[dependabot]

Bumps jose from 1.11.12 to 1.11.13.

Release notes

Sourced from jose's releases.

1.11.13 (2026-10-26)

• Security Patches
  • GHSA-wfpv-qxp8-x5gm, GHSA-wh8p-p48q-3vw2: Bound incremental JWE zip: "DEF" decompression to 1 MiB by default. Applications requiring larger compressed plaintexts can set jose:zip_size_maximum/1 or the zip_size_maximum application environment key.
  • GHSA-44hw-rpw9-mwg4: Require the canonical ECDSA signature length for ES256, ES384, ES512 and ES256K.
  • GHSA-6gxw-6f7r-cjr6: Reject AEAD tags other than 128 bits before provider dispatch, and in the AES-GCM fallback.
  • GHSA-3m45-vrpj-xmrq: Bound RSA private-key prime recovery with random trials, reused modular squares and deadlines checked before expensive operations; validate recovered factors against the supplied exponents. Keys above 8192 bits or exhausting the recovery budget must supply CRT parameters.
  • GHSA-fpj2-9h59-32pp: Reject mismatched shared-secret key types instead of recursing indefinitely.
  • GHSA-h4gx-8jq2-mfhc: Strengthen encrypted PKCS#8 DER and PEM exports to PBKDF2-HMAC-SHA256 with 600,000 iterations and 16-byte salts. Previously exported keys remain readable. Use native PBKDF2 when available.
  • GHSA-vwvr-f994-6j9j: Substitute a random CEK of the required length on RSA JWE unwrap failure, then authenticate the content. Low-level RSA padding helpers still report errors; this mitigation does not guarantee constant-time RSA. Prefer RSA-OAEP or RSA-OAEP-256.
  • GHSA-xvr2-gggj-h2pp: Correct the shipped crypto_fallback default to false and document the variable-time pure Erlang curve implementations. Explicitly enabled fallback remains variable-time and should not handle long-lived private keys where timing is observable.
• Fixes
  • Return compressed JWE authentication failures without invoking decompression, including external AAD.
  • Preserve native Ed448/X448 selection when fallback SHAKE256 is unavailable; include X25519/X448 agreement in provider checks.
  • Add public API security regressions and independent legacy PKCS#8 import checks.
  • Treat a random base sharing a factor with the modulus as a failed RSA prime recovery trial, so inconsistent (n, e, d) keys are rejected instead of imported with a composite factor.
  • Return <<>> from Concat KDF for a zero key length instead of looping indefinitely, and reject negative lengths with badarg.
  • Erlang/OTP 29 compatibility: decode X25519/X448 PKCS#8 private keys, encode EC SubjectPublicKeyInfo DER, and replace deprecated catch Expr expressions.
• Notes
  • Deployments relying on unavailable native algorithms must explicitly enable crypto_fallback and review the timing limitations. Native providers remain preferred.
  • Tested on Erlang/OTP 28 and 29.

Changelog

Sourced from jose's changelog.

1.11.13 (2026-10-26)

• Security Patches
  • GHSA-wfpv-qxp8-x5gm, GHSA-wh8p-p48q-3vw2: Bound incremental JWE zip: "DEF" decompression to 1 MiB by default. Applications requiring larger compressed plaintexts can set jose:zip_size_maximum/1 or the zip_size_maximum application environment key.
  • GHSA-44hw-rpw9-mwg4: Require the canonical ECDSA signature length for ES256, ES384, ES512 and ES256K.
  • GHSA-6gxw-6f7r-cjr6: Reject AEAD tags other than 128 bits before provider dispatch, and in the AES-GCM fallback.
  • GHSA-3m45-vrpj-xmrq: Bound RSA private-key prime recovery with random trials, reused modular squares and deadlines checked before expensive operations; validate recovered factors against the supplied exponents. Keys above 8192 bits or exhausting the recovery budget must supply CRT parameters.
  • GHSA-fpj2-9h59-32pp: Reject mismatched shared-secret key types instead of recursing indefinitely.
  • GHSA-h4gx-8jq2-mfhc: Strengthen encrypted PKCS#8 DER and PEM exports to PBKDF2-HMAC-SHA256 with 600,000 iterations and 16-byte salts. Previously exported keys remain readable. Use native PBKDF2 when available.
  • GHSA-vwvr-f994-6j9j: Substitute a random CEK of the required length on RSA JWE unwrap failure, then authenticate the content. Low-level RSA padding helpers still report errors; this mitigation does not guarantee constant-time RSA. Prefer RSA-OAEP or RSA-OAEP-256.
  • GHSA-xvr2-gggj-h2pp: Correct the shipped crypto_fallback default to false and document the variable-time pure Erlang curve implementations. Explicitly enabled fallback remains variable-time and should not handle long-lived private keys where timing is observable.
• Fixes
  • Return compressed JWE authentication failures without invoking decompression, including external AAD.
  • Preserve native Ed448/X448 selection when fallback SHAKE256 is unavailable; include X25519/X448 agreement in provider checks.
  • Add public API security regressions and independent legacy PKCS#8 import checks.
  • Treat a random base sharing a factor with the modulus as a failed RSA prime recovery trial, so inconsistent (n, e, d) keys are rejected instead of imported with a composite factor.
  • Return <<>> from Concat KDF for a zero key length instead of looping indefinitely, and reject negative lengths with badarg.
  • Erlang/OTP 29 compatibility: decode X25519/X448 PKCS#8 private keys, encode EC SubjectPublicKeyInfo DER, and replace deprecated catch Expr expressions.
• Notes
  • Deployments relying on unavailable native algorithms must explicitly enable crypto_fallback and review the timing limitations. Native providers remain preferred.
  • Tested on Erlang/OTP 28 and 29.

Commits

• 0f57e00 Commit mix.lock and always install Hex and rebar in CI
• 600ac2c Version 1.11.13
• c889ea4 Fix CI: disable erlang.mk Elixir builds and refresh Dialyzer ignores
• 60ae6a9 Update Mix dependency requirements and drop earmark
• 98b5354 Ignore erlang.mk's generated lock.mk
• 31b3f85 Fix Concat KDF hang when KeyDataLen is zero or negative
• 29cb8e2 Do not return shared-factor bases as RSA primes during SFM recovery
• 823da52 Expect truncated GCM tags to be rejected in CAVP decrypt vectors
• d5383db Upgrade libsodium test dependency to 3.0.0
• 4615a8e Update erlang.mk, test dependencies and CI for OTP 29
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)