Sourced from jjwt-impl's changelog.

0.11.2

This patch release:

• Allows empty JWS bodies to support RFC 8555 and similar initiatives. Pull Request 540
• Ensures OSGi environments can access JJWT implementation bundles (jjwt-jackson, jjwt-gson, etc) as fragments to jjwt-api bundle. Pull Request 580
• Rejects allowedClockSkewSeconds values that would cause numeric overflow. Issue 583
• Upgrades Jackson dependency to version 2.9.10.4 to address all known Jackson CVE vulnerabilities. Issue 585
• Updates SecretKey algorithm name validation to allow PKCS12 KeyStore OIDs in addition to JCA Names. Issue 588
• Enabled CI builds on JDK 14. Pull Request 590
• Adds missing parameters type to Maps.add(), which removes an unchecked type warning. Issue 591
• Ensures GsonDeserializer always uses UTF-8 for encoding bytes to Strings. Pull Request 592

All issues and PRs are listed in the Github JJWT 0.11.2 milestone.

0.11.1

This patch release:

• Upgrades the jjwt-jackson module's Jackson dependency to 2.9.10.3.
• Fixes an issue when using Java 9+ Map.of with JacksonDeserializer that resulted in an NullPointerException.
• Fixes an issue that prevented the jjwt-gson .jar's seralizer/deserializer implementation from being detected automatically.
• Ensures service implementations are now loaded from the context class loader, Services.class.classLoader, and the system classloader, the first classloader with a service wins, and the others are ignored. This mimics how Classes.forName() works, and how JJWT attempted to auto-discover various implementations in previous versions.
• Fixes a minor error in the Claims#getIssuedAt JavaDoc.

0.11.0

This minor release:

• Adds Google's Gson as a natively supported JSON parser. Installation instructions have been updated and new JJWT Gson usage guidelines have been added.

• Updates the Jackson dependency version to 2.9.10 to address three security vulnerabilities in Jackson.

• A new JwtParserBuilder interface has been added and is the recommended way of creating an immutable and thread-safe JwtParser instance. Mutable methods in JwtParser will be removed before v1.0. Migration to the new signatures is straightforward, for example:

  Previous Version:

   Jwts.parser()
       .requireAudience("string")
       .parse(jwtString)

  Current Version:

  Jwts.parserBuilder()
      .requireAudience("string")
      .build()
      .parse(jwtString)

• 2747493 [maven-release-plugin] prepare release 0.11.2
• 0596bea Updating readme dependency references to reflect the 0.11.2 release
• 5c8064b Updated changelog to link to the 0.11.2 milestone
• 26527bd Updated the pom snapshot versions to prepare for the upcoming 0.11.2 release
• 2f897cb Updated the changelog for the upcoming 0.11.2 release
• 72973f9 Argument validation for allowedClockSkewSeconds (#601)
• 2b00ed1 Add DefaultJwtParser functionality to parse JWSs with empty body. (#540)
• 82b870e Add support for jdk14 (#590)
• d8c313c Fix GsonDeserializer to support unicode characters independently of "file.enc...
• 43de9a3 Add parameterized return type to Maps.and() (#597)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)