Upgrade jwt library #387
Upgrade jwt library #387
Conversation
andygrunwald#343 https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12
There was a problem hiding this comment.
Hey @benjivesterby @andygrunwald sorry to be that annoying person :) but this seems to address CVE-2020-26160 and since this is a very used library the update might pluck several holes for people :)
Hey Horacio, long time. Looks good to me, if the tests pass I'll merge it. |
tx a lot, nice to find you here in a stranger's PR :) hope to bump in person again :D |
Fixes #343
https://github.com/dgrijalva/jwt-go has been abondoned (see dgrijalva/jwt-go#462). In order to fix the vulnarability we have to switch to a community driven fork https://github.com/golang-jwt/jwt . The issue has been fixed in golang-jwt/jwt#12