From 70862cb9e4ab6dbccb2f5699ff3313533fd4d79e Mon Sep 17 00:00:00 2001
From: Jonathan Bernard <jonathan@jdbernard.com>
Date: Mon, 5 Oct 2026 20:59:26 -0500
Subject: [PATCH] Require BearSSL 0.3

---
 CHANGELOG.md                             |  6 ++++++
 jwt_full.nimble                          |  4 ++--
 src/main/jwt_full/private/crypto/pem.nim | 18 ++++++++----------
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cbbbadf..dd6df31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.1 - 2026-10-05
+
+### Changed
+
+- Require BearSSL 0.3.0 or newer and use its managed PEM decoder interface.
+
 ## 0.5.0 - 2026-09-29
 
 ### Added
diff --git a/jwt_full.nimble b/jwt_full.nimble
index eafcbc0..2b0afcb 100644
--- a/jwt_full.nimble
+++ b/jwt_full.nimble
@@ -1,6 +1,6 @@
 # Package
 
-version       = "0.5.0"
+version       = "0.5.1"
 author        = "Jonathan Bernard"
 description   = "Full JWT, JWS, JWE, and JWK implementation for Nim, compliant with RFCs 7515-7519."
 license       = "GPL-3.0-or-later"
@@ -9,7 +9,7 @@ srcDir        = "src/main"
 # Dependencies
 
 requires "nim >= 1.4.8"
-requires "bearssl"
+requires "bearssl >= 0.3.0"
 requires "https://github.com/yglukhov/bearssl_pkey_decoder"
 
 task unittest, "Run the unit test suites.":
diff --git a/src/main/jwt_full/private/crypto/pem.nim b/src/main/jwt_full/private/crypto/pem.nim
index 13b0ff4..ae1aa40 100644
--- a/src/main/jwt_full/private/crypto/pem.nim
+++ b/src/main/jwt_full/private/crypto/pem.nim
@@ -13,30 +13,28 @@ proc decodePem*(
   ) =
 
   var pemCtx: PemDecoderContext
-  pemDecoderInit(pemCtx)
+  pemCtx.init()
 
-  var offset: uint = 0
-  var bytesRemaining: uint = uint len(pem)
+  var offset = 0
   var readingObj = false
 
-  while bytesRemaining > 0:
-    let bytesRead = pemDecoderPush(pemCtx, unsafeAddr pem[offset], uint bytesRemaining)
+  while offset < pem.len:
+    let bytesRead = pemCtx.push(pem.toOpenArray(offset, pem.high))
     offset += bytesRead
-    bytesRemaining -= bytesRead
 
-    case pemDecoderEvent(pemCtx):
+    case pemCtx.lastEvent():
       of PEM_BEGIN_OBJ:
         if readingObj:
           raise newException(ValueError,
             "Invalid PEM: saw a second BEGIN before seeing END.")
 
-        if pemDecoderName(pemCtx) != expectedObjectName:
+        if pemCtx.banner() != expectedObjectName:
           raise newException(ValueError,
             "Invalid PEM: expected BEGIN " & expectedObjectName &
-            " but got BEGIN " & $pemDecoderName(pemCtx))
+            " but got BEGIN " & pemCtx.banner())
 
         readingObj = true
-        pemDecoderSetdest(pemCtx, callback, keyCtx)
+        pemCtx.setdest(callback, keyCtx)
 
       of PEM_END_OBJ:
         if readingObj: readingObj = false