Missing rockspec module declaration for new utils file with latest v0.3.1 release

[jesost]

It looks like I have issues with the v0.3.1 release. Should the new utils file be added to the modules in the rockspec file?

[chorcheus]

Confirmed, the rockspecs needs resty,utils include

[jpallari]

I also have issues with the latest release. I have not confirmed what is the exact cause of the issue, but the failures seem to occur during resty.jwt module import. Reverting back to 0.2.3 seems to have helped.

[Niklas-Flaig]

Having the exact same problem: version 0.3.1 is failing due to the broken resty.jwt import.
Notice, that the problem was my codebase dynamically installing the newest version of this library when building. So the build suddenly failed even though i didn't change anything in the setup.

Pinning the version in my Dockerfile to 0.2.3-0 resolves the Problem for now!

[HanadaLee]

Having the exact same problem: version 0.3.1 is failing due to the broken resty.jwt import. Notice, that the problem was my codebase dynamically installing the newest version of this library when building. So the build suddenly failed even though i didn't change anything in the setup.

Pinning the version in my Dockerfile to 0.2.3-0 resolves the Problem for now!

This is absolutely insane. I only discovered this serious issue when the service suddenly crashed during a CI/CD canary rollout upgrade. I hope it can be fixed as soon as possible. I've already locked the version to 0.2.3-0.

[jesost]

We went ahead and pinned our version at 0.2.4 as the utils file was added in the 0.3.0 release. Keep in mind that 0.2.4 fixed this CVE GHSA-vvpg-5wfc-53jj

[cdbattags]

Thanks for reporting this and apologies for the broken install. I've gone ahead and made a new test to capture this in the future!

v0.3.2 is out now and fixes the missing resty.utils module in the rockspec. You should be able to luarocks install lua-resty-jwt again without issues.

A note on versions and semver:

• v0.2.4 is the critical security fix for GHSA-vvpg-5wfc-53jj (authentication bypass via JWE header confusion). If you're pinning, please pin to >= 0.2.4, not 0.2.3 — reverting to 0.2.3 reintroduces the vulnerability.
• v0.3.0 is a minor version bump (new features: ECDH-ES key agreement, full JOSE algorithm coverage, etc.). Per semver, minor versions add functionality in a backward-compatible way. The utils.lua file was part of that new feature set.
• v0.3.1 / v0.3.2 are patch releases fixing issues within the 0.3.x line.

TL;DR upgrade to 0.3.2 if you can, otherwise pin to 0.2.4 (not 0.2.3) to stay patched.

Thanks @jesost for helping others!