chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1 by thaJeztah · Pull Request #13847 · docker/compose

thaJeztah · 2026-06-16T14:09:58Z

relates to chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 #13842 (comment)
stacked on pkg/e2e: fix malformed JWT in fixtures #13857

full diff: golang-jwt/jwt@v5.3.0...v5.3.1

What I did

Related issue

(not mandatory) A picture of a cute animal, if possible in relation to what you did

thaJeztah · 2026-06-18T20:59:04Z

OK same error here;

=== Failed
=== FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.08s)
    publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
        please double check that you are not leaking sensitive data
        AWS Client ID
        "services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF
        AWS Secret Key
        "services.serviceA.environment.AWS_SECRET_ACCESS_KEY": aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+"
        Keyword Detector
        "secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt
        Github authentication
        "GITHUB_TOKEN": ***
        Private Key
        "": -----BEGIN DSA PRIVATE KEY-----
        wxyz+ABC=
        -----END DSA PRIVATE KEY-----
        Are you ok to publish these sensitive data?
        
    --- FAIL: TestPublishChecks/detect_sensitive_data (0.08s)

thaJeztah · 2026-06-19T09:26:26Z

 		assert.Assert(t, strings.Contains(output, "AWS Secret Key\n\"services.serviceA.environment.AWS_SECRET_ACCESS_KEY\": aws\"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+\""), output)
 		assert.Assert(t, strings.Contains(output, "Github authentication\n\"GITHUB_TOKEN\": ghp_1234567890abcdefghijklmnopqrstuvwxyz"), output)
-		assert.Assert(t, strings.Contains(output, "JSON Web Token\n\"\": eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."+
+		assert.Assert(t, strings.Contains(output, "WOOP JSON Web Token\n\"\": eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."+


Temporary commit to make the test rump the old output;

=== Failed === FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.07s) publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "WOOP JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact. please double check that you are not leaking sensitive data AWS Client ID "services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF AWS Secret Key "services.serviceA.environment.AWS_SECRET_ACCESS_KEY": aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+" Keyword Detector "secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt Github authentication "GITHUB_TOKEN": *** JSON Web Token "": *** Private Key "": -----BEGIN DSA PRIVATE KEY----- wxyz+ABC= -----END DSA PRIVATE KEY----- Are you ok to publish these sensitive data? --- FAIL: TestPublishChecks/detect_sensitive_data (0.07s)

thaJeztah · 2026-06-19T09:29:34Z

Right, so for some reason the JSON Web Token doesn't appear;

diff --git a/before.txt b/after.txt
index cfbbfaf3f..facfa1d5b 100644
--- a/before.txt
+++ b/after.txt
@@ -1,6 +1,6 @@
 === Failed
 === FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.08s)
-    publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "WOOP JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
+    publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
         please double check that you are not leaking sensitive data
         AWS Client ID
         "services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF
@@ -10,8 +10,6 @@
         "secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt
         Github authentication
         "GITHUB_TOKEN": ***
-        JSON Web Token
-        "": ***
         Private Key
         "": -----BEGIN DSA PRIVATE KEY-----
         wxyz+ABC=

thaJeztah · 2026-06-19T09:52:42Z

OK; looks like this is indeed because of

Set token.Signature in ParseUnverified golang-jwt/jwt#414
5.3.1 now treats malformed signatures as an error in ParseUnverified, which does not align with the documented behavior golang-jwt/jwt#499

The fixture we use is not a valid JWT;

compose/pkg/e2e/fixtures/publish/config.txt

Line 1 in 6042df7

    
           eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw

First 2 elements decode, but the last one is malformed;

echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9' | base64 -d
{"alg":"HS256","typ":"JWT"}⏎                                                                                                                                                                                         

echo 'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ' | base64 -d
{"sub":"1234567890","name":"John Doe","iat":1516239022⏎                                                                                                                                                              

echo 'SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw' | base64 -d
I�J�IHǊ(]�O��ǉ�~�:N�%_�u
                        ,⏎

It looks like that may be taken from an example, like https://github.com/knottx/JWTCodable#example-jwt-token, but the last 2 bytes were truncated.

codecov · 2026-06-19T10:15:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

full diff: golang-jwt/jwt@v5.3.0...v5.3.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Copilot

Pull request overview

This PR bumps the indirect Go dependency github.com/golang-jwt/jwt/v5 from v5.3.0 to v5.3.1 to pick up the upstream patch-level changes (per the linked upstream compare and prior related discussion in docker/compose).

Changes:

Update github.com/golang-jwt/jwt/v5 to v5.3.1 in go.mod (indirect dependency).
Refresh go.sum entries to match the new module version and checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Bumps `github.com/golang-jwt/jwt/v5` indirect requirement to `v5.3.1`.
go.sum	Updates checksum entries for `github.com/golang-jwt/jwt/v5` to `v5.3.1`.

docker-agent

Assessment: 🟢 APPROVE

This PR bumps github.com/golang-jwt/jwt/v5 from v5.3.0 to v5.3.1. The changes are limited to go.mod and go.sum:

The version string in go.mod is updated correctly to v5.3.1.
Both checksum entries in go.sum are updated consistently with the new release hashes.
The shared go.mod hash between v5.3.0 and v5.3.1 is expected — the upstream module's go.mod did not change between patch releases.

No logic, security, or behavioral issues introduced. The dependency update looks correct and complete.

thaJeztah force-pushed the bump_jwt branch from b95ca96 to 9814053 Compare June 18, 2026 21:00

thaJeztah commented Jun 19, 2026

View reviewed changes

thaJeztah force-pushed the bump_jwt branch from 9814053 to 1eb59b2 Compare June 19, 2026 09:55

thaJeztah mentioned this pull request Jun 19, 2026

pkg/e2e: fix malformed JWT in fixtures #13857

Merged

thaJeztah mentioned this pull request Jun 19, 2026

chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 #13842

Open

4 tasks

chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1

bd3e718

full diff: golang-jwt/jwt@v5.3.0...v5.3.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah force-pushed the bump_jwt branch from 1eb59b2 to bd3e718 Compare June 19, 2026 14:15

thaJeztah marked this pull request as ready for review June 19, 2026 14:15

thaJeztah requested a review from a team as a code owner June 19, 2026 14:15

thaJeztah requested review from Copilot, glours and ndeloof June 19, 2026 14:15

Copilot started reviewing on behalf of thaJeztah June 19, 2026 14:15 View session

glours approved these changes Jun 19, 2026

View reviewed changes

glours enabled auto-merge (rebase) June 19, 2026 14:16

Copilot AI reviewed Jun 19, 2026

View reviewed changes

docker-agent Bot reviewed Jun 19, 2026

View reviewed changes

glours merged commit 5d0f6e2 into docker:main Jun 19, 2026
78 of 79 checks passed

thaJeztah deleted the bump_jwt branch June 19, 2026 15:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1#13847

chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1#13847
glours merged 1 commit into
docker:mainfrom
thaJeztah:bump_jwt

thaJeztah commented Jun 16, 2026 •

edited

Loading

Uh oh!

thaJeztah commented Jun 18, 2026

Uh oh!

thaJeztah Jun 19, 2026

Uh oh!

thaJeztah commented Jun 19, 2026

Uh oh!

thaJeztah commented Jun 19, 2026

Uh oh!

codecov Bot commented Jun 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

docker-agent Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

thaJeztah commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah commented Jun 18, 2026

Uh oh!

thaJeztah Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Jun 19, 2026

Uh oh!

thaJeztah commented Jun 19, 2026

Uh oh!

codecov Bot commented Jun 19, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

docker-agent Bot left a comment

Choose a reason for hiding this comment

Assessment: 🟢 APPROVE

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

thaJeztah commented Jun 16, 2026 •

edited

Loading