Skip to content

chore(deps): Bump jsonwebtoken from 10.4.0 to 11.0.0 - #160

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/jsonwebtoken-11.0.0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/jsonwebtoken-11.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps jsonwebtoken from 10.4.0 to 11.0.0.

Changelog

Sourced from jsonwebtoken's changelog.

11.0.0 (2026-07-24)

  • Add conversions between Algorithm and KeyAlgorithm
  • JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
  • JWKs with unknown key types are now deserializable
  • BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
  • BREAKING: Jwk.thumbprint now returns a Result<_>
  • BREAKING: Header.extras is now a struct that allows for deserialization to any T
  • BREAKING: Implicit features resulting from optional crates have been removed
  • BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
  • BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
  • BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

  • When constructing HMAC signers, the algorithm family must now be verified on construction
  • JwkUtils has been renamed to KeyUtils
    • compute_digest now returns a Result<_>
    • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
    • rsa_pub_components_from_public_key has been added
    • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
    • ed_pub_components_from_private_key has been added
Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 27, 2026
Bumps [jsonwebtoken](https://github.com/Keats/jsonwebtoken) from 10.4.0 to 11.0.0.
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/jsonwebtoken-11.0.0 branch from 18a1c40 to aae9d97 Compare August 1, 2026 20:32
letuhao added a commit that referenced this pull request Aug 11, 2026
Same shape as composition_arc_template_edit, opposite outcome. There, op=update
wrote NULL over columns the caller never mentioned and had never worked. Here,
op=update with only `text` changes the text and preserves kind, scope and active.
The difference is where partial-ness is enforced, exactly as #160 concluded: this
repo builds its SET list from the supplied patch rather than trusting the caller to
have stripped its Nones.

It also has the stronger contract of the two. expected_version is required for
op=update, not optional, and the refusal names all three missing pieces at once, so
a blind clobber is impossible by construction rather than merely unlikely. A stale
version returns applied_conflict with current_version, so the retry needs no extra
read.

delete->restore round-trips through is_archived with the text intact, and all four
ops name their missing companions precisely.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
letuhao added a commit that referenced this pull request Aug 11, 2026
…nction

The legacy twin of canon_rule_edit(op=update), and like #160's arc_update it
handles partials correctly: setting active=false alone changed only that, leaving
text and kind intact. Reusing a consumed expected_version returns applied_conflict
with current_version, so the version is single-use rather than decorative.

It also settles from the write side the distinction that misled me in #173. `active`
and `is_archived` are two different user actions, not two names for one: this tool
disables a rule while keeping it in the list, delete removes it from the list
reversibly, and the row after active=false still had is_archived=false. The critic's
own read requires both (active AND NOT is_archived), which is why each has its own
tool.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants