fix(deps): update go major dependencies (major) - autoclosed by red-hat-konflux[bot] · Pull Request #1464 · konflux-ci/integration-service

red-hat-konflux · 2026-02-11T15:06:43Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-git/gcfg	`v1.5.1-0.20230307220236-3a3c6141e376` -> `v2.0.2`
github.com/golang-jwt/jwt/v4	`v4.5.2` -> `v5.3.1`
github.com/google/go-github/v45	`v45.2.0` -> `v83.0.0`
github.com/google/go-github/v75	`v75.0.0` -> `v83.0.0`
github.com/santhosh-tekuri/jsonschema/v5	`v5.3.1` -> `v6.0.2`
gitlab.com/gitlab-org/api/client-go	`v0.134.0` -> `v1.42.0`
go.yaml.in/yaml/v2	`v2.4.3` -> `v3.0.4`
gomodules.xyz/jsonpatch/v2	`v2.5.0` -> `v3.0.1`
gopkg.in/evanphx/json-patch.v4	`v4.13.0` -> `v5.9.11`
gopkg.in/yaml.v2	`v2.4.0` -> `v3.0.1`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

go-git/gcfg (github.com/go-git/gcfg)

`v2.0.2`

Compare Source

What's Changed

Remove empty subsection name check from read by @CLBRITTON2 in #7

New Contributors

@CLBRITTON2 made their first contribution in #7

Full Changelog: go-git/gcfg@v2.0.1...v2.0.2

`v2.0.1`

Compare Source

What's Changed

Housekeeping by @pjbgf in #5
Rename module to v2 by @pjbgf in #6

New Contributors

@pjbgf made their first contribution in #5

Full Changelog: go-git/gcfg@v2.0.0...v2.0.1

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

`v5.3.1`

Compare Source

What's Changed

🔐 Features

Add spellcheck Github action to catch common spelling mistakes by @equalsgibson in #458
Add WithNotBeforeRequired parser option and add test coverage by @equalsgibson in #456
Update godoc example func to properly refer to NewWithClaims() by @equalsgibson in #459
Update github workflows by @mfridman in #462
Additional test for CustomClaims that validates unmarshalling behaviour by @equalsgibson in #457
Fix early file close in jwt cli by @mfridman in #472
Add TPM signature reference by @salrashid123 in #473
Remove misleading ParserOptions documentation in #484
Save signature to Token struct after successful signing by @EgorSheff in #417
Set token.Signature in ParseUnverified by @slickwilli in #414

👒 Dependencies

Bump crate-ci/typos from 1.34.0 to 1.35.3 by @dependabot[bot] in #461
Bump crate-ci/typos from 1.35.4 to 1.36.2 by @dependabot[bot] in #470
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #478
Bump crate-ci/typos from 1.36.2 to 1.39.0 by @dependabot[bot] in #480
Bump golangci/golangci-lint-action from 8 to 9 by @dependabot[bot] in #481
Bump actions/setup-go from 5 to 6 by @dependabot[bot] in #469
Bump crate-ci/typos from 1.39.0 to 1.40.0 by @dependabot[bot] in #488
Bump actions/checkout from 5 to 6 by @dependabot[bot] in #487
Bump crate-ci/typos from 1.40.0 to 1.41.0 by @dependabot[bot] in #490
Bump crate-ci/typos from 1.41.0 to 1.42.1 by @dependabot[bot] in #492

New Contributors

@equalsgibson made their first contribution in #458
@salrashid123 made their first contribution in #473
@EgorSheff made their first contribution in #417
@slickwilli made their first contribution in #414

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

`v5.3.0`

Compare Source

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Create CODEOWNERS by @oxisto in #449
Bump Go version to indicate correct minimum requirement by @oxisto in #452

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

`v5.2.3`

Compare Source

What's Changed

Bump GitHub workflows and Go versions by @mfridman in #438
Implementing validation of multiple audiences by @oxisto in #433
Bump golangci/golangci-lint-action from 7 to 8 by @dependabot[bot] in #440
replaced interface{} to any by @aachex in #445
Fix bug in validation of multiple audiences by @sfinnman-cotn in #441

New Contributors

@aachex made their first contribution in #445
@sfinnman-cotn made their first contribution in #441

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

`v5.2.2`

Compare Source

What's Changed

Fixed GHSA-mh63-6h87-95cp by @mfridman
Fixed some typos by @Ashikpaul in #382
build: add go1.22 to ci workflows by @mfridman in #383
Bump golangci/golangci-lint-action from 4 to 5 by @dependabot in #387
Bump golangci/golangci-lint-action from 5 to 6 by @dependabot in #389
chore: bump ci tests to include go1.23 by @mfridman in #405
Fix jwt -show by @AlexanderYastrebov in #406
docs: typo by @kvii in #407
Update SECURITY.md by @oxisto in #416
Update jwt.Parse example to use jwt.WithValidMethods by @mattt in #425

New Contributors

@Ashikpaul made their first contribution in #382
@kvii made their first contribution in #407
@mattt made their first contribution in #425

Full Changelog: golang-jwt/jwt@v5.2.1...v5.2.2

`v5.2.1`

Compare Source

What's Changed

chore: remove unnecessary conversions from tests by @estensen in #370
Trivial: Typo fix for ECDSA error message by @tjs-cinemo in #373
Fix incorrect error return by @ss49919201 in #371

New Contributors

@tjs-cinemo made their first contribution in #373
@ss49919201 made their first contribution in #371

Full Changelog: golang-jwt/jwt@v5.2.0...v5.2.1

`v5.2.0`

Compare Source

What's Changed

Exported NewValidator by @oxisto in #349
Improve ErrInvalidKeyType error messages by @Laurin-Notemann in #361
Update MIGRATION_GUIDE.md by @jbarham in #363

New Contributors

@Laurin-Notemann made their first contribution in #361
@jbarham made their first contribution in #363

Full Changelog: golang-jwt/jwt@v5.1.0...v5.2.0

`v5.1.0`

Compare Source

What's Changed

Using jwt's native ErrInvalidType instead of json.UnsupportedTypeError by @oxisto in #316
Fix typos in comments and test names by @alexandear in #317
Format: add whitespaces, remove empty lines by @alexandear in #319
Refactor example: use io.ReadAll instead of io.Copy by @alexandear in #320
Refactor code by using switch instead of if-else by @alexandear in #318
A quick way to validate token string by @dcalsky in #302
Refactor: remove unnecessary []byte conversion to string by @alexandear in #330
Refactor: compare strings with strings.EqualFold by @alexandear in #329
Avoid use of json.NewDecoder by @craigpastro in #313
Update ParseUnverified godoc by @duhaesbaert in #341
Update ci workflows (add go1.21) by @mfridman in #345
Bump actions/checkout from 3 to 4 by @dependabot in #346
Key rotation with VerificationKeySet by @mfridman in #344
Add explicit ClaimsValidator implementation check for custom claims by @epelc in #343
feat: allow making exp claim required by @tareksha in #351
Add error handling to examples by @craigpastro in #312

New Contributors

@alexandear made their first contribution in #317
@dcalsky made their first contribution in #302
@craigpastro made their first contribution in #313
@duhaesbaert made their first contribution in #341
@epelc made their first contribution in #343
@tareksha made their first contribution in #351

Full Changelog: golang-jwt/jwt@v5.0.0...v5.1.0

`v5.0.0`

Compare Source

🚀 New Major Version `v5` 🚀

It's finally here, the release you have been waiting for! We don't take breaking changes lightly, but the changes outlined below were necessary to address some of the challenges of the previous API. A big thanks for @mfridman for all the reviews, all contributors for their commits and of course @dgrijalva for the original code. I hope we kept some of the spirit of your original v4 branch alive in the approach we have taken here.
~@oxisto, on behalf of @golang-jwt/maintainers

Version v5 contains a major rework of core functionalities in the jwt-go library. This includes support for several validation options as well as a re-design of the Claims interface. Lastly, we reworked how errors work under the hood, which should provide a better overall developer experience.

Starting from v5.0.0, the import path will be:

"github.com/golang-jwt/jwt/v5"

For most users, changing the import path should suffice. However, since we intentionally changed and cleaned some of the public API, existing programs might need to be updated. The following sections describe significant changes and corresponding updates for existing programs.

Parsing and Validation Options

Under the hood, a new validator struct takes care of validating the claims. A long awaited feature has been the option to fine-tune the validation of tokens. This is now possible with several ParserOption functions that can be appended to most Parse functions, such as ParseWithClaims. The most important options and changes are:

Added WithLeeway to support specifying the leeway that is allowed when validating time-based claims, such as exp or nbf.
Changed default behavior to not check the iat claim. Usage of this claim is OPTIONAL according to the JWT RFC. The claim itself is also purely informational according to the RFC, so a strict validation failure is not recommended. If you want to check for sensible values in these claims, please use the WithIssuedAt parser option.
Added WithAudience, WithSubject and WithIssuer to support checking for expected aud, sub and iss.
Added WithStrictDecoding and WithPaddingAllowed options to allow previously global settings to enable base64 strict encoding and the parsing of base64 strings with padding. The latter is strictly speaking against the standard, but unfortunately some of the major identity providers issue some of these incorrect tokens. Both options are disabled by default.

Changes to the `Claims` interface

Complete Restructuring

Previously, the claims interface was satisfied with an implementation of a Valid() error function. This had several issues:

The different claim types (struct claims, map claims, etc.) then contained similar (but not 100 % identical) code of how this validation was done. This lead to a lot of (almost) duplicate code and was hard to maintain
It was not really semantically close to what a "claim" (or a set of claims) really is; which is a list of defined key/value pairs with a certain semantic meaning.

Since all the validation functionality is now extracted into the validator, all VerifyXXX and Valid functions have been removed from the Claims interface. Instead, the interface now represents a list of getters to retrieve values with a specific meaning. This allows us to completely decouple the validation logic with the underlying storage representation of the claim, which could be a struct, a map or even something stored in a database.

type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}

Supported Claim Types and Removal of `StandardClaims`

The two standard claim types supported by this library, MapClaims and RegisteredClaims both implement the necessary functions of this interface. The old StandardClaims struct, which has already been deprecated in v4 is now removed.

Users using custom claims, in most cases, will not experience any changes in the behavior as long as they embedded RegisteredClaims. If they created a new claim type from scratch, they now need to implemented the proper getter functions.

Migrating Application Specific Logic of the old `Valid`

Previously, users could override the Valid method in a custom claim, for example to extend the validation with application-specific claims. However, this was always very dangerous, since once could easily disable the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new ClaimsValidator interface has been introduced. This interface consists of the Validate() error function. If the validator sees, that a Claims struct implements this interface, the errors returned to the Validate function will be appended to the regular standard validation. It is not possible to disable the standard validation anymore (even only by accident).

Usage examples can be found in example_test.go, to build claims structs like the following.

// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}

Changes to the `Token` and `Parser` struct

The previously global functions DecodeSegment and EncodeSegment were moved to the Parser and Token struct respectively. This will allow us in the future to configure the behavior of these two based on options supplied on the parser or the token (creation). This also removes two previously global variables and moves them to parser options WithStrictDecoding and WithPaddingAllowed.

In order to do that, we had to adjust the way signing methods work. Previously they were given a base64 encoded signature in Verify and were expected to return a base64 encoded version of the signature in Sign, both as a string. However, this made it necessary to have DecodeSegment and EncodeSegment global and was a less than perfect design because we were repeating encoding/decoding steps for all signing methods. Now, Sign and Verify operate on a decoded signature as a []byte, which feels more natural for a cryptographic operation anyway. Lastly, Parse and SignedString take care of the final encoding/decoding part.

In addition to that, we also changed the Signature field on Token from a string to []byte and this is also now populated with the decoded form. This is also more consistent, because the other parts of the JWT, mainly Header and Claims were already stored in decoded form in Token. Only the signature was stored in base64 encoded form, which was redundant with the information in the Raw field, which contains the complete token as base64.

type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}

Most (if not all) of these changes should not impact the normal usage of this library. Only users directly accessing the Signature field as well as developers of custom signing methods should be affected.

What's Changed

Added GitHub Actions Markdown by @oxisto in #260
Remove StandardClaims in favor of RegisteredClaims by @oxisto in #235
Adding more coverage by @oxisto in #268
More consistent way of handling validation errors by @oxisto in #274
New Validation API by @oxisto in #236
v5 Pre-Release by @oxisto in #234
no need for string slice and call to strings.join by @moneszarrugh in #115
Update MIGRATION_GUIDE.md by @liam-verta in #289
Moving DecodeSegement to Parser by @oxisto in #278
Adjusting the error checking example by @oxisto in #270
add documentation to hmac Verify & Sign to detail why string is not an advisable input for key by @dillonstreator in #249
Add golangci-lint by @mfridman in #279
Added dependabot updates for GitHub actions by @oxisto in #298
Bump actions/checkout from 2 to 3 by @dependabot in #299
Bump actions/setup-go from 3 to 4 by @dependabot in #300
Added coverage reporting by @oxisto in #304
Last Documentation cleanups for v5 release by @oxisto in #291
enable jwt.ParsePublicKeyFromPEM to parse PKCS1 Public Key by @twocs in #120

New Contributors

@moneszarrugh made their first contribution in #115
@liam-verta made their first contribution in #289
@dillonstreator made their first contribution in #249
@dependabot made their first contribution in #299
@twocs made their first contribution in #120

Full Changelog: golang-jwt/jwt@v4.5.0...v5.0.0

google/go-github (github.com/google/go-github/v45)

`v83.0.0`

Compare Source

I don't recall ever having this many breaking API changes in a single release, and the last release was only 3 weeks ago!

A special heart-felt thanks goes to @merchantmoh-debug, @Not-Dhananjay-Mishra, and @alexandear for the addition of a long-requested feature to this repo:

native auto-generated iterators for all List* methods that support pagination (change your call from List* to List*Iter and make sure to use a rate-limiting transport or you will quickly exhaust your quotas!)

A second set of heart-felt thanks go to @stevehipwell for setting up our REVIEWERS file and to our amazing volunteer reviewers:

who have reduced our code-review wait times from days (sometimes weeks) down to literally hours and thereby enable rapid responses to bug fixes and attempts to stay up-to-date with the ever-evolving GitHub v3 API.

This release contains the following breaking API changes:

fix!: Divide PackageGetAllVersions into two separate methods ListPackageVersions and ListUserPackageVersions (#4014)
BREAKING CHANGE: PackageGetAllVersions is now divided into ListPackageVersions and ListUserPackageVersions.
fix!: Remove unsupported pagination from ListAutolinks (#4012)
BREAKING CHANGE: opts *ListOptions is removed from RepositoriesService.ListAutoLinks.
fix!: Remove ListOptions from PullRequestsService.ListReviewers (#4009)
BREAKING CHANGE: PullRequestsService.ListReviewers no longer has opts *ListOptions.
fix!: Change PremiumRequestUsageItem quantities to float64 (#4002)
BREAKING CHANGE: PremiumRequestUsageItem numeric fields are now float64.
fix!: Add ListOptions to ListDeploymentBranchPolicies and ListCustomDeploymentRuleIntegrations (#3988)
BREAKING CHANGE: RepositoriesService.ListDeploymentBranchPolicies and RepositoriesService.ListCustomDeploymentRuleIntegrations now accept ListOptions.
fix!: Pass url struct tags by value instead of by reference (#3991)
BREAKING CHANGE: Many *Options structs now pass omitempty URL struct fields by value instead of by reference.
fix!: Fix pagination support for IssuesService list methods (#3984)
BREAKING CHANGE: ListCursorOptions is removed from IssueListOptions.
fix!: Add field PerPage to OrganizationsListOptions (#3986)
BREAKING CHANGE: OrganizationsListOptions now contains only PerPage instead of ListOptions.
fix!: Add ListLicensesOptions to LicensesService.List (#3981)
BREAKING CHANGE: LicensesService.List now accepts ListLicensesOptions for pagination.
fix!: Change SCIMEnterpriseAttributeOperation.Value from *string to any (#3971)
BREAKING CHANGE: SCIMEnterpriseAttributeOperation.Value is changed from *string to any.
feat!: Add ListOptions to RepositoriesService.ListAllTopics (#3978)
BREAKING CHANGE: RepositoriesService.ListAllTopics now accepts ListOptions for pagination.
fix!: Replace UserListOptions.ListOptions with UserListOptions.PerPage (#3977)
BREAKING CHANGE: Replaces UserListOptions.ListOptions with UserListOptions.PerPage which also removes UsersService.ListAllIter.
fix!: CreateHostedRunnerRequest, UpdateHostedRunnerRequest instead of HostedRunnerRequest (#3973)
BREAKING CHANGE: ActionsService.CreateHostedRunner and EnterpriseService.CreateHostedRunner now accept CreateHostedRunnerRequest; ActionsService.UpdateHostedRunner and EnterpriseService.UpdateHostedRunner now accept UpdateHostedRunnerRequest.
refactor!: Use RepositoryPermissions struct for User.Permissions (#3963)
BREAKING CHANGE: User.Permissions is now *RepositoryPermissions instead of map[string]bool.