Support jwt gem 3.x alongside 2.x

[dan98765]

Changes

Widens the jwt runtime dependency from ~> 2.7 (which caps at < 3.0) to >= 2.7, < 4.0. This lets consumers that depend on both auth0 and a gem requiring jwt 3.x (e.g. workos >= 6.0) resolve without conflicts.

No code changes — just the gemspec constraint and the lockfile.

References

• Support jwt gem version 3 #690 — community request for jwt 3.x support
• jwt 3.0 changelog
• The workos gem pinned jwt ~> 3.1 starting at v6.0, making it impossible to use workos >= 6 with auth0 today

Testing

Ran the full test suite (bundle exec rake test) on Ruby 3.3.9 with jwt 3.1.2 resolved:

• 1040 unit examples, 0 failures
• 164 integration examples, 0 failures (1 pending — pre-existing)
• Line coverage: 99.56%

No new tests needed since this is a dependency constraint change and all existing JWT-related tests already pass against 3.x.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of Ruby

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors
• Rubocop passes on all added/modified files (note: rubocop fails to start due to a pre-existing config issue in .rubocop_todo.yml — Metrics/LineLength renamed to Layout/LineLength — unrelated to this change)
• All active GitHub checks have passed