Migrate to jwx v3

.github/workflows/build.yaml

@@ -18,16 +18,16 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Setup Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version-file: 'go.mod'
         cache: false
 
     - name: Lint
-      uses: golangci/golangci-lint-action@v7
+      uses: golangci/golangci-lint-action@v8
       with:
         args: --build-tags integration --timeout=5m
 

dex.go

@@ -9,7 +9,7 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
-	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v3/jwk"
 )
 
 const (
@@ -187,7 +187,7 @@ func (dx *Dex) searchKey(kid string) (any, error) {
 			continue
 		}
 		var key any
-		err = jwtkey.Raw(&key)
+		err = jwk.Export(jwtkey, &key)
 		return key, err
 	}
 	return nil, fmt.Errorf("key %q not found", kid)

dex_test.go

@@ -1,14 +1,12 @@
 package security
 
 import (
-	"context"
 	"crypto/rsa"
 	"encoding/base64"
 	"math/big"
 	"strings"
 	"testing"
 
-	"github.com/lestrrat-go/jwx/v2/jwk"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/stretchr/testify/require"
@@ -134,11 +132,16 @@ func TestDex_keyfetcher(t *testing.T) {
 			return
 		}
 
-		for it := keys.Keys(context.Background()); it.Next(context.Background()); {
-			pair := it.Pair()
-			key := pair.Value.(jwk.Key)
+		for i := range keys.Len() {
+			key, ok := keys.Key(i)
+			if !ok {
+				t.Errorf("failed to get key at index %d", i)
+			}
 
-			keyID := key.KeyID()
+			keyID, ok := key.KeyID()
+			if !ok {
+				t.Errorf("failed to get keyid at index %d", i)
+			}
 			require.NotEmpty(t, keyID)
 		}
 

go.mod

@@ -1,46 +1,48 @@
 module github.com/metal-stack/security
 
-go 1.24
-
-toolchain go1.24.2
+go 1.25
 
 require (
-	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/go-jose/go-jose/v4 v4.1.0
-	github.com/go-openapi/runtime v0.28.0
-	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/coreos/go-oidc/v3 v3.17.0
+	github.com/go-jose/go-jose/v4 v4.1.3
+	github.com/go-openapi/runtime v0.29.2
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
-	github.com/lestrrat-go/jwx/v2 v2.1.5
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.37.0
-	golang.org/x/net v0.39.0
-	golang.org/x/oauth2 v0.29.0
+	github.com/lestrrat-go/jwx/v3 v3.0.12
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/crypto v0.45.0
+	golang.org/x/oauth2 v0.33.0
 )
 
 require (
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
-	github.com/go-openapi/errors v0.22.1 // indirect
-	github.com/go-openapi/strfmt v0.23.0 // indirect
-	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-openapi/errors v0.22.4 // indirect
+	github.com/go-openapi/strfmt v0.25.0 // indirect
+	github.com/go-openapi/swag/conv v0.25.4 // indirect
+	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
+	github.com/go-openapi/swag/loading v0.25.4 // indirect
+	github.com/go-openapi/swag/mangling v0.25.4 // indirect
+	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
+	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
-	github.com/lestrrat-go/blackmagic v1.0.3 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.4 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
-	github.com/lestrrat-go/httprc v1.0.6 // indirect
-	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/httprc/v3 v3.0.1 // indirect
 	github.com/lestrrat-go/option v1.0.1 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/lestrrat-go/option/v2 v2.0.0 // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/segmentio/asm v1.2.0 // indirect
-	go.mongodb.org/mongo-driver v1.17.3 // indirect
-	golang.org/x/sync v0.13.0 // indirect
-	golang.org/x/sys v0.32.0 // indirect
+	github.com/segmentio/asm v1.2.1 // indirect
+	go.mongodb.org/mongo-driver v1.17.6 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )