Allow for user provided ctx during parse

The purpose of this release is to add a new method, .KeyfuncCtx.

This new method accepts a context.Context, then returns a jwt.Keyfunc. This user provided context.Context is used during JWK lookup in the github.com/MicahParks/jwkset package when parsing JWTs. Passing a request scoped context allows the JWT parsing and JWK retrieval to cancel according to the given context.Context behavior instead of the default context.Context, which was provided at keyfunc.Keyfunc initialization.

In practice, this is used to prevent situations where many JWTs with kid not in a remote JWK Set are attempting to be parsed over a long period of time.

Relevant issues:

• MicahParks/jwkset#26

Relevant pull requests:

• #118
• #119
• #120
• #121

Wrap errors where appropriate

The purpose of this pull request is to wrap errors with errors.Join where appropriate.

Relevant issues:

• #103

Relevant pull requests:

• #104

Automatic unknown key ID refresh

The purpose of this release is to update the jwkset dependency so that the refresh on unknown key ID feature is available by default.

See:
https://github.com/MicahParks/jwkset/releases/tag/v0.5.6

Related pull requests:

• #102

Related issues:

• #101

X.509 Thumbprint bug fix

JWK Sets have two X.509 thumbprint parameters that are optional. A bug in github.com/MicahParks/jwkset made these parameters required in circumstances that affect the keyfunc project. This release updates this dependency to the latest version.

Thank you, @joshkaplinsky, for reporting this bug!

Please see the below release for details:
https://github.com/MicahParks/jwkset/releases/tag/v0.5.5

V3 simplify API by using github.com/MicahParks/jwkset

This upgrade removes most of the code in this repository and outsources JWK and JWK Set related code to the updated github.com/MicahParks/jwkset package. The exported assets from the keyfunc project has been vastly reduced as well, with the intention of making it easier to use for the majority of use cases.

Note

A superset of features from V1 and V2 is available.

Tolerate initial JWK Set HTTP Error

The purpose of this release is to add a new feature that allows keyfunc.Get to continue without error even if the initial HTTP request to the JWK Set fails. This supports the use case of multiple JWK Sets when a subset are undergoing maintenance, among others.

This is done through the new TolerateInitialJWKHTTPError field on the keyfunc.Options data structure. If the initial HTTP request fails, the resulting *keyfunc.JWKS will contain no keys, but have the opportunity to be populated by a future background goroutine refresh.

Relevant issues:

• #64
• #90

Relevant pull requests:

• #91

v2.0.3

The purpose of this release is to correct a comment and error text.

Relevant pull requests:

• #89

v2.0.2

The purpose of this release is to change the limitation for creating a MultipleJWKS from requiring 2 or more JWK Set URLs to 1 JWK Set URLs. It appears there was no technical reason for this limitation and it is more convenient to use the Multi JWK Set implementation in some use cases.

Related issues:

• #87

Related pull requests:

• #88

Fix bug with context option

The purpose of this pull request is to fix a bug that prevents the context.Context passed in keyfunc.Options from behaving as described. The described behavior was that the background goroutine would be closed when the context was cancelled, however, the context was immediately overwritten with context.Background() causing its value to be ignored.

Thank you to our new contributor @tho!

Related issues:

• #85

Related pull requests:

• #86

v2.0.0

The purpose of this release is to move support from [github.com/golang-jwt/jwt/v4](http://github.com/golang-jwt/jwt/v4) to [github.com/golang-jwt/jwt/v5](http://github.com/golang-jwt/jwt/v5).

The biggest breaking change is the upstream JWT package version. The other breaking change is that the following deprecated functions have been overwritten by those with the same name plus the WithOptions suffix.

• NewGivenCustom
• NewGivenECDSA
• NewGivenEdDSA
• NewGivenHMAC
• NewGivenRSA

If you need to use [github.com/golang-jwt/jwt/v4](http://github.com/golang-jwt/jwt/v4), the last version of this project to support it is v1.9.0. Should there be a necessary change to this project for /v4 users, it will be located in the separate [github.com/MicahParks/compatibility-keyfunc](http://github.com/MicahParks/compatibility-keyfunc) project.

Relevant pull requests:

• #46
• #84

Relevant issues:

• #82