chore(deps): bump github.com/lestrrat-go/jwx/v2 from 2.1.4 to 2.1.6

[dependabot]

Bumps github.com/lestrrat-go/jwx/v2 from 2.1.4 to 2.1.6.

Release notes

Sourced from github.com/lestrrat-go/jwx/v2's releases.

v2.1.6

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

• DIRECT mode content encryption
• Using A256CBC_HS512
• With an erroneously created CEK of exactly 32-bytes.

---

• jws: backport jws parsing ehancements by @​lestrrat in lestrrat-go/jwx#1363
• [v2] Backport #1367 by @​lestrrat in lestrrat-go/jwx#1368

Full Changelog: lestrrat-go/jwx@v2.1.5...v2.1.6

v2.1.5

What's Changed

• jws/jwe: split token into fixed number of parts (#1308) by @​lestrrat in lestrrat-go/jwx#1309
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @​dependabot in lestrrat-go/jwx#1317
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @​dependabot in lestrrat-go/jwx#1319
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @​dependabot in lestrrat-go/jwx#1327
• Remove use of go1.22 in CI by @​lestrrat in lestrrat-go/jwx#1356
• v2: jws/jwe: split token into fixed number of parts (#1308) by @​lestrrat in lestrrat-go/jwx#1355
• Bump github.com/lestrrat-go/blackmagic from 1.0.2 to 1.0.3 by @​dependabot in lestrrat-go/jwx#1354
• autodoc updates by @​github-actions in lestrrat-go/jwx#1359

Full Changelog: lestrrat-go/jwx@v2.1.4...v2.1.5

Changelog

Sourced from github.com/lestrrat-go/jwx/v2's changelog.

v2.1.6 29 Apr 2025

• [jwe] Fixed a long standing bug that could lead to degraded encryption or failure to decrypt JWE messages when a very specific combination of inputs were used for JWE operations.

  This problem only manifested itself when the following conditions in content encryption or decryption were met:

  • Content encryption was specified to use DIRECT mode.
  • Contentn encryption algorithm is specified as A256CBC_HS512
  • The key was erronously constructed with a 32-byte content encryption key (CEK)

  In this case, the user would be passing a mis-constructed key of 32-bytes instead of the intended 64-bytes. In all other cases, this construction would cause an error because crypto/aes.NewCipher would return an error when a key with length not matching 16, 24, and 32 bytes is used. However, due to use using a the provided 32-bytes as half CEK and half the hash, the crypto/aes.NewCipher was passed a 16-byte key, which is fine for AES-128. So internally crypto/aes.NewCipher would choose to use AES-128 instead of AES-256, and happily continue. Note that no other key lengths such as 48 and 128 would have worked. It had to be exactly 32.

  This does indeed result in a downgraded encryption, but we believe it is unlikely that this would cause a problem in the real world, as you would have to very specifically choose to use DIRECT mode, choose the specific content encryption algorithm, AND also use the wrong key size of exactly 32 bytes.

  However, in abandunce of caution, we recommend that you upgrade to v3.0.1 or later, or v2.1.6 or later if you are still on v2 series.

• [jws] Improve performance of jws.SplitCompact and jws.SplitCompactString

• [jwe] Improve performance of jwe.Parse

v2.1.5 16 Apr 2025

• Update minimum require go version to 1.23; this is an indirect consequence of updateing github.com/lestrrat-go/blackmagic
• backport #1308

Commits

• 13e92f3 Merge branch 'develop/v2' into v2
• 5ccb28f Update Changes
• 0081fdb [v2] Backport #1367 (#1368)
• 37a9b05 jws: backport jws parsing ehancements (#1363)
• a980d23 Merge branch 'develop/v2' into v2
• e613cad Update Changes
• 37f80be autodoc updates (#1359)
• bf4893d Bump github.com/lestrrat-go/blackmagic from 1.0.2 to 1.0.3 (#1354)
• 64959e1 jws/jwe: split token into fixed number of parts (#1308) (#1355)
• 7c11c78 Remove use of go1.22 in CI (#1356)
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[Kyrremann]

@dependabot recreate

[Kyrremann]

https://github.com/dependabot recreate

[Kyrremann]

https://github.com/dependabot recreate

[dependabot]

Looks like github.com/lestrrat-go/jwx/v2 is up-to-date now, so this is no longer needed.