v11.1.0

Compare Source

Changelog

Bug fixes

• 432567c: fix: retract v11.0.1, gate init nil pointers (#​318) (@​caarlos0)

Other work

• de7a9cc: ci: update goreleaser configs (@​caarlos0)

Released with GoReleaser Pro!

v11.0.1

Compare Source

Changelog

Bug fixes

• 0f77fef: fix: add logic to handle nil pointer structs (#​306) (@​NithinGudla)

Documentation updates

• 1e2d9e1: docs: better explain UseFieldNameByDefault (@​caarlos0)
• b436dff: docs: document generics (@​caarlos0)

Released with GoReleaser Pro!

v11.0.0

Compare Source

Changelog

Breaking changes

• Updated module's Go version to 1.18

New Features

• 8aee119: feat: ParseAs, ParseAsWithOptions, Must (#​300) (@​caarlos0)

Bug fixes

• c0ca5e0: fix: UseFieldNameByDefault when uppercased word in name (#​297) (@​caarlos0)

Documentation updates

• b400510: docs: add related projects (#​290) (@​g4s8)
• 5235aff: docs: add used and supported by section to readme (#​289) (@​caarlos0)
• 506c331: docs: update (@​caarlos0)
• af0d375: docs: update caution banner (@​caarlos0)
• 8cddcf2: docs: update readme (@​caarlos0)
• fa32ef4: docs: update readme (@​caarlos0)

Other work

• 4723331: feat!: prepare for release (@​caarlos0)

Released with GoReleaser Pro!

v4.0.2: Version 4.0.2

Compare Source

What's Changed

• Improved documentation of Verify() to note that JSONWebKeySet is a supported argument type
• Defined exported error values for missing x5c header and unsupported elliptic curves error cases

New Contributors

• @​mitar made their first contribution in https://github.com/go-jose/go-jose/pull/104
• @​milosgajdos made their first contribution in https://github.com/go-jose/go-jose/pull/117

Full Changelog: go-jose/go-jose@v4.0.1...v4.0.2

v4.0.1

Compare Source

Fixed

• An attacker could send a JWE containing compressed data that used large
  amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.
  Those functions now return an error if the decompressed data would exceed
  250kB or 10x the compressed size (whichever is larger). Thanks to
  Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@​zer0yu and @​chenjj)
  for reporting.

v4.0.0

Compare Source

This release makes some breaking changes in order to more thoroughly
address the vulnerabilities discussed in Three New Attacks Against JSON Web
Tokens, "Sign/encrypt confusion", "Billion hash attack", and "Polyglot
token".

Changed

• Limit JWT encryption types (exclude password or public key types) (#​78)
• Enforce minimum length for HMAC keys (#​85)
• jwt: match any audience in a list, rather than requiring all audiences (#​81)
• jwt: accept only Compact Serialization (#​75)
• jws: Add expected algorithms for signatures (#​74)
• Require specifying expected algorithms for ParseEncrypted,
  ParseSigned, ParseDetached, jwt.ParseEncrypted, jwt.ParseSigned,
  jwt.ParseSignedAndEncrypted (#​69, #​74)
  • Usually there is a small, known set of appropriate algorithms for a program
    to use and it's a mistake to allow unexpected algorithms. For instance the
    "billion hash attack" relies in part on programs accepting the PBES2
    encryption algorithm and doing the necessary work even if they weren't
    specifically configured to allow PBES2.
• Revert "Strip padding off base64 strings" (#​82)
• The specs require base64url encoding without padding.
• Minimum supported Go version is now 1.21

Added

• ParseSignedCompact, ParseSignedJSON, ParseEncryptedCompact, ParseEncryptedJSON.
  • These allow parsing a specific serialization, as opposed to ParseSigned and
    ParseEncrypted, which try to automatically detect which serialization was
    provided. It's common to require a specific serialization for a specific
    protocol - for instance JWT requires Compact serialization.