Upgrade to jwt 3.x

[dan-manges]

I am integrating WorkOS into RWX. I added workos to my Gemfile:

gem "workos"

And I realized today that bundler installed version 5.6.0, which is about 1 year old. Version 5.24.0 is the latest.

It appears to have done this because version 5.24.0 requires jwt 2.x

workos-ruby/workos.gemspec

Line 25 in 4d8a2ba

spec.add_dependency 'jwt', '~> 2.8'

My project was already using jwt 3.x, and I'd rather not downgrade jwt to use the latest workos.

WorkOS 5.6.0 doesn't have a dependency on jwt at all, which is presumably why bundler selected that version.

https://github.com/workos/workos-ruby/blob/v5.6.0/workos.gemspec

[gjtorikian]

This is done as of v6!

[raldred]

@gjtorikian

We're in the opposite situation at the moment, trying to upgrade to get the UserManagement improvements.
This upgrade is too strict and conflicting with other gems in use in our platform, so we're currently tied to workos 5.6.0

Could this be relaxed a little to be >= 2.8 if there's no specific need for 3? Whilst it does bring some good improvements, other gems we rely on aren't in a position to support it.

[gjtorikian]

I'm not strictly opposed to it, but I'm a bit hesitant to do so, because the 2.x series had more lax security, and that's just not good for anyone. I'd honestly rather run around and open PRs for the other gems in your dependency list to upgrade to JWT 3.x; can you provide me with a list of those and I'll see if I can't nudge them along?

Otherwise, which user management APIs do you need? I can try to backport them as a one-off to get you unblocked.

[raldred]

Absolutely, I agree completely. So please if you're not comfortable, don't change anything.
I appreciate the consideration.

We're migrating part of our system from Auth0, their Ruby SDK is current targeting 'jwt', '~> 2.7'. There's is an open feature request to support 3, but they move slowly.

We would like to leverage metadata on users, which is not supported by create/update user calls on 5.6.0. At the moment I've worked around it by calling the endpoint directly which is fine for our use case really.