Bump gopkg.in/square/go-jose.v2 from 2.2.2 to 2.5.1

[dependabot]

Bumps gopkg.in/square/go-jose.v2 from 2.2.2 to 2.5.1.

Release notes

Sourced from gopkg.in/square/go-jose.v2's releases.

Version 2.5.1

Bug Fixes

• Fix parsing and validation of x5t and x5t#S256 headers for JWK (h/t @mangas) (#305).

Version 2.5.0

New Features

• Add support for x5u, x5t, and x5t#S256 headers for JWK (#242).
• Add support for RFC 7638 canonical kid for JWK (#269).

Bug Fixes

• Add error checking in jose-util to avoid nil referencing (#250).
• Documentation improvements (#274, #280, #289).

Version 2.4.1

Bug Fixes

• Fixes a bug introduced in v2.4.0 that could cause a panic on invalid inputs (#282).
• Improves performance of parsing payloads with a lot of whitespace (#279).

Version 2.4.0

New Features

• Add support for the b64 header parameter (#230).
• Add functions to handle detached signatures (#234).
• Expose an interface for opaque key encryption/decryption (#261, #257).

Bug Fixes

• Fixes a issue with ECDSA on P-521, whereby the generated shared secret derived for encryption was computed incorrectly (#267, #245).
• Fixes salt length for new RSA-PSS messages to be equal to the hash length, as required by RFC 3447 (#232).
• Don't include the kid header in a JWT if the key id is an empty string (#227).

Version 2.3.1

Fixes a bug in the serialization of ED25519 keys to JWK (JSON), where X/D values ended up being switched for one another in the serialized output (see #224). Reading a serialized private key would also end up switching the X/D values for another, so keys that were serialized/deserialized with old versions of go-jose would work fine (values should end up in the correct place again). However, sharing a private key with another library would have caused problems. If you have private keys that were previously serialized to JWK using this library, the X/D values will be incorrect and will need to be switched in the JSON serialization before the key can be deserialized with an updated version of go-jose.

Version 2.3.0

New Features

• Add support for unwrapping JSON Web Key Set in the jwt sub-package. This means the key passed to Claims or Decrypt can now be a set of keys (of type *jose.JSONWebKeySet), and the key will be selected automatically based on the key id in the header of the token.

Bug Fixes

• Improves handling of exp, iat and nbf claims. This means proper handling for zero dates (#214), don't error if optional exp and nbf claims are missing from the token (#220), and perform an extra check on iat if it is present (#217). Note that expiration in tokens is optional per standard, if you want to require expiration or other claims to be absolutely present in a token be sure to check the claim is present.

Note this release also drops support for Go 1.5 and Go 1.6, we now require Go 1.7 or later.

Commits

• 3a5ee09 Merge pull request #305 from square/mbyczkowski/v2-304-backport
• 1323f1f Fix decoding x5t parameters (#304)
• 2204b3e Merge pull request #291 from square/mbyczkowski/v2-cherry-picks
• 18864eb Document iat claim for jwt.Expected
• 5ac6eba Fix typo in claims.go
• 0af3954 add comments documenting cram is used for jose-util testing
• 5c5751a Support RFC 7638 canonical kid for JWK (#269)
• 6ed2107 added error checking avoid nil referencing when error occurs
• 9d1ab6c Support x5u, x5t, and x5t#S256 headers.
• 4ef0f1b Merge pull request #282 from square/cs/jws-panic
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)