From 468945aae7a02f286e673cb33f14e98f2f7f3e25 Mon Sep 17 00:00:00 2001
From: dan98765 <3498629+dan98765@users.noreply.github.com>
Date: Tue, 5 May 2026 10:28:16 -0700
Subject: [PATCH] Support jwt gem 3.x alongside 2.x

Widen the jwt dependency from `~> 2.7` (which caps at < 3.0) to
`>= 2.7, < 4.0`.  This allows consumers that depend on both auth0 and
a gem requiring jwt 3.x (e.g. workos >= 6.0) to resolve without
conflicts.

Full test suite (1040 unit + 164 integration examples) passes on
jwt 3.1.2 / Ruby 3.3.9 with zero failures.

Closes #690
---
 Gemfile.lock  | 4 ++--
 auth0.gemspec | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index af52d8fa..50744b72 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -3,7 +3,7 @@ PATH
   specs:
     auth0 (5.18.1)
       addressable (~> 2.8)
-      jwt (~> 2.7)
+      jwt (>= 2.7, < 4.0)
       rest-client (~> 2.1)
       retryable (~> 3.0)
       zache (~> 0.12)
@@ -80,7 +80,7 @@ GEM
       concurrent-ruby (~> 1.0)
     io-console (0.8.2)
     json (2.19.4)
-    jwt (2.10.2)
+    jwt (3.1.2)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
diff --git a/auth0.gemspec b/auth0.gemspec
index 5978d9c5..a9e0e107 100644
--- a/auth0.gemspec
+++ b/auth0.gemspec
@@ -17,7 +17,7 @@ Gem::Specification.new do |s|
   s.require_paths = ['lib']
 
   s.add_runtime_dependency 'rest-client', '~> 2.1'
-  s.add_runtime_dependency 'jwt', '~> 2.7'
+  s.add_runtime_dependency 'jwt', '>= 2.7', '< 4.0'
   s.add_runtime_dependency 'zache', '~> 0.12'
   s.add_runtime_dependency 'addressable', '~> 2.8'
   s.add_runtime_dependency 'retryable', '~> 3.0'