Updated jwt version in oauth2-provider

[alex268]

No description provided.

[codecov]

Codecov Report

❌ Patch coverage is 83.92857% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.42%. Comparing base (05585b0) to head (b8fb064).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
...src/main/java/tech/ydb/auth/OAuth2TokenSource.java	82.69%	8 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #704      +/-   ##
============================================
+ Coverage     72.37%   72.42%   +0.04%     
- Complexity     3516     3524       +8     
============================================
  Files           391      391              
  Lines         16350    16341       -9     
  Branches       1712     1702      -10     
============================================
+ Hits          11834    11835       +1     
+ Misses         3870     3867       -3     
+ Partials        646      639       -7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[robot-vibe-db]

AI Review Summary

Verdict: ✅ No critical issues found

Critical issues

No critical issues found.

Other findings

• Major | Medium: Public API methods removed/changed without deprecation — OAuth2TokenSource.java (removed withPrivateKeyPemFile overloads, changed signatures of withPrivateKeyPem and withHmacPrivateKeyBase64)
• Minor | Medium: Use else if instead of two separate if blocks for HMAC vs signature algorithm lookup — OAuth2TokenExchangeProvider.java:119
• Minor | Medium: Error message "Multiple audience is not supported by current JWT library" at OAuth2TokenExchangeProvider.java:146 is now inaccurate since JJWT 0.13.0 does support multiple audiences. The limitation is in the wrapper code, not the library. Consider updating the message or adding multi-audience support.
• Minor | Low: readSecretKeyBase64 derives JCA name from algorithm.getKeyBitLength() which is fragile — OAuth2TokenSource.java:93
• Nit | Low: Variable named jcpName should likely be jcaName (Java Cryptography Architecture) — OAuth2TokenSource.java:93

---

This review was generated automatically. Critical issues require attention; other findings are advisory.
If this comment was useful, please give it a 👍 — it helps us improve the review bot.

[robot-vibe-db]

Full analysis log

Analysis performed by claude, claude-opus-4-6.