Bump github.com/lestrrat-go/jwx/v4 from 4.2.0 to 4.4.0

[dependabot]

Bumps github.com/lestrrat-go/jwx/v4 from 4.2.0 to 4.4.0.

Release notes

Sourced from github.com/lestrrat-go/jwx/v4's releases.

v4.4.0

For more detailed release notes, see Changes.

What's Changed

• implement ML-DSA natively on Go 1.27 by @​lestrrat in lestrrat-go/jwx#2309
• use released Go 1.27 in CI by @​lestrrat in lestrrat-go/jwx#2308
• move ML-DSA primitives to dsig by @​lestrrat in lestrrat-go/jwx#2310
• generate ML-DSA from jwa/objects.yml by @​lestrrat in lestrrat-go/jwx#2311
• show both ML-DSA paths in the extensions doc by @​lestrrat in lestrrat-go/jwx#2312
• make GOEXPERIMENT conditional on Go 1.26 by @​lestrrat in lestrrat-go/jwx#2313
• point ML-DSA doc cache at generated jwa file by @​lestrrat in lestrrat-go/jwx#2314
• strip inherited jsonv2 on Go 1.27 by @​lestrrat in lestrrat-go/jwx#2315

Full Changelog: lestrrat-go/jwx@v4.3.0...v4.4.0

v4.3.0

For more detailed release notes, see Changes.

What's Changed

• jwe: serialize the JSON "aad" member as BASE64URL(JWE AAD) by @​sueun-dev in lestrrat-go/jwx#2275
• add JWE authenticated data option by @​lestrrat in lestrrat-go/jwx#2277
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 by @​dependabot[bot] in lestrrat-go/jwx#2281
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in lestrrat-go/jwx#2284
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in lestrrat-go/jwx#2286
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @​dependabot[bot] in lestrrat-go/jwx#2291
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @​dependabot[bot] in lestrrat-go/jwx#2294
• fuzz every package, not just the module root by @​lestrrat in lestrrat-go/jwx#2295
• retry a fuzz target that fails with no crasher by @​lestrrat in lestrrat-go/jwx#2296
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in lestrrat-go/jwx#2303
• build(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by @​dependabot[bot] in lestrrat-go/jwx#2302
• fix build under Go 1.27 by @​lestrrat in lestrrat-go/jwx#2304

New Contributors

• @​sueun-dev made their first contribution in lestrrat-go/jwx#2275

Full Changelog: lestrrat-go/jwx@v4.2.0...v4.3.0

Changelog

Sourced from github.com/lestrrat-go/jwx/v4's changelog.

v4.4.0 20 August 2026

• [jwa][jwk][jws] ML-DSA (FIPS 204) is now implemented natively when jwx is built with Go 1.27 or later, where crypto/mldsa is part of the standard library. jwa.MLDSA44(), jwa.MLDSA65() and jwa.MLDSA87() are registered automatically, and *mldsa.PrivateKey / *mldsa.PublicKey values from crypto/mldsa work directly with jws.Sign, jws.Verify, jwk.Import and jwk.Export. No extension module and no side-effect import are required.

  On Go 1.26 the algorithms are not registered at all, so jws.Sign and jws.Verify report them as unsupported instead of failing later with a confusing key error. ML-DSA on Go 1.26 still needs github.com/jwx-go/mldsa/v4. That extension remains safe to import on Go 1.27 from its v4.0.5 release on, which detects the native registration and bridges filippo.io/mldsa keys onto it. (#2309, #2310, #2311)

v4.3.0 18 August 2026

• [jwe] Correct the JSON "aad" member so it contains only BASE64URL of the external Additional Authenticated Data, rather than the combined value used as the content-encryption AAD. Add jwe.WithAuthenticateData for encrypting JSON JWEs with external AAD; the value is included in the shared AEAD input for all recipients, and compact serialization rejects non-empty external AAD. (#2275, #2277)
• Fix the build under Go 1.27. Go 1.27 removed encoding/json/v2.SkipFunc and gave its role to errors.ErrUnsupported, which broke compilation of internal/json for anyone on the new toolchain. The sentinel is now selected by a Go-version build tag, so both Go 1.26 (with GOEXPERIMENT=jsonv2) and Go 1.27 build from the same source. No public API or behavior change.

Commits

• db71983 release v4.4.0
• 683a00f strip inherited jsonv2 on Go 1.27 (#2315)
• 87aa4eb point ML-DSA doc cache at generated jwa file (#2314)
• 2e2adb2 make GOEXPERIMENT conditional on Go 1.26 (#2313)
• 28ed836 show both ML-DSA paths in the extensions doc (#2312)
• 741ca1c generate ML-DSA from jwa/objects.yml (#2311)
• ddd788e move ML-DSA primitives to dsig (#2310)
• 68906d4 use released Go 1.27 in CI (#2308)
• 8f44bc3 implement ML-DSA natively on Go 1.27 (#2309)
• b891d3e release v4.3.0
• Additional commits viewable in compare view