Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: jwt/ruby-jwt
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: jwt/ruby-jwt
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 2-10-stable
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 4 commits
  • 9 files changed
  • 2 contributors

Commits on Dec 28, 2024

  1. Fix deprecation messages

    anakinj committed Dec 28, 2024
    Configuration menu
    Copy the full SHA
    7ff5f07 View commit details
    Browse the repository at this point in the history

Commits on Jun 29, 2025

  1. Simplify CI on 2.10 branch (#702)

    * Remove coverage steps
    
    * Use ubuntu latest
    
    * Older openssl on selected Ruby versions
    
    * Logger was needed
    anakinj authored Jun 29, 2025
    Configuration menu
    Copy the full SHA
    c73c286 View commit details
    Browse the repository at this point in the history
  2. Backport: Avoid using the same digest across calls (#697) (#701)

    Avoid using the same digest across calls (#697)
    
    * Avoid using the same digest across calls
    
    JWT appears to reuse these JWA instances across threads, which
    can lead to them stepping on each other via the shared
    OpenSSL::Digest instance. This causes decoding to fail
    verification, likely because the digest contains an amalgam of
    data from the different threads.
    
    This patch creates a new OpenSSL::Digest for each use, avoiding
    the threading issue.
    
    Note that the HMAC JWA already calls OpenSSL::HMAC.digest,
    avoiding the shared state, and the others do not use digest.
    
    The original code does not fail on CRuby most likely because only
    one thread at a time can be calculating a digest against a given
    OpenSSL::Digest instance, due to the VM lock.
    
    Fixes #696
    
    Addresses the issue reported in jruby/jruby#8504 by @mohamedhafez
    
    * Add #697 to changelog
    
    * Modify Rsa digest name test for new structure
    
    The @digest instance variable now contains the name to the digest
    to be used.
    
    See #697
    
    * Add test for concurrent encode/decode using ECDSA
    
    This is adapted from the script in #696 and provides a test for
    the ECDSA part of the fix in #697.
    
    * Fixes for Rubocop
    
    Co-authored-by: Charles Oliver Nutter <[email protected]>
    anakinj and headius authored Jun 29, 2025
    Configuration menu
    Copy the full SHA
    67dc9d3 View commit details
    Browse the repository at this point in the history
  3. Version 2.10.2 (#703)

    anakinj authored Jun 29, 2025
    Configuration menu
    Copy the full SHA
    658275c View commit details
    Browse the repository at this point in the history
Loading