chore(deps): upgrade golang-jwt from v4.5.2 to v5.3.1 by janisz · Pull Request #21258 · stackrox/stackrox

janisz · 2026-06-18T15:23:06Z

Upgrade github.com/golang-jwt/jwt from v4.5.2 to v5.3.1.
Updated import paths from /v4 to /v5 across 4 files.

No API changes required - all used APIs (MapClaims, NewWithClaims,
SigningMethodRS256, ParseWithClaims, RegisteredClaims,
ParseRSAPrivateKeyFromPEM, WithoutClaimsValidation, ErrTokenMalformed)
are compatible with v5.

Changes: golang-jwt/jwt@v4.5.2...v5.3.1

Tested with:

go test ./central/auth/m2m -run TestIssuerFromRawIDToken
go test ./central/auth/m2m -run Test_genericTokenVerifier_VerifyIDToken

Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

Description

change me!

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

change me!

openshift-ci · 2026-06-18T15:23:10Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

janisz · 2026-06-18T15:23:48Z

This change is part of the following stack:

chore(deps): upgrade RoaringBitmap from v1.9.4 to v2.15.0 #21257
- chore(deps): upgrade golang-jwt from v4.5.2 to v5.3.1 #21258 ◀
  - chore(deps): upgrade go-github from v60.0.0 to v88.0.0 #21259
    - chore(deps): upgrade backoff from v4.3.0 to v6.0.1 #21260
      - chore(deps): upgrade mpb from v4.12.2 to v8.12.0 #21261
        
        chore(deps): upgrade go-sarif from v2.3.3 to v3.3.1 #21262
        
        chore(deps): migrate mapstructure from mitchellh to go-viper/v2 #21263
        
        WIP: Major upgrades #19504

_{Change managed by git-spice.}

rhybrillou · 2026-06-18T16:13:23Z

go mod tidy ?

coderabbitai · 2026-07-03T08:45:10Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Changes

Go dependency cache mtime stabilization

Layer / File(s)	Summary
Configurable Go cache mtime handling `.github/actions/cache-go-dependencies/action.yaml`	Adds `mtime-mode` with `git-log` and `blob` strategies, stabilizes mtimes for the Go test cache and module index, and keeps directory mtimes fixed.

JWT test token encoding

Layer / File(s)	Summary
Encoded JWT test signature `central/jwt/jwt_test.go`	Updates the JWT test helper to Base64URL-encode the fake signature segment.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: dependabot[bot]

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR includes a brief summary and test commands, but most required template sections remain as placeholders or unchecked.	Fill out the Description, User-facing documentation, Testing and quality, Automated testing, and How I validated my change sections, or explicitly mark items not needed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately describes the main change: upgrading golang-jwt from v4.5.2 to v5.3.1.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch golang-jwt

_{Comment @coderabbitai help to get the list of available commands.}

Upgrade github.com/golang-jwt/jwt from v4.5.2 to v5.3.1. Updated import paths from /v4 to /v5 across 4 files. No API changes required - all used APIs (MapClaims, NewWithClaims, SigningMethodRS256, ParseWithClaims, RegisteredClaims, ParseRSAPrivateKeyFromPEM, WithoutClaimsValidation, ErrTokenMalformed) are compatible with v5. Changes: golang-jwt/jwt@v4.5.2...v5.3.1 Tested with: - go test ./central/auth/m2m -run TestIssuerFromRawIDToken - go test ./central/auth/m2m -run Test_genericTokenVerifier_VerifyIDToken Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

golang-jwt/v5 validates token structure before extracting claims, rejecting the literal "signature" string as invalid base64. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

janisz · 2026-07-30T14:37:05Z

/retest

janisz · 2026-07-31T10:45:52Z

/retest

openshift-ci · 2026-07-31T12:48:45Z

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-4-21-qa-e2e-tests	`c09f1d0`	link	false	`/test ocp-4-21-qa-e2e-tests`
ci/prow/ocp-4-21-nongroovy-e2e-tests	`c09f1d0`	link	false	`/test ocp-4-21-nongroovy-e2e-tests`
ci/prow/ocp-4-21-operator-e2e-tests	`c09f1d0`	link	false	`/test ocp-4-21-operator-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rhacs-bot · 2026-07-31T13:05:32Z

/retest

janisz · 2026-08-03T10:45:48Z

/konflux-retest operator-bundle-on-push

openshift-ci Bot added the do-not-merge/work-in-progress label Jun 18, 2026

github-actions Bot added the area/central label Jun 18, 2026

Base automatically changed from RoaringBitmap to master June 19, 2026 14:01

openshift-ci Bot added the needs-rebase label Jun 28, 2026

janisz force-pushed the golang-jwt branch from e0a0029 to b54bd58 Compare July 3, 2026 08:40

openshift-ci Bot removed the needs-rebase label Jul 3, 2026

janisz marked this pull request as ready for review July 3, 2026 08:41

janisz requested review from a team as code owners July 3, 2026 08:41

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 3, 2026

janisz requested a review from rhybrillou July 3, 2026 08:41

janisz added the auto-retest PRs with this label will be automatically retested if prow checks fails label Jul 3, 2026

janisz force-pushed the golang-jwt branch from b54bd58 to 6c13245 Compare July 3, 2026 14:59

rhybrillou approved these changes Jul 3, 2026

View reviewed changes

janisz added ci-seed-cache Enable cache saving on PR runs (for seeding) ci-save-cache Enable Go cache saves on this PR branch for testing labels Jul 10, 2026

github-actions Bot added area/ci ai-review coderabbit-review labels Jul 10, 2026

janisz changed the base branch from reproduce/jwt-roxvet-stale-cache-index to master July 29, 2026 10:18

janisz force-pushed the golang-jwt branch from c19d9bc to 604db35 Compare July 29, 2026 10:18

janisz requested review from a team and rhacs-bot as code owners July 29, 2026 10:18

rhacs-bot requested a review from a team July 29, 2026 10:18

github-actions Bot added area/ui area/helm area/operator area/sensor area/scanner konflux-build Run Konflux in PR. Push commit to trigger it. labels Jul 29, 2026

openshift-ci Bot removed the needs-rebase label Jul 29, 2026

janisz force-pushed the golang-jwt branch from 604db35 to c09f1d0 Compare July 29, 2026 10:19

janisz and others added 2 commits July 30, 2026 14:52

fix(jwt): use valid base64 signature in test tokens

80cc15c

golang-jwt/v5 validates token structure before extracting claims, rejecting the literal "signature" string as invalid base64. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

janisz force-pushed the golang-jwt branch from c09f1d0 to 80cc15c Compare July 30, 2026 12:53

stackrox deleted a comment from rhacs-bot Jul 31, 2026

janisz merged commit ae72046 into master Aug 3, 2026
202 of 244 checks passed

janisz deleted the golang-jwt branch August 3, 2026 10:46

Navigation Menu

Repository navigation

chore(deps): upgrade golang-jwt from v4.5.2 to v5.3.1 - #21258

chore(deps): upgrade golang-jwt from v4.5.2 to v5.3.1#21258
janisz merged 2 commits into
masterfrom
golang-jwt

janisz commented Jun 18, 2026

Uh oh!

openshift-ci Bot commented Jun 18, 2026

Uh oh!

janisz commented Jun 18, 2026

Uh oh!

rhybrillou commented Jun 18, 2026

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

janisz commented Jul 30, 2026

Uh oh!

janisz commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

rhacs-bot commented Jul 31, 2026

Uh oh!

janisz commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

janisz commented Jun 18, 2026

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci Bot commented Jun 18, 2026

Uh oh!

janisz commented Jun 18, 2026

Uh oh!

rhybrillou commented Jun 18, 2026

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

janisz commented Jul 30, 2026

Uh oh!

janisz commented Jul 31, 2026

Uh oh!

openshift-ci Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhacs-bot commented Jul 31, 2026

Uh oh!

janisz commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

openshift-ci Bot commented Jul 31, 2026 •

edited

Loading