fix(deps): update module github.com/gofiber/jwt/v3 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/gofiber/jwt/v3	v3.3.10 -> v4.0.0

---

Release Notes

gofiber/jwt (github.com/gofiber/jwt/v3)

v4.0.0

Compare Source

🧹 Updates

• Upgrade to github.com/golang-jwt/jwt/v5 and use github.com/MicahParks/keyfunc/v2 for JWK Set client (#​129)
• Bump github.com/MicahParks/keyfunc/v2 from 2.0.2 to 2.0.3 (#​133)
• Bump github.com/gofiber/fiber/v2 from 2.45.0 to 2.46.0 (#​132)

Full Changelog: gofiber/jwt@v3.3.10...v3.3.11

Thank you @​MicahParks for making this update possible.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[druid-infra]

Daily Renovate audit (druid-infra): inspected head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, metadata/diff/files, release notes, review state, mergeability, and check runs. Diff adds github.com/gofiber/jwt/v4 v4.0.0 and its go.mod checksum alongside the existing v3 dependency; no auth call-site migration is included. Release notes indicate the v4 line changes to golang-jwt/jwt v5 and keyfunc v2. Checks: no check runs reported; no reviews reported; GitHub mergeability was unknown. Local reproduction used isolated worktree /tmp/druid-cli-pr30. git diff --check passed. Dockerized Go golang:1.23-bookworm /usr/local/go/bin/go test ./test ./internal/... failed in test with QueueManager missing LogManager.AddLine calls. Browser coverage: not applicable. Decision: not merged — major/auth-sensitive upgrade, dependency is added rather than adopted, required checks are absent, and tests are failing.

[druid-infra]

Daily Renovate audit (2026-09-05 UTC), druid-infra: inspected metadata, diff, head d2cb1db, reviews, mergeability, and check runs. Diff only adds github.com/gofiber/jwt/v4 v4.0.0 to go.mod/go.sum alongside v3; release notes in the Renovate description were reviewed. Checks: none reported. Local validation: dockerized Go 1.24 with GOWORK=off go test ./... was attempted; it did not complete cleanly, reporting existing compile/vet failure at debug/exec.go:54 (int-to-string conversion) and later timing out after package tests; git diff --check — PASS. Browser coverage: not applicable. Decision: NOT MERGED — PR is CONFLICTING/DIRTY and is a major auth/JWT API-line addition without migration/code changes; tests did not provide a clean result.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata, head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, diff (go.mod/go.sum only), release notes, review state, mergeability, and check runs. The update adds github.com/gofiber/jwt/v4 v4.0.0 while retaining v3; release notes indicate a JWT v5/keyfunc v2 migration, but this diff does not migrate usage, so it is not safely mergeable as an additive major-version dependency. Checks: no check runs reported. Dockerized test: docker run --rm -v /tmp/druid-cli-pr-30:/app -w /app golang:1.23 bash -lc 'export PATH=/usr/local/go/bin:$PATH; go test ./test' — PASS. Broader go test ./... reached the repository's pre-existing debug/exec.go:54 vet/build error and timed out while integration work continued. Browser coverage: not applicable (Go dependency-only diff). Decision: NOT MERGED; GitHub reports mergeable_state=dirty, no CI/check evidence, and the major-version API is unused by this diff.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, go.mod/go.sum diff (adds github.com/gofiber/jwt/v4 alongside v3; major-version/auth-related dependency), mergeability (dirty), review state (no reviews), and check runs (none). Ran Dockerized Go 1.23: go test ./... and go vet ./...; validation exposed existing repository failures (debug/exec.go:54 vet/build diagnostic and failing test/queue_manager_test.go cases) and the command timed out after 600s. No browser coverage was applicable. Decision: not merged — dirty/unmergeable, no CI checks, auth/security-sensitive major-version change, and local validation did not pass.

[druid-infra]

druid-infra daily Renovate audit (2026-09-11 UTC): inspected metadata, changed files/diff, head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, review state, mergeability, and check runs. Diff is limited to adding github.com/gofiber/jwt/v4 v4.0.0 and its go.sum entry while retaining v3; upstream v4.0.0 notes were reviewed, including its JWT v5/keyfunc v2 migration. Ran Dockerized Go 1.24 go test ./...; it reached TestQueueManager failures for AddItem_Command (missing MockLogManagerInterface.AddLine calls). No browser test: backend dependency-only change. Not merged: auth-related major-version migration, mergeable_state=dirty, no check runs, and failing tests.

[druid-infra]

Daily Renovate audit (2026-09-12), authenticated as druid-infra.

Inspected head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, metadata, diff, review state, mergeability, and check runs. Diff only adds github.com/gofiber/jwt/v4 v4.0.0 to go.mod/go.sum; existing v3.3.10 remains and no source imports were changed. No check runs are reported; GitHub reports mergeability dirty.

Tests in an isolated worktree using Docker golang:1.23:

• go test -timeout 120s ./test — PASS
• go build ./... — PASS
• git diff --check — PASS

Browser coverage: not applicable; this is a Go dependency metadata-only change with no UI surface. Decision: not merged. This is a major/authentication-library update without the required source migration, and the PR is not clean/mergeable with no required check runs.

[druid-infra]

Renovate audit (druid-infra, 2026-09-13): inspected PR metadata, head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, mergeability/review state, all check runs (0 check runs; combined status pending), and the full diff (go.mod/go.sum, adds github.com/gofiber/jwt/v4 4.0.0 while retaining v3.3.10). Reviewed the upstream v4 release notes: it moves to golang-jwt/jwt/v5 and keyfunc/v2, but this PR contains no source migration. git diff --check passed. Dockerized compile coverage passed: docker run --rm -v <checkout>:/src -w /src golang:1.24.7 /usr/local/go/bin/go test -vet=off -run '^$' ./.... Full runtime tests were not claimed because the repository’s untagged integration packages run long-lived Docker tests; the compile-only command covered all packages. No browser test applies to this Go-only dependency diff. Decision: NOT MERGED — major/auth dependency change requires explicit instruction and source migration review; required checks are absent/pending with mergeability reported unknown.

[druid-infra]

Daily Renovate audit (druid-infra): inspected head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, metadata/mergeability, diff, reviews, commit status, and check runs. Diff adds github.com/gofiber/jwt/v4 v4.0.0 and one go.sum entry while retaining v3; release notes indicate a JWT major migration to golang-jwt/jwt/v5/keyfunc v2, so this is auth-sensitive and not eligible for unattended merge. Checks/status: no check runs; combined status pending; mergeability dirty. Tests: docker run --rm -v "$PWD":/src -w /src golang:1.23 go test ./... did not complete cleanly (existing debug/exec.go:54 vet/build failure and test instability); focused docker run --rm -v "$PWD":/src -w /src golang:1.23 go test ./test passed (ok, 0.024s). git diff --check passed. Browser coverage: not applicable (Go dependency). Decision: NOT MERGED — dirty/non-green state and auth-sensitive major update requires explicit review.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, diff, mergeability, reviews, and check runs. Diff adds github.com/gofiber/jwt/v4 v4.0.0 alongside the existing v3 dependency; no source migration is included. Release notes explicitly upgrade to golang-jwt/jwt/v5 and keyfunc/v2, making this a major/authentication-sensitive dependency change requiring explicit review. No check runs are reported; mergeability is dirty; no reviews/change requests are reported. In an isolated checkout, git diff --check passed. Dockerized test attempt: docker run --rm -v /tmp/druid-pr30:/app -w /app golang:1.23 bash -lc '/usr/local/go/bin/go test ./... && /usr/local/go/bin/go vet ./...'; it did not pass (existing debug/exec.go:54 vet diagnostic and unrelated test/process_manager_test.go failure; command timed out before vet completion). Decision: not merged; major/auth-sensitive migration, dirty merge state, absent successful checks, and failed local verification.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, diff (go.mod, go.sum), mergeability, reviews, and check runs. Reviewed gofiber/jwt v4.0.0 release notes; it moves to golang-jwt/jwt v5 and keyfunc/v2, while this diff only adds the new module and does not migrate source imports/API usage. git diff --check passed. Attempted Dockerized Go validation: docker run --rm -v /tmp/druid-pr-audit/druid-cli-30:/src -w /src golang:1.24 bash -c 'go test ./...'; dependency download did not complete within the audit run, so no passing test result is claimed. Browser coverage: not applicable (Go dependency-only diff). Decision: not merged; GitHub reports mergeable_state=dirty, with no check runs, and the major-version update is not demonstrated as adopted by source changes.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata, head d2cb1db9f731f5f95821bb4ab191a87d82f78cce, diff, changed files, reviews, mergeability, and check/status surfaces. The diff only adds github.com/gofiber/jwt/v4 v4.0.0 plus one go.sum entry; no source migration from jwt/v3 is included. Dockerized Go 1.24: go test -vet=off ./test passed; go test ./... did not complete cleanly (existing debug/exec.go:54 vet failure and a QueueManager test failure). go mod tidy -diff removes the added jwt/v4 requirement and checksum, showing dependency/lockfile drift. No browser coverage (non-UI). No reviews/check runs were present; GitHub reports mergeability dirty/status pending. Decision: not merged; major/auth-related update, dirty mergeability, absent checks, and tidy drift require repair and explicit review.