build(deps): bump jwt from 2.10.1 to 2.10.3

[dependabot]

Bumps jwt from 2.10.1 to 2.10.3.

Changelog

Sourced from jwt's changelog.

Changelog

v3.2.1 (NEXT)

Full Changelog

Features:

• Your contribution here

Fixes and enhancements:

• Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip #728

v3.2.0 (2026-05-13)

Full Changelog

Features:

• Add enforce_hmac_key_length configuration option #716 - (@​304)

Fixes and enhancements:

• Reject nil and empty HMAC keys when signing and verifying (CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Fix compatibility with the openssl 4.0 gem #706
• Test against Ruby 4.0 on CI #707
• Fix type error when header is not a JSON object #715 - (@​304)

v3.1.2 (2025-06-28)

Full Changelog

Fixes and enhancements:

• Avoid using the same digest across calls in JWT::JWA::Ecdsa and JWT::JWA::Rsa #697
• Fix signing with a EC JWK #699 (@​anakinj)

v3.1.1 (2025-06-24)

Full Changelog

Fixes and enhancements:

• Require the algorithm to be provided when signing and verifying tokens using JWKs #695 (@​anakinj)

v3.1.0 (2025-06-23)

Full Changelog

... (truncated)

Commits

• a52e81d Version 2.10.3 (#726)
• 9820020 Backport to 2.x: Reject nil and empty HMAC keys (CVE-2026-45363) (#725)
• 658275c Version 2.10.2 (#703)
• 67dc9d3 Backport: Avoid using the same digest across calls (#697) (#701)
• c73c286 Simplify CI on 2.10 branch (#702)
• 7ff5f07 Fix deprecation messages
• See full diff in compare view

[coveralls]

Coverage Report for CI Build 27562877530

Coverage remained the same at 90.209%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	50272
Covered Lines:	46339
Line Coverage:	92.18%
Relevant Branches:	2284
Covered Branches:	1071
Branch Coverage:	46.89%
Branches in Coverage %:	Yes
Coverage Strength:	126.41 hits per line

---

💛 - Coveralls

[donny-wong]

@dependabot rebase

[donny-wong]

Reviewed the jwt 2.10.1 → 2.10.3 bump. The only behavioral change is CVE-2026-45363 (rejection of nil/empty HMAC keys). Grepped all JWT call sites — only two exist (lti_client.rb and lti_deployments_controller.rb), both using RS256, so the HMAC fix does not affect MarkUs.