Allow jwt 3.x - #6
Conversation
Relax the jwt runtime dependency from ~> 2 to >= 2, < 4 so consumers can upgrade to jwt 3.x. The lockfile now resolves jwt 3.2.0 so CI exercises the new major. The only spec change needed: jwt 3 decodes base64 strictly (RFC 4648), so the invalid-signature spec now tampers the signature with a valid base64 segment instead of appending raw characters. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Co-Authored-By: Amplify 3.0.1 <amplify@getjobber.com>
|
Note on the failing Check for Vulnerabilities (Snyk) job: this is pre-existing and unrelated to this PR. Every Snyk run in this repo fails with the same All unit test jobs (Ruby 3.0/3.1/3.2) pass on this PR. |
There was a problem hiding this comment.
Pull request overview
Relaxes this gem’s jwt dependency constraint to support jwt 3.x, allowing downstream consumers to upgrade (and pick up the referenced security fix) while keeping the library behavior and test suite compatible.
Changes:
- Relax
jwtruntime dependency from~> 2to>= 2, < 4in the gemspec (and align the Gemfile). - Update
Gemfile.lockto resolve and exercisejwt3.2.0 in CI. - Adjust the invalid-signature spec to remain valid under JWT 3.x’s stricter base64 decoding behavior.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| spec/omniauth/auth0/jwt_validator_spec.rb | Updates a signature-failure test to avoid base64 decoding errors under jwt 3.x. |
| omniauth-auth0.gemspec | Relaxes the runtime jwt dependency constraint to allow 3.x. |
| Gemfile | Aligns the dev/test dependency constraint for jwt with the gemspec. |
| Gemfile.lock | Locks resolution to jwt 3.2.0 so CI runs against the new major. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -21,7 +21,7 @@ omniauth-auth0 is the OmniAuth strategy for Auth0. | |||
| s.executables = `git ls-files -- bin/*`.split('\n').map{ |f| File.basename(f) } | |||
There was a problem hiding this comment.
Correct observation, but this line is pre-existing upstream code (verbatim from auth0/omniauth-auth0, untouched by this PR) and has no effect: the gem ships no bin/ files, so git ls-files -- bin/* is empty and the split returns [] regardless of the delimiter. Leaving it as-is to keep the fork's diff from upstream minimal — worth fixing upstream if anyone ever adds an executable.
What
Relaxes the
jwtruntime dependency from~> 2to>= 2, < 4so consumers (Jobber) can upgrade to jwt 3.2.0. The Gemfile/lockfile now resolve jwt 3.2.0 so CI exercises the new major.Why
Jobber is upgrading
jwt2.10.2 → 3.2.0 (includes the fix for CVE-2026-45363). This gem's~> 2constraint is the last blocker for bundler resolution; upstream auth0/omniauth-auth0 still caps at~> 2as well, so this needs to land on the fork.Compatibility
JWTValidatoruses the classicJWT.decode(jwt, key, true, opts)API, which is unchanged in jwt 3. Full spec suite passes against jwt 3.2.0 (128 examples, 0 failures).One spec updated: jwt 3 decodes token segments with strict base64 (RFC 4648), so the invalid-signature spec now swaps in a valid-base64 signature from another token instead of appending raw characters (which now raises
JWT::Base64DecodeError— still aJWT::DecodeErrorsubclass — before signature verification runs).Related issue in original gem
auth0#223
🤖 Generated with Claude Code
Co-Authored-By: Amplify 3.0.1 amplify@getjobber.com