square/go-jose is deprecated, use successor

.github/workflows/master.yaml

@@ -15,10 +15,10 @@ jobs:
       uses: golangci/golangci-lint-action@v3
       with:
         args: -p bugs -p unused
-    - name: Set up Go 1.20
+    - name: Set up Go 1.21
       uses: actions/setup-go@v4
       with:
-        go-version: '1.20.x'
+        go-version: '1.21.x'
     - name: Test
       run: |
         make test

.github/workflows/pr.yaml

@@ -15,10 +15,10 @@ jobs:
       uses: golangci/golangci-lint-action@v3
       with:
         args: -p bugs -p unused
-    - name: Set up Go 1.20
+    - name: Set up Go 1.21
       uses: actions/setup-go@v4
       with:
-        go-version: '1.20.x'
+        go-version: '1.21.x'
     - name: Test
       run: |
         make test

genericOidc.go

@@ -8,7 +8,7 @@ import (
 	"golang.org/x/oauth2"
 
 	"github.com/coreos/go-oidc/v3/oidc"
-	"gopkg.in/square/go-jose.v2/jwt"
+	"github.com/go-jose/go-jose/v3/jwt"
 )
 
 // GenericOIDCClaims

genericOidc_test.go

@@ -12,7 +12,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"gopkg.in/square/go-jose.v2"
+	"github.com/go-jose/go-jose/v3"
 )
 
 type wantUserFn func(issuer string) *User

go.mod

@@ -1,35 +1,35 @@
 module github.com/metal-stack/security
 
-go 1.20
+go 1.21
 
 require (
-	github.com/coreos/go-oidc/v3 v3.5.0
+	github.com/coreos/go-oidc/v3 v3.6.0
+	github.com/go-jose/go-jose/v3 v3.0.0
 	github.com/go-openapi/runtime v0.26.0
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/google/go-cmp v0.5.9
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
 	github.com/gorilla/mux v1.8.0
-	github.com/lestrrat-go/jwx v1.2.25
-	github.com/stretchr/testify v1.8.2
-	go.uber.org/zap v1.24.0
-	golang.org/x/crypto v0.8.0
-	golang.org/x/net v0.9.0
-	golang.org/x/oauth2 v0.7.0
-	gopkg.in/square/go-jose.v2 v2.6.0
+	github.com/lestrrat-go/jwx v1.2.26
+	github.com/stretchr/testify v1.8.4
+	go.uber.org/zap v1.25.0
+	golang.org/x/crypto v0.12.0
+	golang.org/x/net v0.14.0
+	golang.org/x/oauth2 v0.11.0
 )
 
 require (
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/benbjohnson/clock v1.3.3 // indirect
+	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.0 // indirect
-	github.com/go-openapi/errors v0.20.3 // indirect
+	github.com/go-openapi/errors v0.20.4 // indirect
 	github.com/go-openapi/strfmt v0.21.7 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
 	github.com/lestrrat-go/backoff/v2 v2.0.8 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
@@ -40,10 +40,9 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	go.mongodb.org/mongo-driver v1.11.4 // indirect
-	go.uber.org/atomic v1.10.0 // indirect
+	go.mongodb.org/mongo-driver v1.12.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

mac_test.go

@@ -206,7 +206,7 @@ func TestMacCalc(t *testing.T) {
 	u := User{Name: "Bicycle Repair Man"}
 	hm := NewHMACAuth("mytype", []byte{1, 2, 3}, WithUser(u))
 	mac, ts := hm.create(time.Date(2019, time.January, 16, 14, 44, 45, 123, time.UTC), []byte{6, 7, 8, 9})
-	expectmac := "bfb747058c7036befe1e32ce1d180099aa85951656e2164245b53e766074e262"
+	expectmac := "bfb747058c7036befe1e32ce1d180099aa85951656e2164245b53e766074e262" // nolint:gosec
 	expectts := "2019-01-16T14:44:45Z"
 	if mac != expectmac {
 		t.Fatalf("expected mac %q, but got %q", expectmac, mac)

token.go

@@ -18,8 +18,8 @@ import (
 
 	"github.com/gorilla/mux"
 
-	"gopkg.in/square/go-jose.v2"
-	"gopkg.in/square/go-jose.v2/jwt"
+	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v3/jwt"
 )
 
 // TokenCfg contains the data for filling the token

token_test.go

@@ -9,8 +9,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
-	"gopkg.in/square/go-jose.v2"
-	"gopkg.in/square/go-jose.v2/jwt"
+	"github.com/go-jose/go-jose/v3"
+	"github.com/go-jose/go-jose/v3/jwt"
 )
 
 func TestCreateTokenAndKeys(t *testing.T) {

tokenheader.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"strings"
 
-	"gopkg.in/square/go-jose.v2/jwt"
+	"github.com/go-jose/go-jose/v3/jwt"
 )
 
 // ParseTokenClaimsUnvalidated returns the UNVALIDATED claims from the bearer token in the authentication header.

tokenheader_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 
-	"gopkg.in/square/go-jose.v2/jwt"
+	"github.com/go-jose/go-jose/v3/jwt"
 )
 
 func createHeader(key, value string) http.Header {