Bump github.com/go-oidfed/lib from 0.10.12 to 0.11.0

[dependabot]

Bumps github.com/go-oidfed/lib from 0.10.12 to 0.11.0.

Release notes

Sourced from github.com/go-oidfed/lib's releases.

go-oidfed/lib 0.11.0

Breaking Changes

• Go 1.26 is now required (go.mod bumped from go 1.25.8 to go 1.26.0); the build now uses the jsonv2 experiment.
• jwx upgraded from v3 → v4 (github.com/lestrrat-go/jwx/v4). All internal call sites and public re-exports moved to v4; the v3 module is no longer imported.
• Logging switched from logrus → zerolog (github.com/rs/zerolog). logrus is now only an indirect dependency. The internal package helpers (WithError, etc.) were replaced with zerolog-style calls (internal.Logger().Error().Err(err).Msg(...)). New helpers: internal.SetLevel, internal.SetOutput, internal.Logger().
• KMS signer type changed from crypto.Signer to jwx.SigningKey throughout the public API (RequestObjectProducer.signPayload, KMS interfaces, etc.). jwx.SigningKey is a small interface (Public() crypto.PublicKey) satisfied by stdlib private keys and by an internal wrapper for composite-signature keys.
• SimpleEntityCollector.collect now takes ...*TrustAnchor instead of ...TrustAnchor (discovery.go).
• crypto11 dependency relocated: github.com/ThalesGroup/crypto11 → github.com/eclipse-keypont/crypto11 v1.6.5 (used by the PKCS#11 KMS).

Features

Cryptography / Signing Algorithms

• New signing algorithms supported in jwx:
  • EdDSAEd25519 (explicit) and EdDSAEd448 (via github.com/jwx-go/ed448/v4), with PEM encoding/decoding (jwx/ed448_pem.go).
  • ES256K (secp256k1) via github.com/jwx-go/es256k/v4, with PEM support (jwx/secp256k1_pem.go).
  • Post-quantum ML-DSA algorithms MLDSA44, MLDSA65, MLDSA87 via github.com/jwx-go/mldsa/v4 (filippo.io/mldsa), with PEM support (jwx/mldsa_pem.go).
  • Composite (hybrid) ML-DSA signatures via github.com/jwx-go/compsig/v4: MLDSA44ES256, MLDSA65ES256, MLDSA87ES384, MLDSA44Ed25519, MLDSA65Ed25519, MLDSA87Ed448 (jwx/compsig_pem.go, jwx/signingkey.go).
• New jwx.SupportedAlgs() / SupportedAlgsStrings() and a curated DefaultAlgs() / DefaultAlgsStrings() list (jwx/algs.go).

JWKS Handling

• jwx.JWKS.WithoutExpired(now) returns a filtered JWKS containing only non-expired keys (jwx/jwks.go).
• jwx.MergeJWKS(primary, secondary) merges two JWKS, deduplicating by KID with primary winning (jwx/jwks.go).
• New SignedJWKS type and ParseSignedJWKS for the application/jwk-set+jwt (typ jwk-set+jwt) format from OpenID Federation §5.2.1, including structural validation (typ, kid, keys, iss, sub, unique kids) and Verify(keys) (signed_jwks.go).
• New JWKStorage interface and FileJWKStorage filesystem implementation for persisting per-entity JWKS, with RegisterEntityJWKSFile symlink support (jwk_storage.go).
• Helpers ExtractKIDs and HasJWKSChanged for diffing JWKS by KID (jwks_diff.go).

Trust Anchor / Subordinate JWKS Refreshing

• New TAJWKSRefresher (ta_jwks_refresher.go): polls trust anchors for JWKS changes and updates them automatically. Concurrency-safe; supports dynamic Add/Remove/Update of trust anchors, per-TA backoff, and seeding JWKS from storage. Configurable via TAJWKSRefresherConfig and TrustAnchor.KeyPollInterval / EnableJWKSUpdate.
• TrustAnchor is now thread-safe (atomic.Pointer[jwx.JWKS] via JWKS() / SetJWKS()), with custom YAML (un)marshaling that accepts both legacy inline jwks and jwks_file (trustanchor.go).
• New SubordinateJWKSRefresher (subordinate_jwks_refresher.go): periodically polls the Entity Configuration of enabled subordinates and updates their stored JWKS when the EC's jwks changes. Configurable poll interval, exponential backoff with SubMinPollInterval floor, and a SubordinateJWKSRefreshStorage interface.

Key Rotation Hooks (KMS)

• New kms.KeyRotationHook and kms.KeyRotationEvent types, fired concurrently (each in its own goroutine, panic-recovered, errors logged) after a key is generated/rotated (jwx/keymanagement/kms/hooks.go).
• KeyRotationConfig.Hooks field registers hooks on the KMS; KMSConfig.EntityID is propagated into events.
• Multiple hook implementations:
  • CmdHook (key_rotation_hook_cmd.go): spawns an external command and pipes the new JWKS JSON to its stdin.
  • HTTPHook (key_rotation_hook_http.go): POSTs to a URL with configurable body mode (none, entity_id, jwks, signed_jwks) and optional private_key_jwt client auth via HTTPHookClientAuth + RequestObjectProducer. URL can be static or resolved dynamically per invocation via URLFunc.
  • TriggerUpdateHook and JWKSUpdateHook (key_rotation_hook_endpoints.go): convenience wrappers that resolve the target's federation_jwks_update_trigger_endpoint / federation_jwks_update_endpoint (and auth requirement / signing algs) from its Entity Configuration on each rotation.
• New oidfedconst constants for the federation entity metadata Extra keys: FederationJWKSUpdateEndpoint, FederationJWKSUpdateTriggerEndpoint, FederationJWKSUpdateTriggerEndpointAuthMethods, plus AuthMethodPrivateKeyJWT and OAuthClientAssertionJWTBearer.

KMS / Key Management

• Key announcement lead time is now configurable via KeyRotationConfig.KeyAnnouncementLeadTime and KeyAnnouncementLeadTimeECMultiplier; resolved by KeyAnnouncementLeadTimeDuration() with sensible defaults (max(5×EC lifetime, 24h)) and clamping to EC lifetime (kms.go).
• Scheduled algorithm changes: new ChangeAlgsAt / ChangeDefaultAlgorithmAt KMS methods, PendingAlgChange / PendingDefaultChange / ScheduledState types, and KMSStateStorer interface for persisting scheduled changes across restarts.

... (truncated)

Changelog

Sourced from github.com/go-oidfed/lib's changelog.

go-oidfed/lib 0.11.0

Breaking Changes

• Go 1.26 is now required (go.mod bumped from go 1.25.8 to go 1.26.0); the build now uses the jsonv2 experiment.
• jwx upgraded from v3 → v4 (github.com/lestrrat-go/jwx/v4). All internal call sites and public re-exports moved to v4; the v3 module is no longer imported.
• Logging switched from logrus → zerolog (github.com/rs/zerolog). logrus is now only an indirect dependency. The internal package helpers (WithError, etc.) were replaced with zerolog-style calls (internal.Logger().Error().Err(err).Msg(...)). New helpers: internal.SetLevel, internal.SetOutput, internal.Logger().
• KMS signer type changed from crypto.Signer to jwx.SigningKey throughout the public API (RequestObjectProducer.signPayload, KMS interfaces, etc.). jwx.SigningKey is a small interface (Public() crypto.PublicKey) satisfied by stdlib private keys and by an internal wrapper for composite-signature keys.
• SimpleEntityCollector.collect now takes ...*TrustAnchor instead of ...TrustAnchor (discovery.go).
• crypto11 dependency relocated: github.com/ThalesGroup/crypto11 → github.com/eclipse-keypont/crypto11 v1.6.5 (used by the PKCS#11 KMS).

Features

Cryptography / Signing Algorithms

• New signing algorithms supported in jwx:
  • EdDSAEd25519 (explicit) and EdDSAEd448 (via github.com/jwx-go/ed448/v4), with PEM encoding/decoding (jwx/ed448_pem.go).
  • ES256K (secp256k1) via github.com/jwx-go/es256k/v4, with PEM support (jwx/secp256k1_pem.go).
  • Post-quantum ML-DSA algorithms MLDSA44, MLDSA65, MLDSA87 via github.com/jwx-go/mldsa/v4 (filippo.io/mldsa), with PEM support (jwx/mldsa_pem.go).
  • Composite (hybrid) ML-DSA signatures via github.com/jwx-go/compsig/v4: MLDSA44ES256, MLDSA65ES256, MLDSA87ES384, MLDSA44Ed25519, MLDSA65Ed25519, MLDSA87Ed448 (jwx/compsig_pem.go, jwx/signingkey.go).
• New jwx.SupportedAlgs() / SupportedAlgsStrings() and a curated DefaultAlgs() / DefaultAlgsStrings() list (jwx/algs.go).

JWKS Handling

• jwx.JWKS.WithoutExpired(now) returns a filtered JWKS containing only non-expired keys (jwx/jwks.go).
• jwx.MergeJWKS(primary, secondary) merges two JWKS, deduplicating by KID with primary winning (jwx/jwks.go).
• New SignedJWKS type and ParseSignedJWKS for the application/jwk-set+jwt (typ jwk-set+jwt) format from OpenID Federation §5.2.1, including structural validation (typ, kid, keys, iss, sub, unique kids) and Verify(keys) (signed_jwks.go).
• New JWKStorage interface and FileJWKStorage filesystem implementation for persisting per-entity JWKS, with RegisterEntityJWKSFile symlink support (jwk_storage.go).
• Helpers ExtractKIDs and HasJWKSChanged for diffing JWKS by KID (jwks_diff.go).

Trust Anchor / Subordinate JWKS Refreshing

• New TAJWKSRefresher (ta_jwks_refresher.go): polls trust anchors for JWKS changes and updates them automatically. Concurrency-safe; supports dynamic Add/Remove/Update of trust anchors, per-TA backoff, and seeding JWKS from storage. Configurable via TAJWKSRefresherConfig and TrustAnchor.KeyPollInterval / EnableJWKSUpdate.
• TrustAnchor is now thread-safe (atomic.Pointer[jwx.JWKS] via JWKS() / SetJWKS()), with custom YAML (un)marshaling that accepts both legacy inline jwks and jwks_file (trustanchor.go).
• New SubordinateJWKSRefresher (subordinate_jwks_refresher.go): periodically polls the Entity Configuration of enabled subordinates and updates their stored JWKS when the EC's jwks changes. Configurable poll interval, exponential backoff with SubMinPollInterval floor, and a SubordinateJWKSRefreshStorage interface.

Key Rotation Hooks (KMS)

• New kms.KeyRotationHook and kms.KeyRotationEvent types, fired concurrently (each in its own goroutine, panic-recovered, errors logged) after a key is generated/rotated (jwx/keymanagement/kms/hooks.go).
• KeyRotationConfig.Hooks field registers hooks on the KMS; KMSConfig.EntityID is propagated into events.
• Multiple hook implementations:
  • CmdHook (key_rotation_hook_cmd.go): spawns an external command and pipes the new JWKS JSON to its stdin.
  • HTTPHook (key_rotation_hook_http.go): POSTs to a URL with configurable body mode (none, entity_id, jwks, signed_jwks) and optional private_key_jwt client auth via HTTPHookClientAuth + RequestObjectProducer. URL can be static or resolved dynamically per invocation via URLFunc.
  • TriggerUpdateHook and JWKSUpdateHook (key_rotation_hook_endpoints.go): convenience wrappers that resolve the target's federation_jwks_update_trigger_endpoint / federation_jwks_update_endpoint (and auth requirement / signing algs) from its Entity Configuration on each rotation.
• New oidfedconst constants for the federation entity metadata Extra keys: FederationJWKSUpdateEndpoint, FederationJWKSUpdateTriggerEndpoint, FederationJWKSUpdateTriggerEndpointAuthMethods, plus AuthMethodPrivateKeyJWT and OAuthClientAssertionJWTBearer.

KMS / Key Management

• Key announcement lead time is now configurable via KeyRotationConfig.KeyAnnouncementLeadTime and KeyAnnouncementLeadTimeECMultiplier; resolved by KeyAnnouncementLeadTimeDuration() with sensible defaults (max(5×EC lifetime, 24h)) and clamping to EC lifetime (kms.go).
• Scheduled algorithm changes: new ChangeAlgsAt / ChangeDefaultAlgorithmAt KMS methods, PendingAlgChange / PendingDefaultChange / ScheduledState types, and KMSStateStorer interface for persisting scheduled changes across restarts.

... (truncated)

Commits

• 83ee478 docs(trustmark): fix deprecation notice for FindByID
• 977c2de test(cache): update mockCacheImpl.Get to ignore target parameter
• e33d65c docs: update README with new features
• 13d5ca8 refactor: replace redundant variable copies with new() for better readabili...
• 86cdc88 chore(deps): update various dependencies to latest versions
• 86c20b8 Merge pull request #180 from go-oidfed/v11
• be68a7e Add CHANGELOG.md including planned changes for 0.11.0
• ae8a60c feat(policy): add except operator with enforcement and utility methods
• 6d64213 chore(kms): update crypto11 dependency to `github.com/eclipse-keypont/crypt...
• d882cbd feat(jwx): add WithoutExpired function to filter expired keys in JWKS
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)