chore(deps): migrage jose to go-jose/v3 (#433)

closes #390

pkg/client/client.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"golang.org/x/oauth2"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/logging"
 	"github.com/zitadel/oidc/v3/pkg/crypto"

pkg/client/profile/jwt_profile.go

@@ -5,8 +5,8 @@ import (
 	"net/http"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"golang.org/x/oauth2"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/oidc/v3/pkg/client"
 	"github.com/zitadel/oidc/v3/pkg/oidc"

pkg/client/rp/jwks.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 	"sync"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 	"github.com/zitadel/oidc/v3/pkg/oidc"

pkg/client/rp/relying_party.go

@@ -9,11 +9,11 @@ import (
 	"net/url"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/google/uuid"
 	"github.com/zitadel/logging"
 	"golang.org/x/exp/slog"
 	"golang.org/x/oauth2"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/oidc/v3/pkg/client"
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"

pkg/client/rp/verifier.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )

pkg/client/rp/verifier_test.go

@@ -5,11 +5,11 @@ import (
 	"testing"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	tu "github.com/zitadel/oidc/v3/internal/testutil"
 	"github.com/zitadel/oidc/v3/pkg/oidc"
-	"gopkg.in/square/go-jose.v2"
 )
 
 func TestVerifyTokens(t *testing.T) {

pkg/crypto/hash.go

@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"hash"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 var ErrUnsupportedAlgorithm = errors.New("unsupported signing algorithm")

pkg/crypto/sign.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 func Sign(object interface{}, signer jose.Signer) (string, error) {

pkg/oidc/keyset.go

@@ -7,7 +7,7 @@ import (
 	"crypto/rsa"
 	"errors"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 const (
@@ -46,8 +46,8 @@ func GetKeyIDAndAlg(jws *jose.JSONWebSignature) (string, string) {
 //
 // will return false none or multiple match
 //
-//deprecated: use FindMatchingKey which will return an error (more specific) instead of just a bool
-//moved implementation already to FindMatchingKey
+// deprecated: use FindMatchingKey which will return an error (more specific) instead of just a bool
+// moved implementation already to FindMatchingKey
 func FindKey(keyID, use, expectedAlg string, keys ...jose.JSONWebKey) (jose.JSONWebKey, bool) {
 	key, err := FindMatchingKey(keyID, use, expectedAlg, keys...)
 	return key, err == nil

pkg/oidc/keyset_test.go

@@ -7,7 +7,7 @@ import (
 	"reflect"
 	"testing"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 func TestFindKey(t *testing.T) {

pkg/oidc/token.go

@@ -5,8 +5,8 @@ import (
 	"os"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"golang.org/x/oauth2"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/muhlemmer/gu"
 	"github.com/zitadel/oidc/v3/pkg/crypto"

pkg/oidc/token_request.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 const (

pkg/oidc/token_test.go

@@ -4,9 +4,9 @@ import (
 	"testing"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/text/language"
-	"gopkg.in/square/go-jose.v2"
 )
 
 var (

pkg/oidc/types.go

@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/zitadel/schema"
 	"golang.org/x/text/language"
-	"gopkg.in/square/go-jose.v2"
 )
 
 type Audience []string

pkg/oidc/verifier.go

@@ -10,7 +10,7 @@ import (
 	"strings"
 	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	str "github.com/zitadel/oidc/v3/pkg/strings"
 )

pkg/op/discovery.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"net/http"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 	"github.com/zitadel/oidc/v3/pkg/oidc"

pkg/op/discovery_test.go

@@ -6,10 +6,10 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"github.com/zitadel/oidc/v3/pkg/op"

pkg/op/keys.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"net/http"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 )

pkg/op/keys_test.go

@@ -7,9 +7,9 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"github.com/zitadel/oidc/v3/pkg/op"

pkg/op/mock/authorizer.mock.impl.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"testing"
 
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/golang/mock/gomock"
 	"github.com/zitadel/schema"
-	"gopkg.in/square/go-jose.v2"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 	"github.com/zitadel/oidc/v3/pkg/op"

pkg/op/mock/discovery.mock.go

@@ -8,8 +8,8 @@ import (
 	context "context"
 	reflect "reflect"
 
+	jose "github.com/go-jose/go-jose/v3"
 	gomock "github.com/golang/mock/gomock"
-	jose "gopkg.in/square/go-jose.v2"
 )
 
 // MockDiscoverStorage is a mock of DiscoverStorage interface.

pkg/op/mock/signer.mock.go

@@ -7,8 +7,8 @@ package mock
 import (
 	reflect "reflect"
 
+	jose "github.com/go-jose/go-jose/v3"
 	gomock "github.com/golang/mock/gomock"
-	jose "gopkg.in/square/go-jose.v2"
 )
 
 // MockSigningKey is a mock of SigningKey interface.

pkg/op/mock/storage.mock.go

@@ -9,10 +9,10 @@ import (
 	reflect "reflect"
 	time "time"
 
+	jose "github.com/go-jose/go-jose/v3"
 	gomock "github.com/golang/mock/gomock"
 	oidc "github.com/zitadel/oidc/v3/pkg/oidc"
 	op "github.com/zitadel/oidc/v3/pkg/op"
-	jose "gopkg.in/square/go-jose.v2"
 )
 
 // MockStorage is a mock of Storage interface.

pkg/op/op.go

@@ -7,11 +7,11 @@ import (
 	"time"
 
 	"github.com/go-chi/chi"
+	jose "github.com/go-jose/go-jose/v3"
 	"github.com/rs/cors"
 	"github.com/zitadel/schema"
 	"golang.org/x/exp/slog"
 	"golang.org/x/text/language"
-	"gopkg.in/square/go-jose.v2"
 
 	httphelper "github.com/zitadel/oidc/v3/pkg/http"
 	"github.com/zitadel/oidc/v3/pkg/oidc"

pkg/op/signer.go

@@ -3,7 +3,7 @@ package op
 import (
 	"errors"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 )
 
 var (

pkg/op/storage.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )

pkg/op/verifier_jwt_profile.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"time"
 
-	"gopkg.in/square/go-jose.v2"
+	jose "github.com/go-jose/go-jose/v3"
 
 	"github.com/zitadel/oidc/v3/pkg/oidc"
 )