[dependencies] update go version to 1.22 and update vulnerable depend…

…encies

Dockerfile

@@ -4,7 +4,7 @@
 # container for this image, the desired binary must be specified (either
 # /usr/bin/core-service or /usr/bin/db-manager).
 
-FROM golang:1.17-alpine AS build
+FROM golang:1.22-alpine AS build
 RUN apk add build-base
 RUN apk add git bash make
 RUN mkdir /app

build/test-certs/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.17-alpine
+FROM golang:1.22-alpine
 
 WORKDIR /go/src/app
 

cmds/dummy-oauth/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.17-alpine AS build
+FROM golang:1.22-alpine AS build
 RUN apk add git bash make
 RUN mkdir /app
 WORKDIR /app

go.mod

@@ -1,24 +1,24 @@
 module github.com/interuss/dss
 
-go 1.17
+go 1.22
 
 require (
 	cloud.google.com/go/profiler v0.4.0
 	github.com/cockroachdb/cockroach-go/v2 v2.2.8
 	github.com/coreos/go-semver v0.3.0
+	github.com/go-jose/go-jose/v3 v3.0.3
 	github.com/golang-jwt/jwt v3.2.1+incompatible
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551
 	github.com/google/uuid v1.3.0
 	github.com/interuss/stacktrace v1.0.0
-	github.com/jackc/pgconn v1.11.0
-	github.com/jackc/pgtype v1.10.0
-	github.com/jackc/pgx/v4 v4.15.0
+	github.com/jackc/pgconn v1.14.3
+	github.com/jackc/pgtype v1.14.0
+	github.com/jackc/pgx/v4 v4.18.2
 	github.com/jonboulle/clockwork v0.2.3
 	github.com/pkg/errors v0.9.1
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/stretchr/testify v1.8.1
 	go.uber.org/zap v1.21.0
-	gopkg.in/square/go-jose.v2 v2.6.0
 )
 
 require (
@@ -36,19 +36,19 @@ require (
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.2.0 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b // indirect
-	github.com/jackc/puddle v1.2.1 // indirect
+	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/puddle v1.3.0 // indirect
 	github.com/lib/pq v1.10.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
-	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/crypto v0.21.0 // indirect
+	golang.org/x/net v0.21.0 // indirect
 	golang.org/x/oauth2 v0.8.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/api v0.128.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect

interfaces/openapi-to-go-server/example/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.17-alpine
+FROM golang:1.22-alpine
 
 WORKDIR /go/src/server_demo
 COPY . .

pkg/auth/auth.go

@@ -14,13 +14,13 @@ import (
 	"sync"
 	"time"
 
+	"github.com/go-jose/go-jose/v3"
 	"github.com/golang-jwt/jwt"
 	"github.com/interuss/dss/pkg/api"
 	dsserr "github.com/interuss/dss/pkg/errors"
 	"github.com/interuss/dss/pkg/logging"
 	"github.com/interuss/stacktrace"
 	"go.uber.org/zap"
-	"gopkg.in/square/go-jose.v2"
 )
 
 // KeyResolver abstracts resolving keys.