Attesto 1.2.4 permits JOSE 1.11.9 through 1.11.12. The earlier releases have two independent compatibility defects on Attesto's supported runtimes.
JOSE 1.11.9 and 1.11.10 are incompatible with EC private-key encode/decode operations on OTP 28: OTP changed the ECPrivateKey version representation from integer 1 to :ecPrivkeyVer1, while those JOSE releases only handle the older representation. Ordinary consumer operations such as generating an EC key and exporting it with JOSE.JWK.to_map/1 can raise FunctionClauseError. JOSE 1.11.11 added OTP-aware handling for both representations; the upstream changelog links the report and implementations: #179, #180, #181, and #182.
JOSE 1.11.11 then introduced a separate regression in its builtin Erlang/OTP JSON backend: an Elixir nil claim could be encoded as the JSON string "nil" instead of null. JOSE 1.11.12 fixed that behavior in #184, making 1.11.12 the first release that includes both corrections.
Raise Attesto's JOSE floor to ~> 1.11.12, cut a patch release, and cover both boundaries with exact-floor tests: generate a P-256 key, export/import its public JWK, sign and verify an ES256 payload, and confirm the builtin OTP JSON backend preserves a nil JWT claim as JSON null. The lock already selects 1.11.12, so the supported OTP 27, 28, and 29 CI jobs exercise the exact floor.
This is a dependency-compatibility correction only; Attesto's public API and runtime policy remain unchanged.
Attesto 1.2.4 permits JOSE 1.11.9 through 1.11.12. The earlier releases have two independent compatibility defects on Attesto's supported runtimes.
JOSE 1.11.9 and 1.11.10 are incompatible with EC private-key encode/decode operations on OTP 28: OTP changed the
ECPrivateKeyversion representation from integer1to:ecPrivkeyVer1, while those JOSE releases only handle the older representation. Ordinary consumer operations such as generating an EC key and exporting it withJOSE.JWK.to_map/1can raiseFunctionClauseError. JOSE 1.11.11 added OTP-aware handling for both representations; the upstream changelog links the report and implementations: #179, #180, #181, and #182.JOSE 1.11.11 then introduced a separate regression in its builtin Erlang/OTP JSON backend: an Elixir
nilclaim could be encoded as the JSON string"nil"instead ofnull. JOSE 1.11.12 fixed that behavior in #184, making 1.11.12 the first release that includes both corrections.Raise Attesto's JOSE floor to
~> 1.11.12, cut a patch release, and cover both boundaries with exact-floor tests: generate a P-256 key, export/import its public JWK, sign and verify an ES256 payload, and confirm the builtin OTP JSON backend preserves anilJWT claim as JSONnull. The lock already selects 1.11.12, so the supported OTP 27, 28, and 29 CI jobs exercise the exact floor.This is a dependency-compatibility correction only; Attesto's public API and runtime policy remain unchanged.