Repository: lestrrat-go/jwx
Pull request #1055 (2024-01-10 07:26:42)

Bump kentaro-m/auto-assign-action from 1.2.5 to 1.2.6
Bumps [kentaro-m/auto-assign-action](https://github.com/kentaro-m/auto-assign-action) from 1.2.5 to 1.2.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/kentaro-m/auto-assign-action/releases">kentaro-m/auto-assign-action's releases</a>.</em></p>
<blockquote>
<h2>v1.2.6</h2>
<h2>Changes</h2>
<ul>
<li>fix: fix security issue (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/165">#165</a>) <a href="https://github.com/kentaro-m"><code>@​kentaro-m</code></a></li>
<li>chore(deps): update dependency prettier to v3.1.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/163">#163</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update actions/setup-node action to v4 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/158">#158</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update actions/checkout action to v4 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/152">#152</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.3.3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/162">#162</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.3.2 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/161">#161</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v3.1.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/160">#160</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update unit test packages (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/138">#138</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.2.2 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/151">#151</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency <code>@​vercel/ncc</code> to v0.38.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/156">#156</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency lint-staged to v13.3.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/150">#150</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency <code>@​vercel/ncc</code> to v0.38.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/149">#149</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency <code>@​octokit/webhooks-types</code> to v7.3.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/143">#143</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>fix(deps): update dependency <code>@​actions/core</code> to v1.10.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/148">#148</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v3.0.3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/147">#147</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency node to v16.20.2 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/142">#142</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency <code>@​octokit/webhooks-types</code> to v7 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/135">#135</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v3.0.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/141">#141</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/140">#140</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.1.6 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/139">#139</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency lint-staged to v13.2.3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/137">#137</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update node.js to v16.20.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/134">#134</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.1.3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/132">#132</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update node.js to v16.20.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/126">#126</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency ts-jest to v29.1.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/130">#130</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency <code>@​octokit/webhooks-types</code> to v6.11.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/129">#129</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v2.8.8 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/131">#131</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency lint-staged to v13.2.2 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/127">#127</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.0.4 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/128">#128</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5.0.3 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/125">#125</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency prettier to v2.8.7 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/123">#123</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency typescript to v5 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/122">#122</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>fix(deps): update dependency js-yaml to v3.14.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/121">#121</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>fix(deps): update dependency <code>@​actions/github</code> to v5.1.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/120">#120</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>fix(deps): update dependency <code>@​actions/core</code> to v1.10.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/119">#119</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update unit test packages to v29.5.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/118">#118</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
<li>chore(deps): update dependency lint-staged to v13.2.0 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/117">#117</a>) <a href="https://github.com/renovate"><code>@​renovate</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/ed73f90568ce37d22dbbd1a73983738fae329f53"><code>ed73f90</code></a> Release v1.2.6</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/d9cefc33ba0dafbe0480684e583f60e28e47e6d8"><code>d9cefc3</code></a> fix: fix security issue (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/165">#165</a>)</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/065886bc6ca26bf9079c3d001e61b701d51e3cd5"><code>065886b</code></a> chore(deps): update dependency prettier to v3.1.1 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/163">#163</a>)</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/32cd12a9ed2e599bc630c8b1426097b77cadbd64"><code>32cd12a</code></a> chore(deps): update actions/setup-node action to v4 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/158">#158</a>)</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/6fa192f98890d9aeb4f89cdf50039f846135a888"><code>6fa192f</code></a> chore(deps): update actions/checkout action to v4 (<a href="https://redirect.github.com/kentaro-m/auto-assign-action/issues/152">#152</a>)</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/2e506e393255dc00975f2ea7401d6e28f1e953ce"><code>2e506e3</code></a> chore(deps): update dependency typescript to v5.3.3</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/d02169562ad7dcbc0abf69235cd144fed41cc67c"><code>d021695</code></a> chore(deps): update dependency typescript to v5.3.2</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/6e3ae59def0049fdd7ea6017ff5f0a4e9065b5e1"><code>6e3ae59</code></a> chore(deps): update dependency prettier to v3.1.0</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/a747cca87363e7f166af6a2e1d75ea2c6d5ecfd2"><code>a747cca</code></a> chore(deps): update unit test packages</li>
<li><a href="https://github.com/kentaro-m/auto-assign-action/commit/07832310b23a3c576daee61930c1588a73170501"><code>0783231</code></a> chore(deps): update dependency typescript to v5.2.2</li>
<li>Additional commits viewable in <a href="https://github.com/kentaro-m/auto-assign-action/compare/v1.2.5...v1.2.6">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=kentaro-m/auto-assign-action&package-manager=github_actions&previous-version=1.2.5&new-version=1.2.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

codecov[bot]: ## [Codecov](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) Report
Attention: `4 lines` in your changes are missing coverage. Please review.
> Comparison is base [(`0a15b4d`)](https://app.codecov.io/gh/lestrrat-go/jwx/commit/0a15b4d9a180b06c6924c4a03b39ae70d05514f4?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) 72.00% compared to head [(`eb16cf9`)](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) 72.24%.
> Report is 26 commits behind head on develop/v2.

| [Files](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) | Patch % | Lines |
|---|---|---|
| [jwe/jwe.go](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go#diff-andlL2p3ZS5nbw==) | 91.17% | [2 Missing and 1 partial :warning: ](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) |
| [jwe/options\_gen.go](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go#diff-andlL29wdGlvbnNfZ2VuLmdv) | 88.88% | [1 Missing :warning: ](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go) |

<details><summary>Additional details and impacted files</summary>


```diff
@@              Coverage Diff               @@
##           develop/v2    #1055      +/-   ##
==============================================
+ Coverage       72.00%   72.24%   +0.24%     
==============================================
  Files              93       93              
  Lines           13795    13855      +60     
==============================================
+ Hits             9933    10010      +77     
+ Misses           3044     3030      -14     
+ Partials          818      815       -3     
```



</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/lestrrat-go/jwx/pull/1055?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=lestrrat-go).


Patch:
diff --git a/.github/workflows/assign-pr.yml b/.github/workflows/assign-pr.yml
index 4405c6d0..0b1cf97d 100644
--- a/.github/workflows/assign-pr.yml
+++ b/.github/workflows/assign-pr.yml
@@ -7,6 +7,6 @@ jobs:
   add-reviews:
     runs-on: ubuntu-latest
     steps:
-      - uses: kentaro-m/auto-assign-action@v1.2.5
+      - uses: kentaro-m/auto-assign-action@v1.2.6
         with:
           configuration-path: .github/auto-assign-pr.yml
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index de9619f5..052cae4c 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -19,12 +19,13 @@ jobs:
       - run: |
           bazel build //...
       - run: |
+          git config --local user.name 'Daisuke Maki'
           git config --local user.email '41898282+github-actions[bot]@users.noreply.github.com'
           git add .
           git commit -m "Run tidy / bazel+gazelle"
-          git push
+          git push origin ${{ github.ref_name }}
           gh pr review --approve "$PR_URL"
           gh pr merge --auto --merge "$PR_URL"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
+https://github.com/endeworks/gihyo/pull/127          PR_URL: ${{github.event.pull_request.html_url}}
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
diff --git a/Changes b/Changes
index 385e45a7..7c6ae61b 100644
--- a/Changes
+++ b/Changes
@@ -4,6 +4,17 @@ Changes
 v2 has many incompatibilities with v1. To see the full list of differences between
 v1 and v2, please read the Changes-v2.md file (https://github.com/lestrrat-go/jwx/blob/develop/v2/Changes-v2.md)
 
+v2.0.20 UNRELEASED
+[New Features]
+  * [jwe] Added jwe.Settings(WithMaxBufferSize(int64)) to set the maximum size of
+    internal buffers. The default value is 256MB. Most users do not need to change
+    this value.
+
+[Miscellaneous]
+  * Internal key conversions should now allow private keys to be used in place of
+    public keys. This would allow you to pass private keys where public keys are
+    expected.
+
 v2.0.19 09 Jan 2024
 [New Features]
   * [jws] Added jws.IsVerificationError to check if the error returned by `jws.Verify`
diff --git a/deps.bzl b/deps.bzl
index 25d35d92..0204ed5c 100644
--- a/deps.bzl
+++ b/deps.bzl
@@ -115,8 +115,8 @@ def go_dependencies():
         name = "org_golang_x_crypto",
         build_file_proto_mode = "disable_global",
         importpath = "golang.org/x/crypto",
-        sum = "h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=",
-        version = "v0.17.0",
+        sum = "h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=",
+        version = "v0.18.0",
     )
 
     go_repository(
@@ -131,15 +131,15 @@ def go_dependencies():
         name = "org_golang_x_sys",
         build_file_proto_mode = "disable_global",
         importpath = "golang.org/x/sys",
-        sum = "h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=",
-        version = "v0.15.0",
+        sum = "h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=",
+        version = "v0.16.0",
     )
     go_repository(
         name = "org_golang_x_term",
         build_file_proto_mode = "disable_global",
         importpath = "golang.org/x/term",
-        sum = "h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=",
-        version = "v0.15.0",
+        sum = "h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=",
+        version = "v0.16.0",
     )
 
     go_repository(
diff --git a/examples/go.mod b/examples/go.mod
index 5e3c0f5a..bc2ea2f6 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -3,7 +3,7 @@ module github.com/lestrrat-go/jwx/v2/examples
 go 1.16
 
 require (
-	github.com/cloudflare/circl v1.3.3
+	github.com/cloudflare/circl v1.3.7
 	github.com/lestrrat-go/jwx/v2 v2.0.11
 )
 
diff --git a/examples/go.sum b/examples/go.sum
index 67772b16..fea8efdc 100644
--- a/examples/go.sum
+++ b/examples/go.sum
@@ -1,6 +1,6 @@
 github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
-github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -35,15 +35,14 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -55,22 +54,20 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
diff --git a/go.mod b/go.mod
index e8fe7dc8..b6156e82 100644
--- a/go.mod
+++ b/go.mod
@@ -11,13 +11,13 @@ require (
 	github.com/lestrrat-go/option v1.0.1
 	github.com/segmentio/asm v1.2.0
 	github.com/stretchr/testify v1.8.4
-	golang.org/x/crypto v0.17.0
+	golang.org/x/crypto v0.18.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/sys v0.16.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 6fabf723..e3210bba 100644
--- a/go.sum
+++ b/go.sum
@@ -24,10 +24,10 @@ github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/keyconv/keyconv.go b/internal/keyconv/keyconv.go
index 807da1de..f0ecbae1 100644
--- a/internal/keyconv/keyconv.go
+++ b/internal/keyconv/keyconv.go
@@ -18,7 +18,7 @@ func RSAPrivateKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
 		var raw rsa.PrivateKey
 		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce rsa.PrivateKey from %T: %w`, src, err)
+			return fmt.Errorf(`keyconv: failed to produce rsa.PrivateKey from %T: %w`, src, err)
 		}
 		src = &raw
 	}
@@ -30,7 +30,7 @@ func RSAPrivateKey(dst, src interface{}) error {
 	case *rsa.PrivateKey:
 		ptr = src
 	default:
-		return fmt.Errorf(`expected rsa.PrivateKey or *rsa.PrivateKey, got %T`, src)
+		return fmt.Errorf(`keyconv: expected rsa.PrivateKey or *rsa.PrivateKey, got %T`, src)
 	}
 
 	return blackmagic.AssignIfCompatible(dst, ptr)
@@ -41,21 +41,25 @@ func RSAPrivateKey(dst, src interface{}) error {
 // `src` may be rsa.PublicKey, *rsa.PublicKey, or a jwk.Key
 func RSAPublicKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
-		var raw rsa.PublicKey
-		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce rsa.PublicKey from %T: %w`, src, err)
+		pk, err := jwk.PublicRawKeyOf(jwkKey)
+		if err != nil {
+			return fmt.Errorf(`keyconv: failed to produce public key from %T: %w`, src, err)
 		}
-		src = &raw
+		src = pk
 	}
 
 	var ptr *rsa.PublicKey
 	switch src := src.(type) {
+	case rsa.PrivateKey:
+		ptr = &src.PublicKey
+	case *rsa.PrivateKey:
+		ptr = &src.PublicKey
 	case rsa.PublicKey:
 		ptr = &src
 	case *rsa.PublicKey:
 		ptr = src
 	default:
-		return fmt.Errorf(`expected rsa.PublicKey or *rsa.PublicKey, got %T`, src)
+		return fmt.Errorf(`keyconv: expected rsa.PublicKey/rsa.PrivateKey or *rsa.PublicKey/*rsa.PrivateKey, got %T`, src)
 	}
 
 	return blackmagic.AssignIfCompatible(dst, ptr)
@@ -67,7 +71,7 @@ func ECDSAPrivateKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
 		var raw ecdsa.PrivateKey
 		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce ecdsa.PrivateKey from %T: %w`, src, err)
+			return fmt.Errorf(`keyconv: failed to produce ecdsa.PrivateKey from %T: %w`, src, err)
 		}
 		src = &raw
 	}
@@ -79,7 +83,7 @@ func ECDSAPrivateKey(dst, src interface{}) error {
 	case *ecdsa.PrivateKey:
 		ptr = src
 	default:
-		return fmt.Errorf(`expected ecdsa.PrivateKey or *ecdsa.PrivateKey, got %T`, src)
+		return fmt.Errorf(`keyconv: expected ecdsa.PrivateKey or *ecdsa.PrivateKey, got %T`, src)
 	}
 	return blackmagic.AssignIfCompatible(dst, ptr)
 }
@@ -88,21 +92,25 @@ func ECDSAPrivateKey(dst, src interface{}) error {
 // non-pointer to a pointer
 func ECDSAPublicKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
-		var raw ecdsa.PublicKey
-		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce ecdsa.PublicKey from %T: %w`, src, err)
+		pk, err := jwk.PublicRawKeyOf(jwkKey)
+		if err != nil {
+			return fmt.Errorf(`keyconv: failed to produce public key from %T: %w`, src, err)
 		}
-		src = &raw
+		src = pk
 	}
 
 	var ptr *ecdsa.PublicKey
 	switch src := src.(type) {
+	case ecdsa.PrivateKey:
+		ptr = &src.PublicKey
+	case *ecdsa.PrivateKey:
+		ptr = &src.PublicKey
 	case ecdsa.PublicKey:
 		ptr = &src
 	case *ecdsa.PublicKey:
 		ptr = src
 	default:
-		return fmt.Errorf(`expected ecdsa.PublicKey or *ecdsa.PublicKey, got %T`, src)
+		return fmt.Errorf(`keyconv: expected ecdsa.PublicKey/ecdsa.PrivateKey or *ecdsa.PublicKey/*ecdsa.PrivateKey, got %T`, src)
 	}
 	return blackmagic.AssignIfCompatible(dst, ptr)
 }
@@ -111,13 +119,13 @@ func ByteSliceKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
 		var raw []byte
 		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce []byte from %T: %w`, src, err)
+			return fmt.Errorf(`keyconv: failed to produce []byte from %T: %w`, src, err)
 		}
 		src = raw
 	}
 
 	if _, ok := src.([]byte); !ok {
-		return fmt.Errorf(`expected []byte, got %T`, src)
+		return fmt.Errorf(`keyconv: expected []byte, got %T`, src)
 	}
 	return blackmagic.AssignIfCompatible(dst, src)
 }
@@ -145,11 +153,18 @@ func Ed25519PrivateKey(dst, src interface{}) error {
 
 func Ed25519PublicKey(dst, src interface{}) error {
 	if jwkKey, ok := src.(jwk.Key); ok {
-		var raw ed25519.PublicKey
-		if err := jwkKey.Raw(&raw); err != nil {
-			return fmt.Errorf(`failed to produce ed25519.PublicKey from %T: %w`, src, err)
+		pk, err := jwk.PublicRawKeyOf(jwkKey)
+		if err != nil {
+			return fmt.Errorf(`keyconv: failed to produce public key from %T: %w`, src, err)
 		}
-		src = &raw
+		src = pk
+	}
+
+	switch key := src.(type) {
+	case ed25519.PrivateKey:
+		src = key.Public()
+	case *ed25519.PrivateKey:
+		src = key.Public()
 	}
 
 	var ptr *ed25519.PublicKey
diff --git a/jwe/BUILD.bazel b/jwe/BUILD.bazel
index a5e3f4e0..d0a06f0d 100644
--- a/jwe/BUILD.bazel
+++ b/jwe/BUILD.bazel
@@ -25,6 +25,7 @@ go_library(
         "//internal/keyconv",
         "//internal/pool",
         "//jwa",
+        "//jwe/internal/aescbc",
         "//jwe/internal/cipher",
         "//jwe/internal/content_crypt",
         "//jwe/internal/keyenc",
diff --git a/jwe/internal/aescbc/aescbc.go b/jwe/internal/aescbc/aescbc.go
index acb5a83a..749277b9 100644
--- a/jwe/internal/aescbc/aescbc.go
+++ b/jwe/internal/aescbc/aescbc.go
@@ -10,18 +10,42 @@ import (
 	"errors"
 	"fmt"
 	"hash"
+	"sync/atomic"
 )
 
 const (
 	NonceSize = 16
 )
 
+const defaultBufSize int64 = 256 * 1024 * 1024
+
+// Grr, we would like to use atomic.Int64, but that's only available
+// from Go 1.19. Yes, we will cut support for Go 1.19 at some point,
+// but not today (probably going to up the minimum required Go version
+// some time after 1.22 is released)
+var maxBufSize int64
+
+func init() {
+	atomic.StoreInt64(&maxBufSize, defaultBufSize)
+}
+
+func SetMaxBufferSize(siz int64) {
+	if siz <= 0 {
+		siz = defaultBufSize
+	}
+	atomic.StoreInt64(&maxBufSize, siz)
+}
+
 func pad(buf []byte, n int) []byte {
 	rem := n - len(buf)%n
 	if rem == 0 {
 		return buf
 	}
 
+	mbs := atomic.LoadInt64(&maxBufSize)
+	if int64(len(buf)+rem) > mbs {
+		panic(fmt.Errorf("failed to allocate buffer"))
+	}
 	newbuf := make([]byte, len(buf)+rem)
 	copy(newbuf, buf)
 
@@ -174,6 +198,11 @@ func ensureSize(dst []byte, n int) []byte {
 // Seal fulfills the crypto.AEAD interface
 func (c Hmac) Seal(dst, nonce, plaintext, data []byte) []byte {
 	ctlen := len(plaintext)
+	bufsiz := ctlen + c.Overhead()
+	mbs := atomic.LoadInt64(&maxBufSize)
+	if int64(bufsiz) > mbs {
+		panic(fmt.Errorf("failed to allocate buffer"))
+	}
 	ciphertext := make([]byte, ctlen+c.Overhead())[:ctlen]
 	copy(ciphertext, plaintext)
 	ciphertext = pad(ciphertext, c.blockCipher.BlockSize())
diff --git a/jwe/jwe.go b/jwe/jwe.go
index 7c2905a0..ae1b8e3a 100644
--- a/jwe/jwe.go
+++ b/jwe/jwe.go
@@ -19,6 +19,7 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 
 	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwe/internal/aescbc"
 	"github.com/lestrrat-go/jwx/v2/jwe/internal/content_crypt"
 	"github.com/lestrrat-go/jwx/v2/jwe/internal/keyenc"
 	"github.com/lestrrat-go/jwx/v2/jwe/internal/keygen"
@@ -36,6 +37,8 @@ func Settings(options ...GlobalOption) {
 		switch option.Ident() {
 		case identMaxPBES2Count{}:
 			maxPBES2Count = option.Value().(int)
+		case identMaxBufferSize{}:
+			aescbc.SetMaxBufferSize(option.Value().(int64))
 		}
 	}
 }
diff --git a/jwe/options.yaml b/jwe/options.yaml
index bf7e0a01..2de7fdd1 100644
--- a/jwe/options.yaml
+++ b/jwe/options.yaml
@@ -138,4 +138,15 @@ options:
     comment: |
       WithMaxPBES2Count specifies the maximum number of PBES2 iterations
       to use when decrypting a message. If not specified, the default
-      value of 10,000 is used.
\ No newline at end of file
+      value of 10,000 is used.
+
+      This option has a global effect.
+  - ident: MaxBufferSize
+    interface: GlobalOption
+    argument_type: int64
+    comment: |
+      WithMaxBufferSize specifies the maximum buffer size for internal
+      calculations, such as when AES-CBC is performed. The default value is 256MB.
+      If set to an invalid value, the default value is used.
+
+      This option has a global effect.
\ No newline at end of file
diff --git a/jwe/options_gen.go b/jwe/options_gen.go
index b3de1320..3b74a8a9 100644
--- a/jwe/options_gen.go
+++ b/jwe/options_gen.go
@@ -129,6 +129,7 @@ type identFS struct{}
 type identKey struct{}
 type identKeyProvider struct{}
 type identKeyUsed struct{}
+type identMaxBufferSize struct{}
 type identMaxPBES2Count struct{}
 type identMergeProtectedHeaders struct{}
 type identMessage struct{}
@@ -166,6 +167,10 @@ func (identKeyUsed) String() string {
 	return "WithKeyUsed"
 }
 
+func (identMaxBufferSize) String() string {
+	return "WithMaxBufferSize"
+}
+
 func (identMaxPBES2Count) String() string {
 	return "WithMaxPBES2Count"
 }
@@ -245,9 +250,20 @@ func WithKeyUsed(v interface{}) DecryptOption {
 	return &decryptOption{option.New(identKeyUsed{}, v)}
 }
 
+// WithMaxBufferSize specifies the maximum buffer size for internal
+// calculations, such as when AES-CBC is performed. The default value is 256MB.
+// If set to an invalid value, the default value is used.
+//
+// This option has a global effect.
+func WithMaxBufferSize(v int64) GlobalOption {
+	return &globalOption{option.New(identMaxBufferSize{}, v)}
+}
+
 // WithMaxPBES2Count specifies the maximum number of PBES2 iterations
 // to use when decrypting a message. If not specified, the default
 // value of 10,000 is used.
+//
+// This option has a global effect.
 func WithMaxPBES2Count(v int) GlobalOption {
 	return &globalOption{option.New(identMaxPBES2Count{}, v)}
 }
diff --git a/jwt/openid/birthdate.go b/jwt/openid/birthdate.go
index c356d7f0..a193b403 100644
--- a/jwt/openid/birthdate.go
+++ b/jwt/openid/birthdate.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"math"
 	"regexp"
 	"strconv"
 
@@ -57,9 +58,22 @@ func (b *BirthdateClaim) UnmarshalJSON(data []byte) error {
 	return nil
 }
 
-func tointptr(v int64) *int {
-	i := int(v)
-	return &i
+var intSize int
+
+func init() {
+	switch math.MaxInt {
+	case math.MaxInt16:
+		intSize = 16
+	case math.MaxInt32:
+		intSize = 32
+	case math.MaxInt64:
+		intSize = 64
+	}
+}
+
+func parseBirthdayInt(s string) int {
+	i, _ := strconv.ParseInt(s, 10, intSize)
+	return int(i)
 }
 
 var birthdateRx = regexp.MustCompile(`^(\d{4})-(\d{2})-(\d{2})$`)
@@ -100,23 +114,23 @@ func (b *BirthdateClaim) Accept(v interface{}) error {
 		// we can assume that strconv.ParseInt always succeeds.
 		// strconv.ParseInt (and strconv.ParseUint that it uses internally)
 		// only returns range errors, so we should be safe.
-		year, _ := strconv.ParseInt(v[indices[2]:indices[3]], 10, 64)
+		year := parseBirthdayInt(v[indices[2]:indices[3]])
 		if year <= 0 {
 			return fmt.Errorf(`failed to parse birthdate year`)
 		}
-		tmp.year = tointptr(year)
+		tmp.year = &year
 
-		month, _ := strconv.ParseInt(v[indices[4]:indices[5]], 10, 64)
+		month := parseBirthdayInt(v[indices[4]:indices[5]])
 		if month <= 0 {
 			return fmt.Errorf(`failed to parse birthdate month`)
 		}
-		tmp.month = tointptr(month)
+		tmp.month = &month
 
-		day, _ := strconv.ParseInt(v[indices[6]:indices[7]], 10, 64)
+		day := parseBirthdayInt(v[indices[6]:indices[7]])
 		if day <= 0 {
 			return fmt.Errorf(`failed to parse birthdate day`)
 		}
-		tmp.day = tointptr(day)
+		tmp.day = &day
 
 		*b = tmp
 		return nil


Test patch:
diff --git a/jwe/jwe_test.go b/jwe/jwe_test.go
index 9559abcd..5f9a3bcb 100644
--- a/jwe/jwe_test.go
+++ b/jwe/jwe_test.go
@@ -959,3 +959,15 @@ func TestGHSA_7f9x_gw85_8grf(t *testing.T) {
 		}
 	}
 }
+
+func TestMaxBufferSize(t *testing.T) {
+	// NOTE: This has GLOBAL EFFECT
+	jwe.Settings(jwe.WithMaxBufferSize(1))
+	defer jwe.Settings(jwe.WithMaxBufferSize(0))
+
+	key, err := jwxtest.GenerateRsaJwk()
+	require.NoError(t, err, `jwxtest.GenerateRsaJwk should succeed`)
+
+	_, err = jwe.Encrypt([]byte("Lorem Ipsum"), jwe.WithContentEncryption(jwa.A128CBC_HS256), jwe.WithKey(jwa.RSA_OAEP, key))
+	require.Error(t, err, `jwe.Encrypt should fail`)
+}
diff --git a/jwe/options_gen_test.go b/jwe/options_gen_test.go
index d36b9765..b58d2362 100644
--- a/jwe/options_gen_test.go
+++ b/jwe/options_gen_test.go
@@ -16,6 +16,7 @@ func TestOptionIdent(t *testing.T) {
 	require.Equal(t, "WithKey", identKey{}.String())
 	require.Equal(t, "WithKeyProvider", identKeyProvider{}.String())
 	require.Equal(t, "WithKeyUsed", identKeyUsed{}.String())
+	require.Equal(t, "WithMaxBufferSize", identMaxBufferSize{}.String())
 	require.Equal(t, "WithMaxPBES2Count", identMaxPBES2Count{}.String())
 	require.Equal(t, "WithMergeProtectedHeaders", identMergeProtectedHeaders{}.String())
 	require.Equal(t, "WithMessage", identMessage{}.String())