bump jose dependency to >= 0.2.38.0