bump some jwt related go modules to current version

go-jwt/jwt to v5.2.1
MicahParks/keyfunc to v2.1.0

vendor/github.com/MicahParks/keyfunc/v2/get.go

@@ -49,11 +49,21 @@ func Get(jwksURL string, options Options) (jwks *JWKS, err error) {
 
 	err = jwks.refresh()
 	if err != nil {
-		return nil, err
+		if options.TolerateInitialJWKHTTPError {
+			if jwks.refreshErrorHandler != nil {
+				jwks.refreshErrorHandler(err)
+			}
+			jwks.keys = make(map[string]parsedJWK)
+		} else {
+			return nil, err
+		}
 	}
 
 	if jwks.refreshInterval != 0 || jwks.refreshUnknownKID {
-		jwks.ctx, jwks.cancel = context.WithCancel(context.Background())
+		if jwks.ctx == nil {
+			jwks.ctx = context.Background()
+		}
+		jwks.ctx, jwks.cancel = context.WithCancel(jwks.ctx)
 		jwks.refreshRequests = make(chan refreshRequest, 1)
 		go jwks.backgroundRefresh()
 	}

vendor/github.com/MicahParks/keyfunc/v2/given.go

@@ -42,28 +42,14 @@ func NewGiven(givenKeys map[string]GivenKey) (jwks *JWKS) {
 	}
 }
 
-// NewGivenCustom creates a new GivenKey given an untyped variable. The key argument is expected to be a supported
+// NewGivenCustom creates a new GivenKey given an untyped variable. The key argument is expected to be a type supported
 // by the jwt package used.
 //
-// See the https://pkg.go.dev/github.com/golang-jwt/jwt/v4#RegisterSigningMethod function for registering an unsupported
-// signing method.
-//
-// Deprecated: This function does not allow the user to specify the JWT's signing algorithm. Use
-// NewGivenCustomWithOptions instead.
-func NewGivenCustom(key interface{}) (givenKey GivenKey) {
-	return GivenKey{
-		inter: key,
-	}
-}
-
-// NewGivenCustomWithOptions creates a new GivenKey given an untyped variable. The key argument is expected to be a type
-// supported by the jwt package used.
-//
 // Consider the options carefully as each field may have a security implication.
 //
-// See the https://pkg.go.dev/github.com/golang-jwt/jwt/v4#RegisterSigningMethod function for registering an unsupported
+// See the https://pkg.go.dev/github.com/golang-jwt/jwt/v5#RegisterSigningMethod function for registering an unsupported
 // signing method.
-func NewGivenCustomWithOptions(key interface{}, options GivenKeyOptions) (givenKey GivenKey) {
+func NewGivenCustom(key interface{}, options GivenKeyOptions) (givenKey GivenKey) {
 	return GivenKey{
 		algorithm: options.Algorithm,
 		inter:     key,
@@ -72,18 +58,8 @@ func NewGivenCustomWithOptions(key interface{}, options GivenKeyOptions) (givenK
 
 // NewGivenECDSA creates a new GivenKey given an ECDSA public key.
 //
-// Deprecated: This function does not allow the user to specify the JWT's signing algorithm. Use
-// NewGivenECDSACustomWithOptions instead.
-func NewGivenECDSA(key *ecdsa.PublicKey) (givenKey GivenKey) {
-	return GivenKey{
-		inter: key,
-	}
-}
-
-// NewGivenECDSACustomWithOptions creates a new GivenKey given an ECDSA public key.
-//
 // Consider the options carefully as each field may have a security implication.
-func NewGivenECDSACustomWithOptions(key *ecdsa.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
+func NewGivenECDSA(key *ecdsa.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
 	return GivenKey{
 		algorithm: options.Algorithm,
 		inter:     key,
@@ -92,18 +68,8 @@ func NewGivenECDSACustomWithOptions(key *ecdsa.PublicKey, options GivenKeyOption
 
 // NewGivenEdDSA creates a new GivenKey given an EdDSA public key.
 //
-// Deprecated: This function does not allow the user to specify the JWT's signing algorithm. Use
-// NewGivenEdDSACustomWithOptions instead.
-func NewGivenEdDSA(key ed25519.PublicKey) (givenKey GivenKey) {
-	return GivenKey{
-		inter: key,
-	}
-}
-
-// NewGivenEdDSACustomWithOptions creates a new GivenKey given an EdDSA public key.
-//
 // Consider the options carefully as each field may have a security implication.
-func NewGivenEdDSACustomWithOptions(key ed25519.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
+func NewGivenEdDSA(key ed25519.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
 	return GivenKey{
 		algorithm: options.Algorithm,
 		inter:     key,
@@ -112,18 +78,8 @@ func NewGivenEdDSACustomWithOptions(key ed25519.PublicKey, options GivenKeyOptio
 
 // NewGivenHMAC creates a new GivenKey given an HMAC key in a byte slice.
 //
-// Deprecated: This function does not allow the user to specify the JWT's signing algorithm. Use
-// NewGivenHMACCustomWithOptions instead.
-func NewGivenHMAC(key []byte) (givenKey GivenKey) {
-	return GivenKey{
-		inter: key,
-	}
-}
-
-// NewGivenHMACCustomWithOptions creates a new GivenKey given an HMAC key in a byte slice.
-//
 // Consider the options carefully as each field may have a security implication.
-func NewGivenHMACCustomWithOptions(key []byte, options GivenKeyOptions) (givenKey GivenKey) {
+func NewGivenHMAC(key []byte, options GivenKeyOptions) (givenKey GivenKey) {
 	return GivenKey{
 		algorithm: options.Algorithm,
 		inter:     key,
@@ -132,18 +88,8 @@ func NewGivenHMACCustomWithOptions(key []byte, options GivenKeyOptions) (givenKe
 
 // NewGivenRSA creates a new GivenKey given an RSA public key.
 //
-// Deprecated: This function does not allow the user to specify the JWT's signing algorithm. Use
-// NewGivenRSACustomWithOptions instead.
-func NewGivenRSA(key *rsa.PublicKey) (givenKey GivenKey) {
-	return GivenKey{
-		inter: key,
-	}
-}
-
-// NewGivenRSACustomWithOptions creates a new GivenKey given an RSA public key.
-//
 // Consider the options carefully as each field may have a security implication.
-func NewGivenRSACustomWithOptions(key *rsa.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
+func NewGivenRSA(key *rsa.PublicKey, options GivenKeyOptions) (givenKey GivenKey) {
 	return GivenKey{
 		algorithm: options.Algorithm,
 		inter:     key,

vendor/github.com/MicahParks/keyfunc/v2/keyfunc.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 )
 
 var (
@@ -14,7 +14,7 @@ var (
 	ErrKID = errors.New("the JWT has an invalid kid")
 )
 
-// Keyfunc matches the signature of github.com/golang-jwt/jwt/v4's jwt.Keyfunc function.
+// Keyfunc matches the signature of github.com/golang-jwt/jwt/v5's jwt.Keyfunc function.
 func (j *JWKS) Keyfunc(token *jwt.Token) (interface{}, error) {
 	kid, alg, err := kidAlg(token)
 	if err != nil {
@@ -23,6 +23,7 @@ func (j *JWKS) Keyfunc(token *jwt.Token) (interface{}, error) {
 	return j.getKey(alg, kid)
 }
 
+// Keyfunc matches the signature of github.com/golang-jwt/jwt/v5's jwt.Keyfunc function.
 func (m *MultipleJWKS) Keyfunc(token *jwt.Token) (interface{}, error) {
 	return m.keySelector(m, token)
 }

vendor/github.com/MicahParks/keyfunc/v2/multiple.go

@@ -4,11 +4,11 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 )
 
 // ErrMultipleJWKSSize is returned when the number of JWKS given are not enough to make a MultipleJWKS.
-var ErrMultipleJWKSSize = errors.New("multiple JWKS must have two or more remote JWK Set resources")
+var ErrMultipleJWKSSize = errors.New("multiple JWKS must have one or more remote JWK Set resources")
 
 // MultipleJWKS manages multiple JWKS and has a field for jwt.Keyfunc.
 type MultipleJWKS struct {
@@ -16,14 +16,14 @@ type MultipleJWKS struct {
 	sets        map[string]*JWKS // No lock is required because this map is read-only after initialization.
 }
 
-// GetMultiple creates a new MultipleJWKS. A map of length two or more JWKS URLs to Options is required.
+// GetMultiple creates a new MultipleJWKS. A map of length one or more JWKS URLs to Options is required.
 //
 // Be careful when choosing Options for each JWKS in the map. If RefreshUnknownKID is set to true for all JWKS in the
 // map then many refresh requests would take place each time a JWT is processed, this should be rate limited by
 // RefreshRateLimit.
 func GetMultiple(multiple map[string]Options, options MultipleOptions) (multiJWKS *MultipleJWKS, err error) {
-	if multiple == nil || len(multiple) < 2 {
-		return nil, fmt.Errorf("multiple JWKS must have two or more remote JWK Set resources: %w", ErrMultipleJWKSSize)
+	if len(multiple) < 1 {
+		return nil, fmt.Errorf("multiple JWKS must have one or more remote JWK Set resources: %w", ErrMultipleJWKSSize)
 	}
 
 	if options.KeySelector == nil {
@@ -46,6 +46,8 @@ func GetMultiple(multiple map[string]Options, options MultipleOptions) (multiJWK
 	return multiJWKS, nil
 }
 
+// JWKSets returns a copy of the map of JWK Sets. The map itself is a copy, but the JWKS are not and should be treated
+// as read-only.
 func (m *MultipleJWKS) JWKSets() map[string]*JWKS {
 	sets := make(map[string]*JWKS, len(m.sets))
 	for u, jwks := range m.sets {
@@ -54,6 +56,7 @@ func (m *MultipleJWKS) JWKSets() map[string]*JWKS {
 	return sets
 }
 
+// KeySelectorFirst returns the first key found in the multiple JWK Sets.
 func KeySelectorFirst(multiJWKS *MultipleJWKS, token *jwt.Token) (key interface{}, err error) {
 	kid, alg, err := kidAlg(token)
 	if err != nil {

vendor/github.com/MicahParks/keyfunc/v2/options.go

@@ -9,7 +9,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 )
 
 // ErrInvalidHTTPStatusCode indicates that the HTTP status code is invalid.
@@ -17,7 +17,7 @@ var ErrInvalidHTTPStatusCode = errors.New("invalid HTTP status code")
 
 // Options represents the configuration options for a JWKS.
 //
-// If RefreshInterval and or RefreshUnknownKID is not nil, then a background goroutine will be launched to refresh the
+// If either RefreshInterval is non-zero or RefreshUnknownKID is true, then a background goroutine will be launched to refresh the
 // remote JWKS under the specified circumstances.
 //
 // When using a background refresh goroutine, make sure to use RefreshRateLimit if paired with RefreshUnknownKID. Also
@@ -54,7 +54,7 @@ type Options struct {
 	// if a background refresh goroutine is active.
 	RefreshErrorHandler ErrorHandler
 
-	// RefreshInterval is the duration to refresh the JWKS in the background via a new HTTP request. If this is not nil,
+	// RefreshInterval is the duration to refresh the JWKS in the background via a new HTTP request. If this is not zero,
 	// then a background goroutine will be used to refresh the JWKS once per the given interval. Make sure to call the
 	// JWKS.EndBackground method to end this goroutine when it's no longer needed.
 	RefreshInterval time.Duration
@@ -84,6 +84,14 @@ type Options struct {
 	// ResponseExtractor consumes a *http.Response and produces the raw JSON for the JWKS. By default, the
 	// ResponseExtractorStatusOK function is used. The default behavior changed in v1.4.0.
 	ResponseExtractor func(ctx context.Context, resp *http.Response) (json.RawMessage, error)
+
+	// TolerateInitialJWKHTTPError will tolerate any error from the initial HTTP JWKS request. If an error occurs,
+	// the RefreshErrorHandler will be given the error. The program will continue to run as if the error did not occur
+	// and a valid JWK Set with no keys was received in the response. This allows for the background goroutine to
+	// request the JWKS at a later time.
+	//
+	// It does not make sense to mark this field as true unless the background refresh goroutine is active.
+	TolerateInitialJWKHTTPError bool
 }
 
 // MultipleOptions is used to configure the behavior when multiple JWKS are used by MultipleJWKS.