Update dependency jsonwebtoken to v9 (master) #13
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^8.2.0
->^9.0.0
By merging this PR, the below vulnerabilities will be automatically resolved:
Release Notes
auth0/node-jsonwebtoken (jsonwebtoken)
v9.0.0
Compare Source
Breaking changes: See Migration from v8 to v9
Breaking changes
8345030
]auth0/node-jsonwebtoken@8345030)ecdf6cc
]auth0/node-jsonwebtoken@ecdf6cc)Security fixes
Arbitrary File Write via verify function
- CVE-2022-23529Insecure default algorithm in jwt.verify() could lead to signature validation bypass
- CVE-2022-23540Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
- CVE-2022-23541Unrestricted key type could lead to legacy keys usage
- CVE-2022-23539