Description

This commit upgrades the ruby-jwt dependency to version 3.1, bringing improved security and RFC compliance.

• Upgraded jwt gem dependency from ~> 2.8 to ~> 3.1 in workos.gemspec
• Updated session test fixture to generate valid base64-encoded JWK data

The JWT 3.x series introduced stricter RFC 4648 compliance for base64 encoding/decoding, replacing the more lenient RFC 2045 standard used in 2.x. This provides better security and interoperability with other JWT implementations that follow the stricter standard.

Key improvements in JWT 3.x:

• Stricter base64 validation that rejects invalid padding and whitespace
• Proper base64 encoding/decoding for HMAC JWK keys (the 'k' parameter)
• Enhanced security through stricter validation

The test fixture in session_spec.rb was updated to use dynamically generated JWK data instead of hardcoded placeholder values. This change is both necessary and safe because:

Why Necessary: The old fixture used invalid base64 strings like "test_n", "test", etc. for RSA key parameters. JWT 3.x's stricter validation correctly rejects these as invalid base64, causing tests to fail during JWK parsing.

Why Safe: The new approach generates the jwks_hash from an actual RSA key pair using JWT::JWK.export, ensuring all base64-encoded fields (n, e, x5c, x5t#S256) contain valid cryptographic data. This makes the tests more realistic and robust, as they now use properly formatted JWKs that match what the production code would receive from WorkOS APIs.

The change maintains test isolation and determinism while ensuring compatibility with JWT 3.x's stricter validation.

All 376 existing tests pass with no modifications to production code, confirming that this upgrade is fully backward compatible with the WorkOS SDK's existing functionality.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.