Skip to content

OCM-00000 | ci: Update module github.com/golang-jwt/jwt/v4 to v5#3309

Closed
red-hat-konflux[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/github.com-golang-jwt-jwt-v4-5.x
Closed

OCM-00000 | ci: Update module github.com/golang-jwt/jwt/v4 to v5#3309
red-hat-konflux[bot] wants to merge 1 commit into
masterfrom
konflux/mintmaker/master/github.com-golang-jwt-jwt-v4-5.x

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Jul 1, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
github.com/golang-jwt/jwt/v4 v4.5.2 → v5.3.1 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

v5.3.1

Compare Source

What's Changed

🔐 Features
👒 Dependencies

New Contributors

Full Changelog: golang-jwt/jwt@v5.3.0...v5.3.1

v5.3.0

Compare Source

This release is almost identical to to v5.2.3 but now correctly indicates Go 1.21 as minimum requirement.

What's Changed

Full Changelog: golang-jwt/jwt@v5.2.3...v5.3.0

v5.2.3

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.2...v5.2.3

v5.2.2

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.1...v5.2.2

v5.2.1

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.0.0...v5.1.0

v5.0.0

Compare Source

🚀 New Major Version v5 🚀

It's finally here, the release you have been waiting for! We don't take breaking changes lightly, but the changes outlined below were necessary to address some of the challenges of the previous API. A big thanks for @​mfridman for all the reviews, all contributors for their commits and of course @​dgrijalva for the original code. I hope we kept some of the spirit of your original v4 branch alive in the approach we have taken here.
~@​oxisto, on behalf of @​golang-jwt/maintainers

Version v5 contains a major rework of core functionalities in the jwt-go library. This includes support for several validation options as well as a re-design of the Claims interface. Lastly, we reworked how errors work under the hood, which should provide a better overall developer experience.

Starting from v5.0.0, the import path will be:

"github.com/golang-jwt/jwt/v5"

For most users, changing the import path should suffice. However, since we intentionally changed and cleaned some of the public API, existing programs might need to be updated. The following sections describe significant changes and corresponding updates for existing programs.

Parsing and Validation Options

Under the hood, a new validator struct takes care of validating the claims. A long awaited feature has been the option to fine-tune the validation of tokens. This is now possible with several ParserOption functions that can be appended to most Parse functions, such as ParseWithClaims. The most important options and changes are:

  • Added WithLeeway to support specifying the leeway that is allowed when validating time-based claims, such as exp or nbf.
  • Changed default behavior to not check the iat claim. Usage of this claim is OPTIONAL according to the JWT RFC. The claim itself is also purely informational according to the RFC, so a strict validation failure is not recommended. If you want to check for sensible values in these claims, please use the WithIssuedAt parser option.
  • Added WithAudience, WithSubject and WithIssuer to support checking for expected aud, sub and iss.
  • Added WithStrictDecoding and WithPaddingAllowed options to allow previously global settings to enable base64 strict encoding and the parsing of base64 strings with padding. The latter is strictly speaking against the standard, but unfortunately some of the major identity providers issue some of these incorrect tokens. Both options are disabled by default.

Changes to the Claims interface

Complete Restructuring

Previously, the claims interface was satisfied with an implementation of a Valid() error function. This had several issues:

  • The different claim types (struct claims, map claims, etc.) then contained similar (but not 100 % identical) code of how this validation was done. This lead to a lot of (almost) duplicate code and was hard to maintain
  • It was not really semantically close to what a "claim" (or a set of claims) really is; which is a list of defined key/value pairs with a certain semantic meaning.

Since all the validation functionality is now extracted into the validator, all VerifyXXX and Valid functions have been removed from the Claims interface. Instead, the interface now represents a list of getters to retrieve values with a specific meaning. This allows us to completely decouple the validation logic with the underlying storage representation of the claim, which could be a struct, a map or even something stored in a database.

type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}
Supported Claim Types and Removal of StandardClaims

The two standard claim types supported by this library, MapClaims and RegisteredClaims both implement the necessary functions of this interface. The old StandardClaims struct, which has already been deprecated in v4 is now removed.

Users using custom claims, in most cases, will not experience any changes in the behavior as long as they embedded RegisteredClaims. If they created a new claim type from scratch, they now need to implemented the proper getter functions.

Migrating Application Specific Logic of the old Valid

Previously, users could override the Valid method in a custom claim, for example to extend the validation with application-specific claims. However, this was always very dangerous, since once could easily disable the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new ClaimsValidator interface has been introduced. This interface consists of the Validate() error function. If the validator sees, that a Claims struct implements this interface, the errors returned to the Validate function will be appended to the regular standard validation. It is not possible to disable the standard validation anymore (even only by accident).

Usage examples can be found in example_test.go, to build claims structs like the following.

// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}

Changes to the Token and Parser struct

The previously global functions DecodeSegment and EncodeSegment were moved to the Parser and Token struct respectively. This will allow us in the future to configure the behavior of these two based on options supplied on the parser or the token (creation). This also removes two previously global variables and moves them to parser options WithStrictDecoding and WithPaddingAllowed.

In order to do that, we had to adjust the way signing methods work. Previously they were given a base64 encoded signature in Verify and were expected to return a base64 encoded version of the signature in Sign, both as a string. However, this made it necessary to have DecodeSegment and EncodeSegment global and was a less than perfect design because we were repeating encoding/decoding steps for all signing methods. Now, Sign and Verify operate on a decoded signature as a []byte, which feels more natural for a cryptographic operation anyway. Lastly, Parse and SignedString take care of the final encoding/decoding part.

In addition to that, we also changed the Signature field on Token from a string to []byte and this is also now populated with the decoded form. This is also more consistent, because the other parts of the JWT, mainly Header and Claims were already stored in decoded form in Token. Only the signature was stored in base64 encoded form, which was redundant with the information in the Raw field, which contains the complete token as base64.

type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}

Most (if not all) of these changes should not impact the normal usage of this library. Only users directly accessing the Signature field as well as developers of custom signing methods should be affected.

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v4.5.0...v5.0.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by CodeRabbit

  • Chores
    • Updated a third-party authentication library to a newer major version.

@red-hat-konflux
OCM-00000 | ci: Update module github.com/golang-jwt/jwt/v4 to v5
d896968 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux red-hat-konflux Bot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Jul 1, 2026
@red-hat-konflux

red-hat-konflux Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: mod upgrade --mod-name=github.com/golang-jwt/jwt/v4 -t=5
could not load package: err: exit status 1: stderr: go: inconsistent vendoring in /tmp/renovate/repos/github/openshift/rosa:
	github.com/golang-jwt/jwt/v5@v5.3.1: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt

	To ignore the vendor directory, use -mod=readonly or -mod=mod.
	To sync the vendor directory, run:
		go mod vendor

@coderabbitai

coderabbitai Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

This pull request updates the go.mod file to change the direct dependency from github.com/golang-jwt/jwt/v4 version v4.5.2 to github.com/golang-jwt/jwt/v5 version v5.3.1. No other dependency requirements or replace directives were modified, and no exported or public entity declarations were altered.

Changes

File Change Summary
go.mod Updated direct dependency from github.com/golang-jwt/jwt/v4 v4.5.2 to github.com/golang-jwt/jwt/v5 v5.3.1

Sequence Diagram(s)

Not applicable — this change is limited to a dependency version update in go.mod with no observable code path changes.

Estimated code review effort: 2 (Simple)

Related issues: No related issues found.

Related PRs: No related pull requests found.

Suggested labels: dependencies, go

Suggested reviewers: No specific reviewer suggestions available based on the provided information.

Poem: A rabbit hopped through go.mod's field, / Traded v4 for v5's shield, / One line changed, tidy and neat, / A version bump, quick and sweet, / Hop, hop, deploy — the build's now sealed.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description is a Renovate update notice and does not use the required template sections for context, testing, and related issues. Rewrite it to follow the repository template and fill in PR Summary, issue context, related issues, type of change, testing, and breaking changes.
✅ Passed checks (14 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly states the dependency update from golang-jwt v4 to v5 and matches the change set.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed Diff against origin/master only changes go.mod; no Ginkgo test titles were added or edited.
Test Structure And Quality ✅ Passed PASS: The PR only changes go.mod (jwt v4→v5); no Ginkgo test code is modified, so these test-quality checks don't apply.
Microshift Test Compatibility ✅ Passed PASS: This PR only bumps a Go module in go.mod; no new Ginkgo e2e tests or MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR only updates go.mod for jwt v5; no new Ginkgo e2e tests were added, so there are no SNO-specific assumptions to flag.
Topology-Aware Scheduling Compatibility ✅ Passed PR only updates go.mod (jwt v4→v5); no deployment manifests, operator code, or controllers are modified, so the topology scheduling check doesn’t apply.
Ote Binary Stdout Contract ✅ Passed PASS: The PR only changes go.mod (jwt v4→v5); no process-level code or stdout writes were modified, so the OTE stdout contract is unaffected.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only go.mod changed versus origin/master; no Ginkgo e2e tests or network-sensitive code were added.
No-Weak-Crypto ✅ Passed PASS: The PR only bumps jwt in go.mod; scans found no MD5/SHA1/DES/RC4/ECB or secret/token compares in changed code or vendored jwt.
Container-Privileges ✅ Passed PR only updates go.mod; no container/K8s manifests or privilege settings were changed.
No-Sensitive-Data-In-Logs ✅ Passed Only go.mod changed to bump jwt v4→v5; no logging code or sensitive-data output was added.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch konflux/mintmaker/master/github.com-golang-jwt-jwt-v4-5.x

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]
Once this PR has been reviewed and has the lgtm label, please assign amandahla for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Hi @red-hat-konflux[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai[bot]
coderabbitai Bot reviewed Jul 1, 2026
View reviewed changes

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@go.mod`:
- Line 24: The JWT migration is incomplete because the codebase still imports
github.com/golang-jwt/jwt/v4 while go.mod has already moved to v5. Update the
imports in pkg/config/token.go, pkg/config/config.go, cmd/token/cmd.go, and
cmd/login/cmd.go to use the v5 module path, then refresh dependency metadata so
go.sum no longer retains the old v4 entries and everything builds against a
single JWT module version.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e92811c3-a497-432c-b5ae-0cea31c11270

📥 Commits

Reviewing files that changed from the base of the PR and between e6c81eb and d896968.

📒 Files selected for processing (1)
  • go.mod

Comment thread go.mod
github.com/dchest/validator v0.0.0-20191217151620-8e45250f2371
github.com/dustin/go-humanize v1.0.1
github.com/golang-jwt/jwt/v4 v4.5.2
github.com/golang-jwt/jwt/v5 v5.3.1

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
rg -n 'github.com/golang-jwt/jwt/v4' .

Repository: openshift/rosa

Length of output: 3890

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'go.mod:\n'
nl -ba go.mod | sed -n '20,28p'

printf '\nRemaining v4 references outside vendored upstream docs:\n'
rg -n 'github.com/golang-jwt/jwt/v4' go.sum cmd pkg vendor/modules.txt vendor/github.com/openshift-online/ocm-sdk-go --glob '!vendor/github.com/golang-jwt/jwt/v4/**'

printf '\nCurrent v5 references:\n'
rg -n 'github.com/golang-jwt/jwt/v5' go.mod go.sum cmd pkg vendor/modules.txt vendor/github.com/openshift-online/ocm-sdk-go

Repository: openshift/rosa

Length of output: 200

Finish the JWT v5 migration

go.mod is on github.com/golang-jwt/jwt/v5, but the tree still imports /v4 in pkg/config/token.go, pkg/config/config.go, cmd/token/cmd.go, and cmd/login/cmd.go, and go.sum still carries the old /v4 entries. Update the remaining imports and dependency metadata together so the build stays on one module path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 24, The JWT migration is incomplete because the codebase
still imports github.com/golang-jwt/jwt/v4 while go.mod has already moved to v5.
Update the imports in pkg/config/token.go, pkg/config/config.go,
cmd/token/cmd.go, and cmd/login/cmd.go to use the v5 module path, then refresh
dependency metadata so go.sum no longer retains the old v4 entries and
everything builds against a single JWT module version.

Source: Path instructions

@openshift-ci

openshift-ci Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

@red-hat-konflux[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/security d896968 link false /test security
ci/prow/lint d896968 link true /test lint
ci/prow/images-images d896968 link true /test images-images
ci/prow/build d896968 link true /test build
ci/prow/test d896968 link true /test test
ci/prow/e2e-presubmits-images d896968 link true /test e2e-presubmits-images

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@red-hat-konflux

red-hat-konflux Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 5.x releases. But if you manually upgrade to 5.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@red-hat-konflux red-hat-konflux Bot deleted the konflux/mintmaker/master/github.com-golang-jwt-jwt-v4-5.x branch July 1, 2026 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] left review comments
@BraeTroutman BraeTroutman Awaiting requested review from BraeTroutman
@jerichokeyne jerichokeyne Awaiting requested review from jerichokeyne

Assignees

No one assigned

Labels

ok-to-test Indicates a non-member PR verified by an org member that is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@olucasfreitas