fix(deps): update module github.com/micahparks/jwkset to v0.5.17

[trap-renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/MicahParks/jwkset	require	minor	v0.3.1 -> v0.5.17

---

Release Notes

MicahParks/jwkset (github.com/MicahParks/jwkset)

v0.5.17

Compare Source

v0.5.16

Compare Source

v0.5.15: Less strict validation

Compare Source

The purpose of this release is to use less strict validation for JWK. This will allow users to work with non-RFC compliant JWK Sets for small padding mistakes.

Two padding related reasons for this are:

1. Mandatory leading padding for ECDSA JWK parameters.
2. A common mistake adding leading padding to RSA JWK parameter "n".

For padding specifically, this project is only comparing integers after they are parsed from Base64 raw URL encoding by default. To turn on strict validation, there will be a new field on jwkset.ValidateOptions named StrictPadding.

An example for 1 would be a bug in this project were mandatory leading padding was absent: https://github.com/MicahParks/jwkset/issues/18

An example for 2 would be a Firebase service that was reported to be incompatible with this project: https://github.com/MicahParks/jwkset/issues/23

Relevant issues:

• https://github.com/MicahParks/jwkset/issues/23
• https://github.com/MicahParks/jwkset/issues/20
• https://github.com/MicahParks/jwkset/issues/18

Relevant pull requests:

• https://github.com/MicahParks/jwkset/pull/24

v0.5.14

Compare Source

v0.5.13

Compare Source

The purpose of this release is to correctly pad EC JWK parameters with leading zeros where required by RFC 7518.

For "x" and "y":

The length of this octet string MUST be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the octet string must be 66 octets long.

For "d":

The length of this octet string MUST be ceiling(log-base-2(n)/8) octets (where n is the order of the curve).

This is to bring the project into RFC compliance with RFC 7518 Section 6.2.1.2, 6.2.1.3, and 6.2.2.1.

Relevant issues:

• https://github.com/MicahParks/jwkset/issues/18

What's Changed

• Required leading zeros in ECDSA keys by @​MicahParks in https://github.com/MicahParks/jwkset/pull/19

Full Changelog: MicahParks/jwkset@v0.5.12...v0.5.13

v0.5.12

Compare Source

v0.5.11

Compare Source

v0.5.10

Compare Source

v0.5.9: jwksetinfer tool multi-PEM bug

Compare Source

A bug in the cmd/jwksetinfer tool caused multiple PEM file inputs to only output the final PEM key as a JWK Set. This is because the metadata wasn't being passed in and the all key IDs were the same empty string.

Thank you @​aarnaud for discovering the bug and fixing it!

Relevant pull requests:

• https://github.com/MicahParks/jwkset/pull/15

v0.5.8

Compare Source

v0.5.7

Compare Source

v0.5.6: Refresh on unknown key ID

Compare Source

The purpose of this release is to change the default HTTP client to add a feature that refreshes remote JWK Set resources when trying to read a key ID kid that has not been found in the local cache.

This requires rate limiting and the pkg.go.dev/golang.org/x/time/rate has been added as a dependency for that.

Related pull requests:

• https://github.com/MicahParks/jwkset/pull/13

v0.5.5: Consistent optional behavior for X.509 certificate thumbprints

Compare Source

This release fixes a bug where X.509 certificate thumbprints were not optional when a JWKMarshal without these fields was used in NewJWKFromMarshal.

Thank you, @​joshkaplinsky, for reporting this bug!

Relevant pull requests:

• https://github.com/MicahParks/jwkset/pull/12

Relevant issues:

• https://github.com/MicahParks/jwkset/issues/11

v0.5.4

Compare Source

v0.5.3

Compare Source

v0.5.2

Compare Source

v0.5.1

Compare Source

v0.5.0: Add HTTP Client

Compare Source

This release contains a Golang HTTP client for JWK Sets.

v0.4.0: Add website and X.509 support

Compare Source

This project now supports all standardized JSON Web Key parameters, including X.509 assets that I could find. Please open an issue if you find some that are not supported.

Additionally, I made a website for this project. The website is mostly for generating and inspecting JSON Web Keys. Check it out at https://jwkset.com

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[motoki317]

@dependabot rebase

[motoki317]

ちがうそうじゃない