Justification for accepting PR #524 for 0.6.0 when #481 (updating jwt-go version) was already included in 0.5.0?

It appears as though PR #524 was accepted and merged after #481 had already updated the `jwt-go` dependency to a later version; was there justification for this, or was this done in error, in which case #524 should be reverted?

Compare PR #524 with PR #481 and the dependency versions included in releases 0.5.0 and 0.6.0. Determine whether #524 duplicated or incorrectly superseded the earlier jwt-go update, then document the justification or the evidence needed for a revert decision.

Written by the indexing model from the issue text.