Breaking change between v3.0.10 and v3.0.12: ES256K disabled by befault #1510
Description
I’ve encountered a backward-compatibility issue when upgrading from jwx v3.0.10 to v3.0.12.
In v3.0.12, the ES256K package is now disabled by default, and needs to be explicitly enabled using the build tag:
-tags jwx_es256k
Previously (v3.0.10), ES256K was enabled by default unless explicitly disabled, so upgrading results in unexpected breakage across multiple services and libraries that depend on jwx. This effectively introduces a breaking change in a patch release.
Expected Behavior
For backward compatibility, ES256K should remain enabled by default, and if a change is desired, it should instead introduce a disable_jwx_es256k tag to allow opting out.
Actual Behavior
ES256K is disabled by default starting in v3.0.12, causing builds to break unless the new tag is added manually.
Why This Is a Problem
Patch releases should not introduce breaking changes.
Suggested Resolution
Restore previous behavior by enabling ES256K by default, and introduce a new opt-out build tag (e.g., disable_jwx_es256k) if necessary. Then, if a user does not need ES256K, they can disable the external dependency by passing the disable_jwx_es256k build tag.