[Snyk] Security upgrade node-jose from 2.0.0 to 2.1.0

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	566/1000 Why? Recently disclosed, Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	No	No Known Exploit
	651/1000 Why? Recently disclosed, Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	No	No Known Exploit
	566/1000 Why? Recently disclosed, Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-jose

The new version differs by 26 commits.

• 38dc55c Merge pull request #345 from justaugustus/release-v2.1.0
• de3ea9f v2.1.0: Release commit
• 427c640 Merge pull request #344 from justaugustus/dep-fixes
• 5538311 package.json: Replace `gulp-util` with `fancy-log`
• 653c629 Merge pull request #342 from justaugustus/dep-fixes
• 34a66ca .github: Add baseline dependabot config
• dd1b68b package.json: Dependency updates
• f626e9d lib/jwk: Explicitly use uuid v4
• 10cc052 package.json: Update to uuid@v8.3.2
• 7d430f2 package.json: Dependency updates
• 8757eb7 generated: Run `npm update`
• ae5a809 Merge pull request #340 from cisco/dependabot/npm_and_yarn/cached-path-relative-1.1.0
• 90a3637 build(deps): bump cached-path-relative from 1.0.2 to 1.1.0
• 81d35de Merge pull request #339 from cisco/fluffy-dep1
• ce03583 upgrade to node-forge 1.2.1
• 5464642 Merge pull request #334 from cisco/dependabot/npm_and_yarn/node-forge-1.0.0
• 69ec9f2 Merge pull request #313 from TechTeamer/fix/decrypt-default-options
• 20515e5 Merge pull request #326 from dlh3/patch-1
• 6e1bdc8 build(deps): bump node-forge from 0.10.0 to 1.0.0
• afafbe1 Merge pull request #328 from bloxsome/develop
• 43045fe updated changelog and incremented package.json
• 683eed7 dependency update
• 9a1b1fb Minor README example fixes
• 58bd293 add test case

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.