Repository navigation
Upgrade JWX library #97
Description
Thanks for your work on this project, it is very valuable. Wanted to ask if there are plans to upgrade to the latest version (V3) of the JWX library. github.com/lestrrat-go/jwx
Thanks
Thanks for your work on this project, it is very valuable. Wanted to ask if there are plans to upgrade to the latest version (V3) of the JWX library. github.com/lestrrat-go/jwx
Thanks
Activity
ggicci commentedon Jul 13, 2025
Hey @rumsrami , thanks for reporting and sorry for the late reply. I don't have plan yet because I don't know how severe it is to upgrade a dependency. Usually I will upgrade when I see security issues. But please let me know if this blocks you or not. I can prioritize if needed :)
rumsrami commentedon Jul 14, 2025
Thanks @ggicci for your reply. It doesn't block me at all. The current version does the job fine. The only reason I mentioned it is that the maintainer of the jwx library mentioned that v2 will only get security updates but no new features and he dropped supporting v1 completely. So we are ok for now.
lestrrat commentedon Aug 4, 2025
Hi, jwx maintainer here. I can help you upgrade if you let me.
I think one reason you might consider upgrading is if you are using the happy path for parsing and signing JWTs, you get somewhere around 15~70% performance boost. But otherwise, I do believe v2 is pretty stable so if you don't feel like it, you do you. No problem.
ggicci commentedon Aug 4, 2025
That sounds great! Feel free to contribute anytime — and thanks so much for sharing the info, @lestrrat .
sebdroid commentedon Nov 10, 2025
Hi @ggicci, is it worth upgrading to v2.1.6 in the meantime, as v2.0.20 is vulnerable to CVE-2024-28122?
lestrrat commentedon Nov 12, 2025
I have a version made with AI assistance here.
I don't know if I got the nuances right, so you should definitely take a closer look before attempting to merge.
ggicci commentedon Nov 14, 2025
Thank you @lestrrat for the update. Since the change is a little large to me, I will take a look when I got sufficient time later this weekend.
ggicci commentedon Nov 14, 2025
@sebdroid v1.1.1 has included the target upgrade :)
ggicci commentedon Mar 8, 2026
Closing as I've upgraded to JWX v3 in #109 and released in v1.1.2.