Sourced from github.com/k1LoW/expand's releases.

v0.16.3

What's Changed

Other Changes

• chore(deps): bump github.com/expr-lang/expr from 1.17.2 to 1.17.3 in the dependencies group by @​dependabot[bot] in k1LoW/expand#77
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in k1LoW/expand#79
• chore(deps): bump github.com/expr-lang/expr from 1.17.4 to 1.17.5 in the dependencies group by @​dependabot[bot] in k1LoW/expand#80
• chore: setup tagpr labels by @​k1LoW in k1LoW/expand#85
• chore(deps): bump github.com/expr-lang/expr from 1.17.5 to 1.17.6 in the dependencies group by @​dependabot[bot] in k1LoW/expand#82
• chore(deps): bump the dependencies group across 1 directory with 2 updates by @​dependabot[bot] in k1LoW/expand#83

Full Changelog: k1LoW/expand@v0.16.2...v0.16.3

Sourced from github.com/k1LoW/expand's changelog.

v0.16.3 - 2025-10-26

Other Changes

• chore(deps): bump github.com/expr-lang/expr from 1.17.2 to 1.17.3 in the dependencies group by @​dependabot[bot] in k1LoW/expand#77
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in k1LoW/expand#79
• chore(deps): bump github.com/expr-lang/expr from 1.17.4 to 1.17.5 in the dependencies group by @​dependabot[bot] in k1LoW/expand#80
• chore: setup tagpr labels by @​k1LoW in k1LoW/expand#85
• chore(deps): bump github.com/expr-lang/expr from 1.17.5 to 1.17.6 in the dependencies group by @​dependabot[bot] in k1LoW/expand#82
• chore(deps): bump the dependencies group across 1 directory with 2 updates by @​dependabot[bot] in k1LoW/expand#83

• e414535 Merge pull request #78 from k1LoW/tagpr-from-v0.16.2
• 1647cbf [tagpr] update CHANGELOG.md
• 0606e09 [tagpr] prepare for the next release
• 2bb219b Merge pull request #83 from k1LoW/dependabot/github_actions/dependencies-3ffa...
• d6e0ef2 Merge pull request #82 from k1LoW/dependabot/go_modules/dependencies-7908e96986
• 669f0c9 chore(deps): bump the dependencies group across 1 directory with 2 updates
• b620f23 chore(deps): bump github.com/expr-lang/expr in the dependencies group
• e1b9293 Merge pull request #85 from k1LoW/setup-tagpr-labels
• 7ac16e9 chore: setup tagpr labels
• 92aee0a chore: bump up go directive version
• Additional commits viewable in compare view

Sourced from github.com/lestrrat-go/jwx/v3's releases.

v3.0.12

What's Changed

• Change go.mod version requirements to go 1.24.0 and introduce toolchain directive by @​henrymcconville in lestrrat-go/jwx#1465
• Use go.mod for go version in Bazel module by @​henrymcconville in lestrrat-go/jwx#1466
• Enable legacy signers by default, and explicitly populate new signer instances by @​lestrrat in lestrrat-go/jwx#1460
• autodoc updates by @​github-actions[bot] in lestrrat-go/jwx#1475
• Fix godoclint issues by @​babakks in lestrrat-go/jwx#1469
• Bump actions/cache from 4.2.4 to 4.3.0 by @​dependabot[bot] in lestrrat-go/jwx#1463
• Bump actions/stale from 10.0.0 to 10.1.0 by @​dependabot[bot] in lestrrat-go/jwx#1468
• Bump github.com/segmentio/asm from 1.2.0 to 1.2.1 by @​dependabot[bot] in lestrrat-go/jwx#1462
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in lestrrat-go/jwx#1472
• Bump golang.org/x/crypto from 0.42.0 to 0.43.0 by @​dependabot[bot] in lestrrat-go/jwx#1474
• revive godoclint by @​lestrrat in lestrrat-go/jwx#1478
• [jwe] Add option to explicitly clear per-recipient headers ("header") for flattened JSON serialization by @​lestrrat in lestrrat-go/jwx#1477
• autodoc updates by @​github-actions[bot] in lestrrat-go/jwx#1480

New Contributors

• @​henrymcconville made their first contribution in lestrrat-go/jwx#1465
• @​babakks made their first contribution in lestrrat-go/jwx#1469

Full Changelog: lestrrat-go/jwx@v3.0.11...v3.0.12

Sourced from github.com/lestrrat-go/jwx/v3's changelog.

v3.0.12 20 Oct 2025

• [jwe] As part of the next change, now per-recipient headers that are empty are no longer serialized in flattened JSON serialization.

• [jwe] Introduce jwe.WithLegacyHeaderMerging(bool) option to control header merging behavior in during JWE encryption. This only applies to flattened JSON serialization.

  Previously, when using flattened JSON serialization (i.e. you specified JSON serialization via jwe.WithJSON() and only supplied one key), per-recipient headers were merged into the protected headers during encryption, and then were left to be included in the final serialization as-is. This caused duplicate headers to be present in both the protected headers and the per-recipient headers.

  Since there maybe users who rely on this behavior already, instead of changing the default behavior to fix this duplication, a new option to jwe.Encrypt() was added to allow clearing the per-recipient headers after merging to leave the "headers" field empty. This in effect makes the flattened JSON serialization more similar to the compact serialization, where there are no per-recipient headers present, and leaves the headers disjoint.

  Note that in compact mode, there are no per-recipient headers and thus the headers need to be merged regardless. In full JSON serialization, we never merge the headers, so it is left up to the user to keep the headers disjoint.

• [jws] Calling the deprecated jws.NewSigner() function for the time will cause legacy signers to be loaded automatically. Previously, you had to explicitly call jws.Settings(jws.WithLegacySigners(true)) to enable legacy signers.

  We incorrectly assumed that users would not be using jws.NewSigner(), and thus disabled legacy signers by default. However, it turned out that some users were using jws.NewSigner() in their code, which lead to breakages in existing code. In hindsight we should have known that any API made public before will be used by somebody.

  As a side effect, jws.Settings(jws.WithLegacySigners(...)) is now a no-op.

  However, please do note that jws.Signer (and similar) objects were always intended to be used for registering new signing/verifying algorithms, and not for end users to actually use them directly. If you are using them for other purposes, please consider changing your code, as it is more than likely that we will somehow deprecate/remove/discouraged their use in the future.

• 9873799 Update Changes
• b731144 autodoc updates (#1480)
• 8923c67 [jwe] Add option to explicitly clear per-recipient headers ("header") for f...
• f2f199d revive godoclint (#1478)
• 5b6c0cd Bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#1474)
• 13a81b2 Bump github/codeql-action from 3 to 4 (#1472)
• ad8a2e8 Bump github.com/segmentio/asm from 1.2.0 to 1.2.1 (#1462)
• 0d7d8fd Bump actions/stale from 10.0.0 to 10.1.0 (#1468)
• b679a25 Bump actions/cache from 4.2.4 to 4.3.0 (#1463)
• 2253d19 Fix godoclint issues (#1469)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions