Bump jwt from 2.7.1 to 3.3.0

[dependabot]

Bumps jwt from 2.7.1 to 3.3.0.

Changelog

Sourced from jwt's changelog.

v3.3.0 (2026-09-11)

Full Changelog

Features:

• Allow a leeway to be given for the iat claim verification #747 - (@​denis1011101)
• Revamp the error hierarchy under a new JWT::Error base class; signing failures now consistently raise JWT::EncodeError, see https://github.com/jwt/ruby-jwt/blob/main/UPGRADING.md #722 (@​anakinj)

Fixes and enhancements:

• Refactor JWT::JWK::Set#initialize so each construction path is a named method #758 (@​anakinj)
• Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip #728
• Fix the Style/DirectiveScope RuboCop offense failing the build #752
• Fix JWT::JWK::Set sharing its key collection with the set it was copied from #751
• Reset the decoded payload and verification state in JWT::EncodedToken#encoded_payload= #749
• Fix JWT::Token#detach_payload! not invalidating an already rendered token #748

v3.2.0 (2026-05-13)

Full Changelog

Features:

• Add enforce_hmac_key_length configuration option #716 - (@​304)

Fixes and enhancements:

• Reject nil and empty HMAC keys when signing and verifying (CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Fix compatibility with the openssl 4.0 gem #706
• Test against Ruby 4.0 on CI #707
• Fix type error when header is not a JSON object #715 - (@​304)

v3.1.2 (2025-06-28)

Full Changelog

Fixes and enhancements:

• Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697
• Fix signing with a EC JWK #699 (@​anakinj)

v3.1.1 (2025-06-24)

Full Changelog

Fixes and enhancements:

• Require the algorithm to be provided when signing and verifying tokens using JWKs #695 (@​anakinj)

... (truncated)

Commits

• ccf2489 Prepare the v3.3.0 release (#762)
• 6cdacc3 Enforce parentheses on method calls with arguments (#761)
• 4a576f8 Declutter jwt_spec.rb (#760)
• 7ddcb0a Fix the RSA-PSS guard skipping the whole jwt_spec file (#759)
• 7cede0c Refactor JWT::JWK::Set#initialize (#758)
• 6ab1be7 Revamp error hierarchy (#722)
• 41fbf31 Invalidate the rendered token when detaching the payload (#757)
• d8e231d Reset verification state when replacing the encoded payload (#756)
• c25fb5e Fix JWT::JWK::Set sharing its key collection when copied (#751)
• bec0ffd Isolate gem builds from release credentials (#755)
• Additional commits viewable in compare view