From 3ccc00b4a2828ee28b26c4bbcf70753a5a2d57a8 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 17:00:57 +0000
Subject: [PATCH] Upgrade io.jsonwebtoken JJWT family 0.11.2 -> 0.12.6

---
 .../skills/java-engineering-excellence/SKILL.md  |  2 +-
 build.gradle                                     |  6 +++---
 .../service/DefaultJwtService.java               | 16 ++++++----------
 3 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/.agents/skills/java-engineering-excellence/SKILL.md b/.agents/skills/java-engineering-excellence/SKILL.md
index 677cfe0bf..ca4dcfc1a 100644
--- a/.agents/skills/java-engineering-excellence/SKILL.md
+++ b/.agents/skills/java-engineering-excellence/SKILL.md
@@ -82,7 +82,7 @@ ts-java-spring-boot-realworld/
 | `com.netflix.dgs.codegen` | 5.0.6 | 7.x+ |
 | `com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter` | 4.9.21 | 8.x+ (Boot 3 compatible) |
 | `org.mybatis.spring.boot:mybatis-spring-boot-starter` | 2.2.2 | 3.0.x |
-| `io.jsonwebtoken:jjwt-api` | 0.11.2 | 0.12.x |
+| `io.jsonwebtoken:jjwt-api` | 0.12.6 | already on 0.12.x |
 | `joda-time:joda-time` | 2.10.13 | remove → `java.time` |
 | `org.xerial:sqlite-jdbc` | 3.36.0.3 | 3.45.x+ |
 | `io.rest-assured:spring-mock-mvc` (test) | 4.5.1 | 5.4.x |
diff --git a/build.gradle b/build.gradle
index 03c56f755..33aee63a6 100644
--- a/build.gradle
+++ b/build.gradle
@@ -63,9 +63,9 @@ dependencies {
     implementation 'org.mybatis.spring.boot:mybatis-spring-boot-starter:2.2.2'
     implementation 'com.netflix.graphql.dgs:graphql-dgs-spring-boot-starter:4.9.21'
     implementation 'org.flywaydb:flyway-core'
-    implementation 'io.jsonwebtoken:jjwt-api:0.11.2'
-    runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.2',
-                'io.jsonwebtoken:jjwt-jackson:0.11.2'
+    implementation 'io.jsonwebtoken:jjwt-api:0.12.6'
+    runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.12.6',
+                'io.jsonwebtoken:jjwt-jackson:0.12.6'
     implementation 'joda-time:joda-time:2.10.13'
     implementation 'org.xerial:sqlite-jdbc:3.36.0.3'
 
diff --git a/src/main/java/io/spring/infrastructure/service/DefaultJwtService.java b/src/main/java/io/spring/infrastructure/service/DefaultJwtService.java
index 515d66106..95316ed04 100644
--- a/src/main/java/io/spring/infrastructure/service/DefaultJwtService.java
+++ b/src/main/java/io/spring/infrastructure/service/DefaultJwtService.java
@@ -3,13 +3,12 @@
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jws;
 import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.SignatureAlgorithm;
+import io.jsonwebtoken.security.Keys;
 import io.spring.core.service.JwtService;
 import io.spring.core.user.User;
 import java.util.Date;
 import java.util.Optional;
 import javax.crypto.SecretKey;
-import javax.crypto.spec.SecretKeySpec;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
@@ -17,22 +16,20 @@
 @Component
 public class DefaultJwtService implements JwtService {
   private final SecretKey signingKey;
-  private final SignatureAlgorithm signatureAlgorithm;
   private int sessionTime;
 
   @Autowired
   public DefaultJwtService(
       @Value("${jwt.secret}") String secret, @Value("${jwt.sessionTime}") int sessionTime) {
     this.sessionTime = sessionTime;
-    signatureAlgorithm = SignatureAlgorithm.HS512;
-    this.signingKey = new SecretKeySpec(secret.getBytes(), signatureAlgorithm.getJcaName());
+    this.signingKey = Keys.hmacShaKeyFor(secret.getBytes());
   }
 
   @Override
   public String toToken(User user) {
     return Jwts.builder()
-        .setSubject(user.getId())
-        .setExpiration(expireTimeFromNow())
+        .subject(user.getId())
+        .expiration(expireTimeFromNow())
         .signWith(signingKey)
         .compact();
   }
@@ -40,9 +37,8 @@ public String toToken(User user) {
   @Override
   public Optional<String> getSubFromToken(String token) {
     try {
-      Jws<Claims> claimsJws =
-          Jwts.parserBuilder().setSigningKey(signingKey).build().parseClaimsJws(token);
-      return Optional.ofNullable(claimsJws.getBody().getSubject());
+      Jws<Claims> claimsJws = Jwts.parser().verifyWith(signingKey).build().parseSignedClaims(token);
+      return Optional.ofNullable(claimsJws.getPayload().getSubject());
     } catch (Exception e) {
       return Optional.empty();
     }