chore(deps): update module github.com/lestrrat-go/jwx/v3 to v4 (9.4)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/lestrrat-go/jwx/v3	indirect	major	v3.1.0 -> v4.0.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v3)

v4.0.1

Compare Source

What's Changed

• docs: add jwxfilter to extension modules doc by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2041
• autodoc updates by @​github-actions[bot] inhttps://github.com/lestrrat-go/jwx/pull/20422
• docs: fix broken v3-to-v4.yaml link in Changes-v4.md by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2048
• guard ecdsa coordinates against oversized big.Int by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2049
• reject jwe with conflicting alg in protected vs per-recipient by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2051
• autodoc updates by @​github-actions[bot] inhttps://github.com/lestrrat-go/jwx/pull/20533
• docs: document PrivateClaims concurrency contract by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2055
• fix AddressClaim.MarshalJSON for non-printable bytes by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2054
• jwt: only call ParseForm when WithFormKey is supplied by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2057
• jws: jkuProvider rejects fetched keys marked use=enc by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2059
• jwk: refuse RegisterKeyImporter for built-in raw key types by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2061
• jwa: unify SignatureAlgorithm/KeyEncryption/ContentEncryption into one registry by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2062
• docs: jwkbb X509 registry is a privileged extension point by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2067
• docs(internals): record Settings unknown-option handling as design intent by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2068
• cmd/jwx: warn on private-key-to-tty + reject keysize<=0 for oct by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2070
• autodoc updates by @​github-actions[bot] inhttps://github.com/lestrrat-go/jwx/pull/20699
• fix jwxmigrate install path in MIGRATION.md by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/2076

Full Changelog: lestrrat-go/jwx@v4.0.0...v4.0.1

v4.0.0

Compare Source

Changes

v4 has many incompatibilities with v3. To see the full list of differences between
v3 and v4, please read the Changes-v4.md file. Coding Agents should read MIGRATION.md

v4.0.0 - 19 Apr 2026

• Initial v4 release. Major features:
  • Lighter: Core / Companion module separation. Less dependencies in core.
  • Faster: Use of generics and other optimizations make v4 2x~3x faster than before.
  • Quantum-Ready: ML-KEM and ML-DSA, HPKE (+Hybrid) are supported through companion modules.
• See Changes-v4.md for a full set of Changes since v3.

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/9.4-github.com-lestrrat-go-jwx-v3-4.x upstream/renovate/9.4-github.com-lestrrat-go-jwx-v3-4.x
git merge upstream/9.4
git push upstream renovate/9.4-github.com-lestrrat-go-jwx-v3-4.x

[elastic-renovate-prod]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.