Relax jwt dependency to support ruby-jwt 3.x (>= 2.0, < 4.0)

gemspec のランタイム依存関係から着手し、既存の encode/decode、webhook 署名検証、内部トークン生成のエントリーポイントを調査します。jwt の制約を緩和し、そのうえで両方のバージョンでこれらの動作が機能することを確認しながら、SDK を jwt 2.10.x および 3.1.x に対して検証します。

Summary

getstream-ruby 6.1.1 pins jwt (~> 2.0), which blocks applications from upgrading to ruby-jwt 3.x. Bundler cannot resolve a single bundle when the app (or other gems) require jwt 3.x.

Current behavior

From the published gem (6.1.1):

jwt (~> 2.0)   # resolves to 2.x only (e.g. 2.10.2)

Other common dependencies already allow jwt 3, e.g. googleauth uses jwt (>= 1.4, < 4.0). The blocker for a unified bundle is specifically getstream-ruby's upper bound.

Problem

• We cannot bundle update jwt to 3.x while using getstream-ruby.
• Ruby loads one jwt version per process; there is no supported way for the SDK to stay on 2.x while the host app uses 3.x.
• Workarounds (forking the gemspec, hand-editing Gemfile.lock) are fragile and unsupported.

Use case

We use getstream-ruby for Stream Chat (API client, webhooks, user upsert) and also use jwt directly elsewhere in the app (user tokens, CDN auth, etc.). We want to upgrade to jwt 3.x for security/maintenance alignment with the rest of the ecosystem, without dropping the official SDK.

Requested change

Relax the runtime dependency, for example:

# gemspec
s.add_runtime_dependency "jwt", ">= 2.0", "< 4.0"

Then verify the SDK against jwt 2.10.x and 3.1.x (encode/decode, webhook signature verification, any internal token generation).

Environment

• getstream-ruby: 6.1.1
• Ruby: 3.x (Rails 7.2 app)
• Current resolved jwt: 2.10.2 (due to ~> 2.0 constraint)