Bump jwt dependency to support 3.x

getstream-ruby.gemspec から始めて、SDK の jwt encode/decode の呼び出し箇所を調べ、その後、既存のテストスイートを実行します。依存関係の制約が選択した jwt 3.x の範囲をサポートし、CI が jwt 3.x をカバーしたうえでテストに合格すれば完了です。

Summary

The current gemspec pins jwt ~> 2.0, which forces consumers to stay on the 2.x line and prevents adopting jwt 3.x in any Ruby app that depends on this gem.

# getstream-ruby.gemspec (v6.1.1)
spec.add_dependency 'jwt', '~> 2.0'

Motivation

The jwt 3.x line introduced several hardenings that apps may want to opt into:

• Rejection of nil/empty HMAC keys at sign and verify (related to CVE-2026-45363 / GHSA-c32j-vqhx-rx3x)
• Enforcement of RSA keys >= 2048 bits
• Stricter RFC 4648 base64 decoding
• Mandatory signature verification before payload access

For consumers already running jwt 3.x in production, adding getstream-ruby currently forces a downgrade, which (a) loses those hardenings and (b) leaves the app stuck on whichever 2.x patch line ends up being the resolved version.

Question

Is bumping the constraint to allow jwt 3.x (e.g. jwt, '>= 2.0', '< 4' or jwt, '~> 3.0') on the roadmap? Quick scan of the SDK usage of jwt suggests the encode/decode call sites should be compatible across 2.x and 3.x, but the maintainers will know best.

There's prior precedent for loosening a dependency constraint in this gem (dotenv — see #25 and #27), so this would follow a similar pattern.

Happy to open a PR with the constraint bump (+ CI matrix entry for jwt 3.x) if that would help.

Thanks!