chore(deps): Bump github.com/lestrrat-go/jwx from 1.2.9 to 1.2.27

[dependabot]

Bumps github.com/lestrrat-go/jwx from 1.2.9 to 1.2.27.

Release notes

Sourced from github.com/lestrrat-go/jwx's releases.

v1.2.27

v1.2.27 - 03 Dec 2023
[Security]
  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users should upgrade, as
    unlike v2, v1 attempts to decrypt JWEs on JWTs by default.
    [GHSA-7f9x-gw85-8grf]
[Bug Fixes]

[jwk] jwk.Set(jwk.KeyOpsKey, <jwk.KeyOperation>) now works (previously, either
Set(.., <string>) or Set(..., []jwk.KeyOperation{...}) worked, but not a single
jwk.KeyOperation

[SECURITY] v1.2.26

v1.2.26 - 14 Jun 2023
[Security]
  * Potential Padding Oracle Attack Vulnerability and Timing Attack Vulnerability
    for JWE AES-CBC encrypted payloads affecting all v2 releases up to v2.0.10,
    all v1 releases up to v1.2.25, and all v0 releases up to v0.9.2 have been reported by
    @shogo82148.
Please note that v0 versions will NOT receive fixes.
This release fixes these vulnerabilities for the v1 series.

v1.2.25

v1.2.25 23 May 2022
[Bug Fixes][Security]
  * [jwe] An old bug from at least 7 years ago existed in handling AES-CBC unpadding,
    where the unpad operation might remove more bytes than necessary ([#744](https://github.com/lestrrat-go/jwx/issues/744))
    This affects all jwx code that is available before v2.0.2 and v1.2.25.

v1.2.24

v1.2.24 05 May 2022
[Security]
  * Upgrade golang.org/x/crypto ([#724](https://github.com/lestrrat-go/jwx/issues/724))

v1.2.23

v1.2.23 13 Apr 2022
[Bug fixes]
  * [jwk] jwk.AutoRefresh had a race condition when `Configure()` was
    called concurrently ([#686](https://github.com/lestrrat-go/jwx/issues/686))
</tr></table> 

... (truncated)

Changelog

Sourced from github.com/lestrrat-go/jwx's changelog.

v1.2.27 - 03 Dec 2023 [Security]

• [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack, similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083. All users should upgrade, as unlike v2, v1 attempts to decrypt JWEs on JWTs by default. [GHSA-7f9x-gw85-8grf]

[Bug Fixes]

• [jwk] jwk.Set(jwk.KeyOpsKey, ) now works (previously, either Set(.., ) or Set(..., []jwk.KeyOperation{...}) worked, but not a single jwk.KeyOperation

v1.2.26 - 14 Jun 2023 [Security]

• Potential Padding Oracle Attack Vulnerability and Timing Attack Vulnerability for JWE AES-CBC encrypted payloads affecting all v2 releases up to v2.0.10, all v1 releases up to v1.2.25, and all v0 releases up to v0.9.2 have been reported by @​shogo82148.

  Please note that v0 versions will NOT receive fixes. This release fixes these vulnerabilities for the v1 series.

[Miscellaneous]

• JWE tests now only run algorithms that are supported by the underlying jose tool

v1.2.25 23 May 2022 [Bug Fixes][Security]

• [jwe] An old bug from at least 7 years ago existed in handling AES-CBC unpadding, where the unpad operation might remove more bytes than necessary (#744) This affects all jwx code that is available before v2.0.2 and v1.2.25.

v1.2.24 05 May 2022 [Security]

• Upgrade golang.org/x/crypto (#724)

v1.2.23 13 Apr 2022 [Bug fixes]

• [jwk] jwk.AutoRefresh had a race condition when Configure() was called concurrently (#686) (It has been patched correctly, but we may come back to revisit the design choices in the near future)

v1.2.22 08 Apr 2022 [Bug fixes]

• [jws] jws.Verify was ignoring the b64 header when it was present in the protected headers (#681). Now the following should work:

  jws.Sign(..., jws.WithDetachedPayload(payload)) // previously payload had to be base64 encoded

... (truncated)

Commits

• 611567b v1.2.27 (#1026)
• d9ddbc8 merge v1 (#936)
• ad8c29d merge develop/v1 (#747)
• e38f677 Merge develop/v1 (#727)
• baba561 Merge branch 'develop/v1' into v1
• 8ff6c75 Update Changes
• ea97e8c Fix race in jwk.AutoRefresh (#686)
• f4701e1 Update Changes
• e831228 Fix jws.Verify not respecting the b64 header in the protected headers (#683)
• b66a2cb backport: Update golangci lint (#679) (#680)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #344.