You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(deps): update module github.com/auth0/go-jwt-middleware/v2 to v3 (#4145)
📹
https://www.loom.com/share/4049912c73734143a8dde39ebf3f4fe6
📹
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[github.com/auth0/go-jwt-middleware/v2](https://redirect.github.com/auth0/go-jwt-middleware)
| `v2.3.1` → `v3.0.0` |
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/370) for more information.
---
### Release Notes
<details>
<summary>auth0/go-jwt-middleware
(github.com/auth0/go-jwt-middleware/v2)</summary>
###
[`v3.0.0`](https://redirect.github.com/auth0/go-jwt-middleware/blob/HEAD/CHANGELOG.md#v300-2026-01-19)
[Compare
Source](https://redirect.github.com/auth0/go-jwt-middleware/compare/v2.3.1...v3.0.0)
[Full
Changelog](https://redirect.github.com/auth0/go-jwt-middleware/compare/v2.3.1...v3.0.0)
**BEFORE YOU UPGRADE**
- This is a major release that includes breaking changes. Please see
[MIGRATION\_GUIDE.md](MIGRATION_GUIDE.md) before upgrading. This release
will require changes to your application.
##### Added
- Pure options pattern for validator, middleware, and JWKS provider
([#​357](https://redirect.github.com/auth0/go-jwt-middleware/pull/357),
[#​358](https://redirect.github.com/auth0/go-jwt-middleware/pull/358),
[#​360](https://redirect.github.com/auth0/go-jwt-middleware/pull/360))
- DPoP (Demonstrating Proof-of-Possession) support per RFC 9449
([#​363](https://redirect.github.com/auth0/go-jwt-middleware/pull/363))
- Framework-agnostic core package for reusable validation logic
([#​356](https://redirect.github.com/auth0/go-jwt-middleware/pull/356))
- Type-safe claims retrieval with generics (`GetClaims[T]()`,
`MustGetClaims[T]()`, `HasClaims()`)
- Structured logging support compatible with `log/slog`
- Support for 14 signature algorithms (HS256/384/512, RS256/384/512,
PS256/384/512, ES256/384/512, ES256K, EdDSA)
- Enhanced error responses with RFC 6750 compliance
- Trusted proxy configuration for DPoP behind reverse proxies
- Multiple issuer and audience support with new APIs
- Documentation and linting configuration
([#​361](https://redirect.github.com/auth0/go-jwt-middleware/pull/361))
##### Changed
- Migrated from square/go-jose to lestrrat-go/jwx v3
([#​358](https://redirect.github.com/auth0/go-jwt-middleware/pull/358))
- Module path updated to `github.com/auth0/go-jwt-middleware/v3`
([#​355](https://redirect.github.com/auth0/go-jwt-middleware/pull/355))
- Minimum Go version updated to 1.24
([#​355](https://redirect.github.com/auth0/go-jwt-middleware/pull/355))
- Update examples for v3 module path and new APIs
##### Breaking
- Pure options pattern: All constructors (`New()`) now require
functional options instead of positional parameters
- Context key: `ContextKey{}` is no longer exported - use
`GetClaims[T]()` helper function
- Custom claims now use generics for type safety
- `TokenExtractor` returns `ExtractedToken` (with scheme) instead of
`string`
- Type naming: `ExclusionUrlHandler` renamed to `ExclusionURLHandler`
##### Migration Example
**v2:**
```go
// Validator with positional parameters
jwtValidator, err := validator.New(
keyFunc,
validator.RS256,
"https://issuer.example.com/",
[]string{"my-api"},
)
// Middleware
middleware := jwtmiddleware.New(jwtValidator.ValidateToken)
// Claims access via context key
claims := r.Context().Value(jwtmiddleware.ContextKey{}).(*validator.ValidatedClaims)
```
**v3:**
```go
// Validator with pure options
jwtValidator, err := validator.New(
validator.WithKeyFunc(keyFunc),
validator.WithAlgorithm(validator.RS256),
validator.WithIssuer("https://issuer.example.com/"),
validator.WithAudience("my-api"),
)
// Middleware with options
middleware, err := jwtmiddleware.New(
jwtmiddleware.WithValidator(jwtValidator),
)
// Type-safe claims with generics
claims, err := jwtmiddleware.GetClaims[*validator.ValidatedClaims](r.Context())
```
See [MIGRATION\_GUIDE.md](MIGRATION_GUIDE.md) for complete migration
instructions.
***
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "before 10am on friday" in timezone
Europe/London, Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/overmindtech/workspace).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41NS40IiwidXBkYXRlZEluVmVyIjoiNDMuNTYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwiZ29sYW5nIl19-->
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **High Risk**
> Upgrades a major authentication dependency and rewrites JWT
validation/claim extraction paths, so mistakes could break auth
enforcement or token parsing across the API server.
>
> **Overview**
> Migrates the codebase from `github.com/auth0/go-jwt-middleware/v2` to
`v3`, updating JWKS provider/validator/middleware construction to the
new options-based APIs and adjusting token extraction/claims retrieval.
>
> Because `v3` no longer exposes `ContextKey{}`, the auth middleware now
stores `*validator.ValidatedClaims` under a new
`auth.ValidatedClaimsContextKey{}` and updates downstream callers (e.g.
token expiry in `ManagementServiceHandler.CreateToken`) accordingly. The
API server init path now skips validator setup when
`AllowUnauthenticated` is enabled and tightens startup validation/error
logging for missing Auth0 config; related tests set
`AllowUnauthenticated: true` to accommodate `v3` rejecting empty
audience/domain values.
>
> Also updates `go.mod`/`go.sum` for new transitive deps pulled in by
`v3` (e.g. `lestrrat-go/jwx/v3`) and adds
`github.com/resend/resend-go/v3` to the main require block.
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
e8a54151abc72beb9973302047684ad983aa5b8e. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
GitOrigin-RevId: f8185846b5c05bebfd88c56b76c4d1bb95a592db
0 commit comments