Bump gopkg.in/square/go-jose.v2 from 2.1.3 to 2.6.0

[dependabot-preview]

Bumps gopkg.in/square/go-jose.v2 from 2.1.3 to 2.6.0.

Release notes

Sourced from gopkg.in/square/go-jose.v2's releases.

Version 2.6.0

Last release from the v2 branch, includes various changes and bug fixes.

For future releases please see v3 at: http://github.com/go-jose/go-jose

Version 2.5.1

Bug Fixes

• Fix parsing and validation of x5t and x5t#S256 headers for JWK (h/t @​mangas) (#305).

Version 2.5.0

New Features

• Add support for x5u, x5t, and x5t#S256 headers for JWK (#242).
• Add support for RFC 7638 canonical kid for JWK (#269).

Bug Fixes

• Add error checking in jose-util to avoid nil referencing (#250).
• Documentation improvements (#274, #280, #289).

Version 2.4.1

Bug Fixes

• Fixes a bug introduced in v2.4.0 that could cause a panic on invalid inputs (#282).
• Improves performance of parsing payloads with a lot of whitespace (#279).

Version 2.4.0

New Features

• Add support for the b64 header parameter (#230).
• Add functions to handle detached signatures (#234).
• Expose an interface for opaque key encryption/decryption (#261, #257).

Bug Fixes

• Fixes a issue with ECDSA on P-521, whereby the generated shared secret derived for encryption was computed incorrectly (#267, #245).
• Fixes salt length for new RSA-PSS messages to be equal to the hash length, as required by RFC 3447 (#232).
• Don't include the kid header in a JWT if the key id is an empty string (#227).

Version 2.3.1

Fixes a bug in the serialization of ED25519 keys to JWK (JSON), where X/D values ended up being switched for one another in the serialized output (see #224). Reading a serialized private key would also end up switching the X/D values for another, so keys that were serialized/deserialized with old versions of go-jose would work fine (values should end up in the correct place again). However, sharing a private key with another library would have caused problems. If you have private keys that were previously serialized to JWK using this library, the X/D values will be incorrect and will need to be switched in the JSON serialization before the key can be deserialized with an updated version of go-jose.

Version 2.3.0

New Features

• Add support for unwrapping JSON Web Key Set in the jwt sub-package. This means the key passed to Claims or Decrypt can now be a set of keys (of type *jose.JSONWebKeySet), and the key will be selected automatically based on the key id in the header of the token.

Bug Fixes

• Improves handling of exp, iat and nbf claims. This means proper handling for zero dates (#214), don't error if optional exp and nbf claims are missing from the token (#220), and perform an extra check on iat if it is present (#217). Note that expiration in tokens is optional per standard, if you want to require expiration or other claims to be absolutely present in a token be sure to check the claim is present.

Note this release also drops support for Go 1.5 and Go 1.6, we now require Go 1.7 or later.

Version 2.2.2

Exports the random reader used for internal randomness to make deterministic tests possible (#212). This allows consumers of the library to add tests that can compare known inputs/outputs deterministically.

Version 2.2.1

... (truncated)

Commits

• a10ff54 Fix EC thumbprint template
• c9ac459 Merge pull request #338 from kelsin/v2
• 7d610ab Merge pull request #341 from leobrines/v2
• a5c7eec Merge pull request #352 from narg95/unmarshal_number_to_int64
• cdfc35f provide int64 for whole numbers in scientific notation
• 4312686 add support to unmarshal int64 into interface{}
• df70637 Merge pull request #348 from adeinega/patch-1
• 953691b Mnr typos in opaque.go
• 5503409 Merge pull request #347 from adeinega/typos
• 2726092 Update shared.go
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[mesosphere-ci]

Can one of the admins verify this patch?

[mesosphere-ci]

Can one of the admins verify this patch?