chore(deps): update jwt requirement from ~> 2.8 to >= 2.8, < 4.0

[dependabot]

Updates the requirements on jwt to permit the latest version.

Changelog

Sourced from jwt's changelog.

v3.3.0 (2026-09-11)

Full Changelog

Features:

• Allow a leeway to be given for the iat claim verification #747 - (@​denis1011101)
• Revamp the error hierarchy under a new JWT::Error base class; signing failures now consistently raise JWT::EncodeError, see https://github.com/jwt/ruby-jwt/blob/main/UPGRADING.md #722 (@​anakinj)

Fixes and enhancements:

• Refactor JWT::JWK::Set#initialize so each construction path is a named method #758 (@​anakinj)
• Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip #728
• Fix the Style/DirectiveScope RuboCop offense failing the build #752
• Fix JWT::JWK::Set sharing its key collection with the set it was copied from #751
• Reset the decoded payload and verification state in JWT::EncodedToken#encoded_payload= #749
• Fix JWT::Token#detach_payload! not invalidating an already rendered token #748

v3.2.0 (2026-05-13)

Full Changelog

Features:

• Add enforce_hmac_key_length configuration option #716 - (@​304)

Fixes and enhancements:

• Reject nil and empty HMAC keys when signing and verifying (CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Fix compatibility with the openssl 4.0 gem #706
• Test against Ruby 4.0 on CI #707
• Fix type error when header is not a JSON object #715 - (@​304)

v3.1.2 (2025-06-28)

Full Changelog

Fixes and enhancements:

• Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697
• Fix signing with a EC JWK #699 (@​anakinj)

v3.1.1 (2025-06-24)

Full Changelog

Fixes and enhancements:

• Require the algorithm to be provided when signing and verifying tokens using JWKs #695 (@​anakinj)

... (truncated)

Commits

• ccf2489 Prepare the v3.3.0 release (#762)
• 6cdacc3 Enforce parentheses on method calls with arguments (#761)
• 4a576f8 Declutter jwt_spec.rb (#760)
• 7ddcb0a Fix the RSA-PSS guard skipping the whole jwt_spec file (#759)
• 7cede0c Refactor JWT::JWK::Set#initialize (#758)
• 6ab1be7 Revamp error hierarchy (#722)
• 41fbf31 Invalidate the rendered token when detaching the payload (#757)
• d8e231d Reset verification state when replacing the encoded payload (#756)
• c25fb5e Fix JWT::JWK::Set sharing its key collection when copied (#751)
• bec0ffd Isolate gem builds from release credentials (#755)
• Additional commits viewable in compare view

[VoxHash]

Closing: superseded by merged Dependabot updates and/or consolidated dependency fixes on main. Remaining major bumps that conflicted can be reopened later as focused PRs against dev.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.