Upgrade jjwt 0.11.2 → 0.12.6

[devin-ai-integration]

Summary

Bumps jjwt-api/jjwt-impl/jjwt-jackson from 0.11.2 (2020) to 0.12.6, the latest release, and migrates DefaultJwtService off the APIs removed/deprecated in 0.12. Token format and signing behavior are unchanged.

API migration in DefaultJwtService:

-Jwts.builder().setSubject(id).setExpiration(exp).signWith(key)
+Jwts.builder().subject(id).expiration(exp).signWith(key)

-Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token)
-claimsJws.getBody().getSubject()
+Jwts.parser().verifyWith(key).build().parseSignedClaims(token)
+claimsJws.getPayload().getSubject()

Key construction is the subtle part. The old code built the key as
new SecretKeySpec(secret.getBytes(), SignatureAlgorithm.HS512.getJcaName()), i.e. it always tagged the key as HmacSHA512 regardless of the secret's actual length, and relied on 0.11's signWith(Key) picking the algorithm purely from key bit length. In 0.12, algorithm lookup for a SecretKey considers the key's JCA name and rejects it if the key is too short for that algorithm — so a sub-512-bit secret tagged HmacSHA512 no longer resolves to an algorithm. Replaced with Keys.hmacShaKeyFor(secret.getBytes()), which tags the key HmacSHA256/384/512 according to its actual length, preserving the algorithm 0.11 would have selected for any given secret (the configured 88-char secret still yields HS512). SignatureAlgorithm (deprecated in 0.12) is no longer referenced.

Verification

• ./gradlew clean test — 68 tests, 0 failures (includes DefaultJwtServiceTest, plus the API tests that exercise auth end-to-end).
• ./gradlew spotlessCheck — passes.
  Note: spotlessCheck and jacocoTestCoverageVerification both fail on main in this environment (google-java-format needs --add-exports on JDK 17; coverage sits at 0.33 vs the 0.80 rule) — both are pre-existing and unrelated; CI runs clean test -x jacocoTestCoverageVerification.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/24e6605322a84c5ca158b576b5ebd66f
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring