fix(deps): update external fixes

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@aws-sdk/s3-request-presigner (source)	3.1103.0 → 3.1116.0
@cloudflare/workers-types	5.20260804.1 → 5.20260822.1
jose	6.2.8 → 6.2.10

---

Release Notes

aws/aws-sdk-js-v3 (@​aws-sdk/s3-request-presigner)

v3.1116.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1115.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1114.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1113.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1112.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1111.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1110.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1109.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1108.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1107.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1106.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1105.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

v3.1104.0

Compare Source

Note: Version bump only for package @​aws-sdk/s3-request-presigner

cloudflare/workerd (@​cloudflare/workers-types)

v5.20260822.1

Compare Source

v5.20260821.1

Compare Source

v5.20260820.1

Compare Source

v5.20260819.1

Compare Source

v5.20260818.1

Compare Source

v5.20260817.1

Compare Source

v5.20260816.1

Compare Source

v5.20260815.1

Compare Source

v5.20260814.1

Compare Source

v5.20260813.1

Compare Source

v5.20260812.1

Compare Source

v5.20260811.1

Compare Source

v5.20260810.1

Compare Source

v5.20260809.1

Compare Source

v5.20260808.1

Compare Source

v5.20260807.2

Compare Source

panva/jose (jose)

v6.2.10

Compare Source

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Compare Source

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 2pm on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!