chore(deps): update dependency jose to v6.2.9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jose	6.2.3 → 6.2.9

---

Release Notes

panva/jose (jose)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Compare Source

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Compare Source

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Compare Source

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Compare Source

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #​879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

• correct subpaths and API documentation (2daec38)
• document consumer-supplied type parameters (9e9f66c)
• stop claiming the JWK "use" parameter is used during import (47a07b2)
• update CHANGELOG.md (fc51bf5)

Refactor

• assert key shape and type from the entry (971057e)
• avoid 32-bit truncation of the AES-CBC-HMAC AAD bit length (1c8c6e9)
• correct swapped JWE unprotected header type error messages (894c498)
• describe each JWS algorithm once (7375028)
• discriminate a key once (0b59a69)
• fold single-consumer modules into their consumers (c2f0ca3)
• generate and import keys from the entry (da69b68)
• keep JWE out of the JWKS and embedded-JWK paths (241dd48)
• keep JWS and JWE out of each other's bundles (2a98564)
• parse a Protected Header in one place (30f72af)
• resolve the content encryption algorithm once (98b50ab)
• tighten key property checks (fe0dc3b)
• types: add discriminated JOSE error types (f7f764e)
• types: add JOSE identifier unions and JWK narrowing (2a20f49)
• types: improve key and result inference (cb25e77)
• types: trim published declaration comments (544f179)
• unify base64 decode errors (3a91833)
• validate each token once rather than once per layer (bbdae09)
• write each algorithm identifier once (73d83b5)

v6.2.4

Compare Source

Documentation

• update README.md and SECURITY.md to reflect passed EOL dates (2a84032)

Refactor

• normalize JWK export members from runtime quirks (386a3eb)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7f9c23a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 7f9c23a

Command	Status	Duration	Result
nx affected -t build lint test typecheck e2e-ci	❌ Failed	2m 27s	View ↗

💡 Dealing with memory or CPU issues? See memory and CPU details with the resource usage add-on ↗.

---

☁️ Nx Cloud last updated this comment at 2026-08-18 15:06:14 UTC

[pkg-pr-new]

Open in StackBlitz

@forgerock/davinci-client

pnpm add https://pkg.pr.new/@forgerock/davinci-client@739

@forgerock/device-client

pnpm add https://pkg.pr.new/@forgerock/device-client@739

@forgerock/journey-client

pnpm add https://pkg.pr.new/@forgerock/journey-client@739

@forgerock/oidc-client

pnpm add https://pkg.pr.new/@forgerock/oidc-client@739

@forgerock/protect

pnpm add https://pkg.pr.new/@forgerock/protect@739

@forgerock/recognize

pnpm add https://pkg.pr.new/@forgerock/recognize@739

@forgerock/sdk-types

pnpm add https://pkg.pr.new/@forgerock/sdk-types@739

@forgerock/sdk-utilities

pnpm add https://pkg.pr.new/@forgerock/sdk-utilities@739

@forgerock/iframe-manager

pnpm add https://pkg.pr.new/@forgerock/iframe-manager@739

@forgerock/sdk-logger

pnpm add https://pkg.pr.new/@forgerock/sdk-logger@739

@forgerock/sdk-oidc

pnpm add https://pkg.pr.new/@forgerock/sdk-oidc@739

@forgerock/sdk-request-middleware

pnpm add https://pkg.pr.new/@forgerock/sdk-request-middleware@739

@forgerock/storage

pnpm add https://pkg.pr.new/@forgerock/storage@739

commit: aa0bb8a

[github-actions]

Deployed f2bcf1b to https://ForgeRock.github.io/ping-javascript-sdk/pr-739/f2bcf1b3dfcaec97646a2195015eeda3a9e85f45 branch gh-pages in ForgeRock/ping-javascript-sdk

[github-actions]

📦 Bundle Size Analysis

📦 Bundle Size Analysis

🆕 New Packages

🆕 @forgerock/journey-client - 92.6 KB (new)
🆕 @forgerock/journey-client - 0.0 KB (new)
🆕 @forgerock/device-client - 10.0 KB (new)
🆕 @forgerock/device-client - 0.0 KB (new)

➖ No Changes

➖ @forgerock/sdk-utilities - 18.6 KB
➖ @forgerock/recognize - 4284.4 KB
➖ @forgerock/sdk-request-middleware - 4.6 KB
➖ @forgerock/iframe-manager - 3.2 KB
➖ @forgerock/sdk-oidc - 5.7 KB
➖ @forgerock/storage - 1.5 KB
➖ @forgerock/sdk-logger - 1.6 KB
➖ @forgerock/oidc-client - 35.4 KB
➖ @forgerock/sdk-types - 9.1 KB
➖ @forgerock/davinci-client - 59.1 KB
➖ @forgerock/protect - 144.6 KB

---

15 packages analyzed • Baseline from latest main build

Legend

🆕 New package
🔺 Size increased
🔻 Size decreased
➖ No change

ℹ️ How bundle sizes are calculated

• Current Size: Total gzipped size of all files in the package's dist directory
• Baseline: Comparison against the latest build from the main branch
• Files included: All build outputs except source maps and TypeScript build cache
• Exclusions: .map, .tsbuildinfo, and .d.ts.map files

---

_{🔄 Updated automatically on each push to this PR}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 24.11%. Comparing base (eafe277) to head (aa0bb8a).
⚠️ Report is 107 commits behind head on main.

❌ Your project status has failed because the head coverage (24.11%) is below the target coverage (40.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #739      +/-   ##
==========================================
+ Coverage   18.07%   24.11%   +6.03%     
==========================================
  Files         155      162       +7     
  Lines       24398    25787    +1389     
  Branches     1203     1686     +483     
==========================================
+ Hits         4410     6218    +1808     
+ Misses      19988    19569     -419     

see 18 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nx-cloud]

Nx Cloud has identified a possible root cause for your failed CI:

We classified this failure as an environment issue rather than a code regression. All 4 tests time out at the identical first UI step and the cleanup teardown also fails reaching the external PingOne DaVinci API, indicating the external service was unavailable during the CI run. The PR contains only a lockfile change with no application source modifications, so no code fix is possible or warranted.

No code changes were suggested for this issue.

Trigger a rerun:

View detailed reasoning on Nx Cloud ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}