(2.11) Bump github.com/nats-io/jwt/v2 from 2.6.0 to 2.7.0 #5915
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [github.com/nats-io/jwt/v2](https://github.com/nats-io/jwt) from 2.6.0 to 2.7.0. - [Release notes](https://github.com/nats-io/jwt/releases) - [Changelog](https://github.com/nats-io/jwt/blob/main/ReleaseNotes.md) - [Commits](nats-io/jwt@v2.6.0...v2.7.0) --- updated-dependencies: - dependency-name: github.com/nats-io/jwt/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
Signed-off-by: Neil Twigg <[email protected]>
neilalexander
force-pushed
the
dependabot/go_modules/github.com/nats-io/jwt/v2-2.7.0
branch
from
5fe6b58 to
da3bd05
Compare
|
imo the jwt lib should not introduce such a change at this point in a minor release. |
|
Indeed, there are some test failures due to tag case-sensitivity, I guess from nats-io/jwt#225. We can fix the tests, but that means this shouldn't be cherry-picked into 2.10.x releases. |
neilalexander
changed the title
|
@aricart explained that only the server uses this feature so the breaking change in the lib is ok - we can fix it in the server and end up in a better place. So I'll take back what I said above expecting the jet lib to not break the API. |
|
@neilalexander the test is directly assigning the values to to the tags (not sure where the server is copying this to JWT), so now that they are case-sensitive - the JWT library previously downcased all the inputs, it doesn't do that anymore (or the tags cannot be used in subjects - the reason for the change) |
|
What are next steps? We going to fix the tests? |
Bumps github.com/nats-io/jwt/v2 from 2.6.0 to 2.7.0.
Release notes
Sourced from github.com/nats-io/jwt/v2's releases.
Commits
18a60d6[CHANGE] removing a tag that doesn't exist results in an error (#228)de1f16b[CHANGE] Tags are now case-sensitive (#225)2d9ece2Added validation to cluster traffic - as downstream tools like nsc will need ...You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)