In #226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

Verify OpaqueSigner's Public() return is public (#260)
jws: skip signature on ErrJWKSKidNotFound (#248)
Handle JWE JSON without protected header (#240)
jws: don't strip internal whitespace before parsing JSON (#239)
jws: fewer calls to OpaqueSigner.Public() (#224)
Return a specific error when parsing empty string (#216)
Reject typed nil at Verify time (#285)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) | require | patch | `v4.1.4` → `v4.1.5` | --- ### Release Notes <details> <summary>go-jose/go-jose (github.com/go-jose/go-jose/v4)</summary> ### [`v4.1.5`](https://github.com/go-jose/go-jose/releases/tag/v4.1.5) [Compare Source](https://github.com/go-jose/go-jose/compare/v4.1.4...v4.1.5) ### Fixed security issues - cipher/cbc\_hmac: don't panic on empty ciphertext ([#292](https://github.com/go-jose/go-jose/issues/292)) - cipher/cbc\_hmac: don't panic on invalid key ([#291](https://github.com/go-jose/go-jose/issues/291)) - json: limit stack depth ([#290](https://github.com/go-jose/go-jose/issues/290)) - jwt: reject out-of-range NumericDate values ([#278](https://github.com/go-jose/go-jose/issues/278)) - Check alg against pubkey curve during verify. ([#293](https://github.com/go-jose/go-jose/issues/293)) - Reject malformed [`Ed25519`](https://github.com/go-jose/go-jose/commit/Ed25519) JWKs ([#250](https://github.com/go-jose/go-jose/issues/250)) - jws: choose verification key per-signature ([#243](https://github.com/go-jose/go-jose/issues/243)) ### Breaking Changes In [#226](https://github.com/go-jose/go-jose/issues/226), we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function. ### Changed - Verify OpaqueSigner's Public() return is public ([#260](https://github.com/go-jose/go-jose/issues/260)) - jws: skip signature on ErrJWKSKidNotFound ([#248](https://github.com/go-jose/go-jose/issues/248)) - Handle JWE JSON without protected header ([#240](https://github.com/go-jose/go-jose/issues/240)) - jws: don't strip internal whitespace before parsing JSON ([#239](https://github.com/go-jose/go-jose/issues/239)) - jws: fewer calls to OpaqueSigner.Public() ([#224](https://github.com/go-jose/go-jose/issues/224)) - Return a specific error when parsing empty string ([#216](https://github.com/go-jose/go-jose/issues/216)) - Reject typed nil at Verify time ([#285](https://github.com/go-jose/go-jose/issues/285)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-09-23 16:59:54 -04:00

chore(deps): update module github.com/go-jose/go-jose/v4 to v4.1.5

renovate/artifacts Artifact file update failure

9f22b3210e

renovate-bot commented

2026-09-23 16:59:55 -04:00

Author

Collaborator

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

[20:59:42.011] INFO (1232): Installing tool golang@1.26.0...
[20:59:42.025] ERROR (1232): Unexpected error found when calling "Symbol(construct)" @postConstruct decorated method on class "VersionService"
[20:59:42.026] FATAL (1232): Install tool golang failed in 17ms.

### ⚠️ Artifact update problem Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens: - any of the package files in this branch needs updating, or - the branch becomes conflicted, or - you click the rebase/retry checkbox if found above, or - you rename this PR's title to start with "rebase!" to trigger it manually The artifact failure details are included below: ##### File name: go.sum ``` [20:59:42.011] INFO (1232): Installing tool golang@1.26.0... [20:59:42.025] ERROR (1232): Unexpected error found when calling "Symbol(construct)" @postConstruct decorated method on class "VersionService" [20:59:42.026] FATAL (1232): Install tool golang failed in 17ms. ```