jwx Files

Security fix for GHSA-4cf7-xm37-g63h.

Custom claim, header, and JWK field names are now JSON-escaped on output. Previously a name was written between the quotes as is, so a name containing " could close its own member and add members the application never set. For example, calling Set with the name x":0,"admin produced a signed token containing "admin":true. Every name now yields exactly one member, and names that need no escaping serialize exactly as before. A name that is not valid UTF-8 now fails serialization instead of being written raw.

See the Changes file for guidance on screening caller-supplied names.

Fixed in v4.5.0 and v3.3.0. v2, v1, and v0 are unmaintained and will not receive a fix.

For more detailed release notes, see Changes.

What's Changed

• build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in https://github.com/lestrrat-go/jwx/pull/2318
• build(deps): bump github/codeql-action from 4.37.7 to 4.37.8 by @dependabot[bot] in https://github.com/lestrrat-go/jwx/pull/2322
• [v4] deprecate AlgorithmsForKey, move to internal by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2325
• [v4] add jws.WithStrictECDSA sign option by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2327
• [v4] fix curve inference claim in docs by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2329
• build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 by @dependabot[bot] in https://github.com/lestrrat-go/jwx/pull/2333
• fix jwk.ParseKey generic guidance in guide skill by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2335
• fix JWKS algorithm inference claim in guide by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2336
• document exact alg match rule in guide by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2337
• note RFC 9864 EdDSA deprecation in guide by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2338
• drop nonexistent v3 and v2 plugin pointers by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2339
• correct ML-DSA import panic claim in guide by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2340
• add jwxfilter to guide companion table by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2341
• build(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in https://github.com/lestrrat-go/jwx/pull/2347
• [v4] escape JSON object member names on output by @lestrrat in https://github.com/lestrrat-go/jwx/pull/2348

Full Changelog: https://github.com/lestrrat-go/jwx/compare/v4.4.0...v4.5.0