dependabot[bot] opened a new pull request, #32: URL: https://github.com/apache/spark-connect-gateway/pull/32
Bumps [jsonwebtoken](https://github.com/Keats/jsonwebtoken) from 9.3.1 to 11.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md";>jsonwebtoken's changelog</a>.</em></p> <blockquote> <h2>11.0.0 (2026-07-24)</h2> <ul> <li>Add conversions between <code>Algorithm</code> and <code>KeyAlgorithm</code></li> <li>JWKs can now be created from <code>DecodingKey</code>s, creation from <code>EncodingKey</code> and <code>DecodingKey</code> now supports Ed25519 as well</li> <li>JWKs with unknown key types are now deserializable</li> <li>BREAKING: <code>Algorithm</code>, <code>KeyAlgorithm</code>, <code>EllipticCurve</code> and <code>ThumbprintHash</code> are now <code>non_exhaustive</code></li> <li>BREAKING: <code>Jwk.thumbprint</code> now returns a <code>Result<_></code></li> <li>BREAKING: <code>Header.extras</code> is now a struct that allows for deserialization to any <code>T</code></li> <li>BREAKING: Implicit features resulting from optional crates have been removed</li> <li>BREAKING: <code>Validation.insecure_disable_signature_validation</code> has been removed, use <code>dangerous::insecure_decode</code> instead</li> <li>BREAKING: <code>EncodingKey.inner</code> has been renamed to <code>as_bytes</code>, <code>try_get_hmac_secret</code> has been removed</li> <li>BREAKING: <code>DecodingKey.as_bytes</code> and <code>try_get_hmac_secret</code> have been removed, use <code>try_get_as_bytes</code> instead</li> </ul> <h3>Changes for <code>CryptoProvider</code>s</h3> <ul> <li>When constructing HMAC signers, the algorithm family must now be verified on construction</li> <li><code>JwkUtils</code> has been renamed to <code>KeyUtils</code> <ul> <li><code>compute_digest</code> now returns a <code>Result<_></code></li> <li><code>extract_rsa_public_key_components</code> has been renamed to <code>rsa_pub_components_from_private_key</code></li> <li><code>rsa_pub_components_from_public_key</code> has been added</li> <li><code>extract_ec_public_key_coordinates</code> has been renamed to <code>ec_pub_components_from_private_key</code></li> <li><code>ed_pub_components_from_private_key</code> has been added</li> </ul> </li> </ul> <h2>10.4.0 (2026-05-11)</h2> <ul> <li>Fix incorrect encoding for Ed25519 JWK thumbprints</li> <li>Make <code>Algorithm.family</code> public and add <code>Validation.new_for_family</code></li> <li><code>EncodingKey</code> and <code>DecodingKey</code> are now partially zeroized on drop (the intermediate <code>PemEncodedKey</code> isn't so far)</li> </ul> <h2>10.3.0 (2026-01-27)</h2> <ul> <li>Export everything needed to define your own CryptoProvider</li> <li>Fix type confusion with exp/nbf when not required</li> </ul> <h2>10.2.0 (2025-11-06)</h2> <ul> <li>Remove <code>Clone</code> bound from decode functions</li> </ul> <h2>10.1.0 (2025-10-18)</h2> <ul> <li>add <code>dangerous::insecure_decode</code></li> <li>Implement TryFrom &Jwk for DecodingKey</li> </ul> <h2>10.0.0 (2025-09-29)</h2> <ul> <li>BREAKING: now using traits for crypto backends, you have to choose between <code>aws_lc_rs</code> and <code>rust_crypto</code></li> <li>Add <code>Clone</code> bound to <code>decode</code></li> <li>Support decoding byte slices</li> <li>Support JWS</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Keats/jsonwebtoken/commit/900010fb1be550ec2cfa8c32038eb154f9ef56d7";><code>900010f</code></a> Bump v11</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/6aac5ae389808b237788faef4afb454ff4538097";><code>6aac5ae</code></a> Allow deserializing unknown key type JWKs (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/530";>#530</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/e7ea8f0efd1b102342db6de34e2e43592e2c02e5";><code>e7ea8f0</code></a> Implement Default on JwkSet (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/527";>#527</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/249f5f7d84a91f7302c278306c98148fe56d03e9";><code>249f5f7</code></a> Don't panic when computing thumbprint (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/524";>#524</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/b5d9c38ed39a5c3883f9084ac1da87c61ed782a1";><code>b5d9c38</code></a> Prepare for v11 release (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/522";>#522</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/6086da74f433abf495601c4e6e6e96f600d13819";><code>6086da7</code></a> Unify encoding and decoding key APIs (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/515";>#515</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/474728f9198037f2bc86a883918ccac6d8ebb2a2";><code>474728f</code></a> Remove deprecated <code>insecure_disable_signature_validation</code> (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/521";>#521</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/31a1dc64d93735a3951480f01435620f4444ef90";><code>31a1dc6</code></a> Feat: Added support for JWK decoding Ed25519 keys (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/506";>#506</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/e681247d61f5dc3a0f6e5138094f1b15a5aebdb0";><code>e681247</code></a> feat: add Jwk::from_decoding_key (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/475";>#475</a>)</li> <li><a href="https://github.com/Keats/jsonwebtoken/commit/bba16eb4e77230cd759879ff8bffa144afb1a82b";><code>bba16eb</code></a> Allow conversion between Algorithm and KeyAlgorithm (<a href="https://redirect.github.com/Keats/jsonwebtoken/issues/516";>#516</a>)</li> <li>Additional commits viewable in <a href="https://github.com/Keats/jsonwebtoken/compare/v9.3.1...v11.0.0";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
