update to node-jws 3.0.0

[gitawego]

jws is updated to 3.0.0 to mitigate a critical security flaw, hope you can update jws asap.

https://github.com/brianloveswords/node-jws/blob/master/CHANGELOG.md

thx a lot

[jfromaniello]

If you look at the link in that changelog you will see that it is our own blog post.

We fixed this library (and many others) before we even published the blog post.

We are validating the alg in the verify method in this library already here:
https://github.com/auth0/node-jsonwebtoken/blob/master/index.js#L140-L142

If you don't specify algorithms to the verify method, we do some heuristic in the secret you provide:

https://github.com/auth0/node-jsonwebtoken/blob/master/index.js#L110-L118

[gitawego]

wow, nice. thx a lot :)

[dschenkelman]

Thanks for taking the time to report 😄