chore(deps): Update dependency com.auth0:java-jwt to v4.6.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.auth0:java-jwt	4.6.0 → 4.6.1

---

Release Notes

auth0/java-jwt (com.auth0:java-jwt)

v4.6.1

Compare Source

Full Changelog

Added

• chore: update bouncycastle #​801 (tanya732)
• Bump com.fasterxml.jackson.core:jackson-core from 2.22.1 to 2.22.2 in /lib #​797 (dependabot[bot])
• chore: remove unused imports #​794 (Zichen1028)

---

Configuration

📅 Schedule: (in timezone Asia/Seoul)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Claude finished @renovate[bot]'s task in 1m 13s —— View job

---

🤖 Claude 의존성 영향도 분석

• 변경 파일 및 lockfile diff 확인
• q-asker 코드 사용처 grep 검색
• 영향도 판단 및 보고서 작성

---

📦 변경점 요약

• com.auth0:java-jwt 4.6.0 → 4.6.1 (patch)
• 핵심 변경 내용:
  • bouncycastle 의존성 업데이트 (보안 패치)
  • jackson-core 2.22.1 → 2.22.2 범프
  • 미사용 import 제거 (코드 정리 only)
• Transitive 의존성 변화: lockfile diff 없음 — Renovate가 lockfile을 재생성하지 않아 아래 주의사항 참고

---

🎯 Q-Asker 영향도: 🟢 LOW

사용처:

• modules/auth/impl/.../component/JwtProvider.java — JWT 서명(JWT.create(), Algorithm.HMAC512) 및 검증(JWT.require(), JWTVerificationException) 단일 진입점에서 직접 사용
• modules/auth/impl/.../filter/JwtTokenAuthenticationFilterTest.java — 테스트에서 JWT, Algorithm 직접 사용

예상 영향:

• API 변경 없는 patch 업데이트이므로 기존 sign(), verifyAndExtractUserId() 동작에 영향 없음
• bouncycastle 업데이트는 내부 암호화 라이브러리 교체로, HMAC512 서명·검증 결과물(JWT 형식·클레임)은 동일하게 유지됨

---

⚠️ 주의: Lockfile 드리프트 감지

gradle/libs.versions.toml은 4.6.1로 업데이트됐으나, 아래 lockfile들은 아직 4.6.0을 참조 중:

modules/auth/impl/gradle.lockfile  → com.auth0:java-jwt:4.6.0
app/gradle.lockfile                → com.auth0:java-jwt:4.6.0

CLAUDE.md에 따르면 "drift 발생 시 빌드 실패" — CI가 compileJava 단계에서 실패할 가능성이 있음. Renovate는 버전 카탈로그만 업데이트하고 lockfile 재생성을 수행하지 않으므로, 머지 전 아래 커맨드로 lockfile을 갱신해야 함:

./gradlew resolveAndLockAll --write-locks

---

✅ 권장 액션

• CI green 확인 (lockfile 드리프트로 인해 빌드 실패 가능성 있음)
• 실패 시 ./gradlew resolveAndLockAll --write-locks 실행 후 lockfile 커밋
• patch 업데이트이므로 별도 기능 검증 불필요

📋 참고

• Release Notes: PR 본문 참조
• 분석 모델: claude-sonnet-4-6

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: gradle/libs.versions.toml

Command failed: ./gradlew -Dorg.gradle.jvmargs=-Xms512m -Xmx512m --console=plain --dependency-verification lenient -q properties

FAILURE: Build failed with an exception.

* Where:
Build file '/tmp/renovate/repos/github/q-asker/api/build.gradle' line: 3

* What went wrong:
Plugin [id: 'com.vanniktech.dependency.graph.generator', version: '0.8.0'] was not found in any of the following sources:

- Gradle Core Plugins (plugin is not in 'org.gradle' namespace)
- Included Builds (No included builds contain this plugin)
- Plugin Repositories (could not resolve plugin artifact 'com.vanniktech.dependency.graph.generator:com.vanniktech.dependency.graph.generator.gradle.plugin:0.8.0')
  Searched in the following repositories:
    Gradle Central Plugin Repository

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 33s