chore(deps): update module github.com/golang-jwt/jwt/v4 to v4.5.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/golang-jwt/jwt/v4	v4.4.1 -> v4.5.1

GitHub Vulnerability Alerts

CVE-2024-51744

Summary

Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

Fix

We have back-ported the error handling logic from the v5 branch to the v4 branch. In this logic, the ParseWithClaims function will immediately return in "dangerous" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release.

Workaround

We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors ("dangerous" ones first), so that you are not running in the case detailed above.

token, err := /* jwt.Parse or similar */
if token.Valid {
	fmt.Println("You look nice today")
} else if errors.Is(err, jwt.ErrTokenMalformed) {
	fmt.Println("That's not even a token")
} else if errors.Is(err, jwt.ErrTokenUnverifiable) {
	fmt.Println("We could not verify this token")
} else if errors.Is(err, jwt.ErrTokenSignatureInvalid) {
	fmt.Println("This token has an invalid signature")
} else if errors.Is(err, jwt.ErrTokenExpired) || errors.Is(err, jwt.ErrTokenNotValidYet) {
	// Token is either expired or not active yet
	fmt.Println("Timing is everything")
} else {
	fmt.Println("Couldn't handle this token:", err)
}

---

Release Notes

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

v4.5.1

Compare Source

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

• Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

v4.5.0

Compare Source

What's Changed

• Allow strict base64 decoding by @​AlexanderYastrebov in https://github.com/golang-jwt/jwt/pull/259

Full Changelog: golang-jwt/jwt@v4.4.3...v4.5.0

v4.4.3

Compare Source

What's Changed

• fix: link update for README.md for v4 by @​krokite in https://github.com/golang-jwt/jwt/pull/217
• Implement a BearerExtractor by @​WhyNotHugo in https://github.com/golang-jwt/jwt/pull/226
• Bump matrix to support latest go version (go1.19) by @​mfridman in https://github.com/golang-jwt/jwt/pull/231
• Include https://github.com/golang-jwt/jwe in README by @​oxisto in https://github.com/golang-jwt/jwt/pull/229
• Add doc comment to ParseWithClaims by @​jkopczyn in https://github.com/golang-jwt/jwt/pull/232
• Refactor: removed the unneeded if statement by @​Krout0n in https://github.com/golang-jwt/jwt/pull/241
• No pointer embedding in the example by @​oxisto in https://github.com/golang-jwt/jwt/pull/255

New Contributors

• @​krokite made their first contribution in https://github.com/golang-jwt/jwt/pull/217
• @​WhyNotHugo made their first contribution in https://github.com/golang-jwt/jwt/pull/226
• @​jkopczyn made their first contribution in https://github.com/golang-jwt/jwt/pull/232
• @​Krout0n made their first contribution in https://github.com/golang-jwt/jwt/pull/241

Full Changelog: golang-jwt/jwt@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

• Added MicahParks/keyfunc to extensions by @​oxisto in https://github.com/golang-jwt/jwt/pull/194
• Update link to v4 on pkg.go.dev page by @​polRk in https://github.com/golang-jwt/jwt/pull/195
• add installation guidelines to the README file by @​morelmiles in https://github.com/golang-jwt/jwt/pull/204
• chore: replace ioutil with io and os by @​estensen in https://github.com/golang-jwt/jwt/pull/198
• CI check for Go code formatting by @​mfridman in https://github.com/golang-jwt/jwt/pull/206
• Create SECURITY.md by @​mfridman in https://github.com/golang-jwt/jwt/pull/171
• Update SECURITY.md by @​oxisto in https://github.com/golang-jwt/jwt/pull/207
• Fixed integer overflow in NumericDate.MarshalJSON by @​qqiao in https://github.com/golang-jwt/jwt/pull/200
• Claims in rsa_test.go Table Driven Test are Unused by @​gkech in https://github.com/golang-jwt/jwt/pull/212

New Contributors

• @​polRk made their first contribution in https://github.com/golang-jwt/jwt/pull/195
• @​morelmiles made their first contribution in https://github.com/golang-jwt/jwt/pull/204
• @​estensen made their first contribution in https://github.com/golang-jwt/jwt/pull/198
• @​qqiao made their first contribution in https://github.com/golang-jwt/jwt/pull/200
• @​gkech made their first contribution in https://github.com/golang-jwt/jwt/pull/212

Full Changelog: golang-jwt/jwt@v4.4.1...v4.4.2

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.