
• docs/jwk: use jwk.WithX509(true) in PEM section prose by @​lestrrat in #​2145
• docs/jwk: document EncodePEM emit-to-PEM path by @​lestrrat in #​2146
• MIGRATION: document PublicSetOf default-reject for symmetric keys by @​lestrrat in #​2147
• jwk: clarify that any value <= 0 disables the RSA strength floor by @​lestrrat in #​2148
• jwk: move extension-authoring walkthrough from doc.go to docs/04-jwk.md by @​lestrrat in #​2149
• jwk: correct Import godoc for crypto/ecdh dispatch by @​lestrrat in #​2150
• jwk: surface Export type mismatch as KeyTypeMismatchError by @​lestrrat in #​2151
• jwk: RegisterKeyImporter takes KeyImporter, not a typed function by @​lestrrat in #​2152
• Changes: draft v4.0.2 release notes by @​lestrrat in #​2154

Full Changelog: lestrrat-go/jwx@v4.0.1...v4.0.2

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in #​2041
• autodoc updates by @​github-actions[bot] in #​2042
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in #​2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in #​2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in #​2051
• autodoc updates by @​github-actions[bot] in #​2053
• docs: document PrivateClaims concurrency contract by @​lestrrat in #​2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in #​2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in #​2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in #​2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in #​2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in #​2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in #​2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in #​2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in #​2070
• autodoc updates by @​github-actions[bot] in #​2069
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in #​2076

Full Changelog: lestrrat-go/jwx@v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION-v4.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/lestrrat-go/dsig	v1.2.1 -> v1.3.0

[kosmoz]

This requires enabling the experimental encoding/json/v2 API which also changes the behavior of encoding/json globally.

https://go.dev/blog/jsonv2-exp