From b4d884001a1f5e4ab9bc2606af41b433857a4985 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Fri, 13 Mar 2026 13:37:56 +0100 Subject: [PATCH 1/2] chore(deps): upgrade golang-jwt from v4.5.2 to v5.3.1 Upgrade github.com/golang-jwt/jwt from v4.5.2 to v5.3.1. Updated import paths from /v4 to /v5 across 4 files. No API changes required - all used APIs (MapClaims, NewWithClaims, SigningMethodRS256, ParseWithClaims, RegisteredClaims, ParseRSAPrivateKeyFromPEM, WithoutClaimsValidation, ErrTokenMalformed) are compatible with v5. Changes: https://github.com/golang-jwt/jwt/compare/v4.5.2...v5.3.1 Tested with: - go test ./central/auth/m2m -run TestIssuerFromRawIDToken - go test ./central/auth/m2m -run Test_genericTokenVerifier_VerifyIDToken Co-Authored-By: Claude Sonnet 4.5 --- central/auth/m2m/generic_token_verifier_test.go | 2 +- central/auth/m2m/id_token.go | 2 +- go.mod | 4 ++-- pkg/certgen/central_jwt.go | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/central/auth/m2m/generic_token_verifier_test.go b/central/auth/m2m/generic_token_verifier_test.go index 84c0bed31934a..dd820bdda4cfa 100644 --- a/central/auth/m2m/generic_token_verifier_test.go +++ b/central/auth/m2m/generic_token_verifier_test.go @@ -13,7 +13,7 @@ import ( "time" "github.com/coreos/go-oidc/v3/oidc" - "github.com/golang-jwt/jwt/v4" + "github.com/golang-jwt/jwt/v5" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) diff --git a/central/auth/m2m/id_token.go b/central/auth/m2m/id_token.go index b5851c50b8935..c957e25abad51 100644 --- a/central/auth/m2m/id_token.go +++ b/central/auth/m2m/id_token.go @@ -1,7 +1,7 @@ package m2m import ( - "github.com/golang-jwt/jwt/v4" + "github.com/golang-jwt/jwt/v5" "github.com/pkg/errors" "github.com/stackrox/rox/pkg/errox" ) diff --git a/go.mod b/go.mod index f1942744f8933..15d9c3feed827 100644 --- a/go.mod +++ b/go.mod @@ -55,7 +55,7 @@ require ( github.com/go-logr/zapr v1.3.0 github.com/gobwas/glob v0.2.3 github.com/godbus/dbus/v5 v5.2.2 - github.com/golang-jwt/jwt/v4 v4.5.2 + github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/certificate-transparency-go v1.3.3 github.com/google/gnostic-models v0.7.1 github.com/google/go-cmp v0.7.0 @@ -304,7 +304,7 @@ require ( github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/gobuffalo/flect v1.0.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang-jwt/jwt/v5 v5.3.1 // indirect + github.com/golang-jwt/jwt/v4 v4.5.2 // indirect github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/golang/snappy v1.0.0 // indirect diff --git a/pkg/certgen/central_jwt.go b/pkg/certgen/central_jwt.go index f5ac3833de55b..f446ae50ff064 100644 --- a/pkg/certgen/central_jwt.go +++ b/pkg/certgen/central_jwt.go @@ -6,7 +6,7 @@ import ( "crypto/x509" "encoding/pem" - "github.com/golang-jwt/jwt/v4" + "github.com/golang-jwt/jwt/v5" "github.com/pkg/errors" ) From 80cc15cc4b95cd46c454e4f580b8822a27fff3a1 Mon Sep 17 00:00:00 2001 From: Tomasz Janiszewski Date: Fri, 10 Jul 2026 16:01:48 +0200 Subject: [PATCH 2/2] fix(jwt): use valid base64 signature in test tokens golang-jwt/v5 validates token structure before extracting claims, rejecting the literal "signature" string as invalid base64. Co-Authored-By: Claude Opus 4.6 --- central/jwt/jwt_test.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/central/jwt/jwt_test.go b/central/jwt/jwt_test.go index 8e21ba55aada6..7f6de28d326ac 100644 --- a/central/jwt/jwt_test.go +++ b/central/jwt/jwt_test.go @@ -31,9 +31,10 @@ func (v mockRoxValidator) Validate(ctx context.Context, token string) (*tokens.T func tokenWithIssuer(issuer string) string { claims := fmt.Sprintf(`{"iss":"%s"}`, issuer) - return fmt.Sprintf("%s.%s.signature", + return fmt.Sprintf("%s.%s.%s", base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"HS256","typ":"JWT"}`)), - base64.RawURLEncoding.EncodeToString([]byte(claims))) + base64.RawURLEncoding.EncodeToString([]byte(claims)), + base64.RawURLEncoding.EncodeToString([]byte("fake-signature"))) } func TestM2MValidator(t *testing.T) {