Consider upgrading version of jwt-go to fix security vulnerability #343
Comments
|
Hi! Thank you for taking the time to create your first issue! Really cool to see you here for the first time. Please give us a bit of time to review it. |
|
@andygrunwald @ghostsquad Perhaps we should set up dependabot so that it can auto-pr package upgrades and merge if the CI passes? |
|
Everything is activated already. Is there anything else to do from our side? Is there a way to check if this vuln is already caught up by the bot? |
|
Hmm I'm not sure. Do you have it setup here? https://app.dependabot.com/accounts/andygrunwald |
|
Thanks @benjivesterby |
|
@andygrunwald no problem. I would suspect that it will auto-PR it. When I've had a security vuln pop on my libs before it took a couple days before dependabot updated. If not that we can keep an eye and do it manually. |
|
Thank you for your reactivity! |
|
@andygrunwald https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12 |
andygrunwald#343 https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12
andygrunwald#343 https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12
andygrunwald#343 https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12 (cherry picked from commit fff481a)
andygrunwald#343 https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12 (cherry picked from commit fff481a) Co-authored-by: Yar Krvtsov <[email protected]>
Hi,
The dependency jwt-go has a security vulnerability in all versions <4.0.0: dgrijalva/jwt-go#428 .
Please consider upgrading to the latest version (v4.0.0-preview1) or switching for another library.
Thanks!
The text was updated successfully, but these errors were encountered: