chore(deps): bump github.com/golang-jwt/jwt/v5 to v5.3.1

[thaJeztah]

• relates to chore(deps): github.com/docker/cli v29.6.0, github.com/docker/buildx v0.35.0, buildkit v0.31.0 #13842 (comment)
• stacked on pkg/e2e: fix malformed JWT in fixtures #13857

full diff: golang-jwt/jwt@v5.3.0...v5.3.1

What I did

Related issue

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[thaJeztah]

OK same error here;

=== Failed
=== FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.08s)
publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
please double check that you are not leaking sensitive data
AWS Client ID
"services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF
AWS Secret Key
"services.serviceA.environment.AWS_SECRET_ACCESS_KEY": aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+"
Keyword Detector
"secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt
Github authentication
"GITHUB_TOKEN": ***
Private Key
"": -----BEGIN DSA PRIVATE KEY-----
wxyz+ABC=
-----END DSA PRIVATE KEY-----
Are you ok to publish these sensitive data?
--- FAIL: TestPublishChecks/detect_sensitive_data (0.08s)

[thaJeztah]

Temporary commit to make the test rump the old output;

=== Failed
=== FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.07s)
publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "WOOP JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
please double check that you are not leaking sensitive data
AWS Client ID
"services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF
AWS Secret Key
"services.serviceA.environment.AWS_SECRET_ACCESS_KEY": aws"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+"
Keyword Detector
"secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt
Github authentication
"GITHUB_TOKEN": ***
JSON Web Token
"": ***
Private Key
"": -----BEGIN DSA PRIVATE KEY-----
wxyz+ABC=
-----END DSA PRIVATE KEY-----
Are you ok to publish these sensitive data?
--- FAIL: TestPublishChecks/detect_sensitive_data (0.07s)

[thaJeztah]

Right, so for some reason the JSON Web Token doesn't appear;

diff --git a/before.txt b/after.txt
index cfbbfaf3f..facfa1d5b 100644
--- a/before.txt+++ b/after.txt@@ -1,6 +1,6 @@
=== Failed
=== FAIL: pkg/e2e TestPublishChecks/detect_sensitive_data (0.08s)
- publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "WOOP JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.+ publish_test.go:152: assertion failed: expression is false: strings.Contains(output, "JSON Web Token\n\"\": ***"+"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"): you are about to publish sensitive data within your OCI artifact.
please double check that you are not leaking sensitive data
AWS Client ID
"services.serviceA.environment.AWS_ACCESS_KEY_ID": A3TX1234567890ABCDEF
@@ -10,8 +10,6 @@
"secrets.mysecret.file": /home/runner/work/compose/compose/pkg/e2e/fixtures/publish/secret.txt
Github authentication
"GITHUB_TOKEN": ***
- JSON Web Token- "": ***
Private Key
"": -----BEGIN DSA PRIVATE KEY-----
wxyz+ABC=

[thaJeztah]

OK; looks like this is indeed because of

• Set token.Signature in ParseUnverified golang-jwt/jwt#414
• 5.3.1 now treats malformed signatures as an error in ParseUnverified, which does not align with the documented behavior golang-jwt/jwt#499

The fixture we use is not a valid JWT;

compose/pkg/e2e/fixtures/publish/config.txt

Line 1 in 6042df7

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw

First 2 elements decode, but the last one is malformed;

echo'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'| base64 -d
{"alg":"HS256","typ":"JWT"}⏎ echo'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ'| base64 -d
{"sub":"1234567890","name":"John Doe","iat":1516239022⏎ echo'SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw'| base64 -d
I�J�IHNJ(]�O��lj�~�:N�%_�u
,⏎

It looks like that may be taken from an example, like https://github.com/knottx/JWTCodable#example-jwt-token, but the last 2 bytes were truncated.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR bumps the indirect Go dependency github.com/golang-jwt/jwt/v5 from v5.3.0 to v5.3.1 to pick up the upstream patch-level changes (per the linked upstream compare and prior related discussion in docker/compose).

Changes:

• Update github.com/golang-jwt/jwt/v5 to v5.3.1 in go.mod (indirect dependency).
• Refresh go.sum entries to match the new module version and checksums.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
go.mod	Bumps github.com/golang-jwt/jwt/v5 indirect requirement to v5.3.1.
go.sum	Updates checksum entries for github.com/golang-jwt/jwt/v5 to v5.3.1.

[docker-agent]

Assessment: 🟢 APPROVE

This PR bumps github.com/golang-jwt/jwt/v5 from v5.3.0 to v5.3.1. The changes are limited to go.mod and go.sum:

• The version string in go.mod is updated correctly to v5.3.1.
• Both checksum entries in go.sum are updated consistently with the new release hashes.
• The shared go.mod hash between v5.3.0 and v5.3.1 is expected — the upstream module's go.mod did not change between patch releases.

No logic, security, or behavioral issues introduced. The dependency update looks correct and complete.