chore(deps): bump jsonwebtoken from 9.3.1 to 11.0.0 in /server - #129
chore(deps): bump jsonwebtoken from 9.3.1 to 11.0.0 in /server#129dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [jsonwebtoken](https://github.com/Keats/jsonwebtoken) from 9.3.1 to 11.0.0. - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v9.3.1...v11.0.0) --- updated-dependencies: - dependency-name: jsonwebtoken dependency-version: 11.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependabot #129 stalled on jsonwebtoken 10, which introduced a required crypto-backend feature choice that broke the build. Bumps straight to 11 with the `rust_crypto` backend (a pure-Rust implementation, needed to keep the arm64 cross-compile for the Pi image working without a system OpenSSL/ring toolchain). Validation semantics in access_jwt.rs are byte-identical: RS256-only `Validation::new(Algorithm::RS256)`, `set_issuer`/`set_audience`/ `set_required_spec_claims(["exp","aud","iss"])`, and the fail-open JWKS-unavailable path are all unchanged -- no source edits were needed beyond the manifest bump. Added a new unit test, `wrong_algorithm_rejected`, covering the classic alg-confusion case (HS256-signed token against the RS256-only verifier) alongside the existing valid/expired/wrong-aud/wrong-iss/tampered/unknown-kid/ cold-cache coverage. The jsonwebtoken advisory this closes is MEDIUM (fixed in 10.3.0, superseded here by 11); the repo's one HIGH advisory is a separate, unrelated react-router (UI) finding -- follow-up ticket, not touched here. Supersedes dependabot#129. Closes JEF-595 Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
Superseded by #153 (JEF-595): jsonwebtoken upgraded to 11.0.0 with the |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps jsonwebtoken from 9.3.1 to 11.0.0.
Changelog
Sourced from jsonwebtoken's changelog.
Commits
900010fBump v116aac5aeAllow deserializing unknown key type JWKs (#530)e7ea8f0Implement Default on JwkSet (#527)249f5f7Don't panic when computing thumbprint (#524)b5d9c38Prepare for v11 release (#522)6086da7Unify encoding and decoding key APIs (#515)474728fRemove deprecatedinsecure_disable_signature_validation(#521)31a1dc6Feat: Added support for JWK decoding Ed25519 keys (#506)e681247feat: add Jwk::from_decoding_key (#475)bba16ebAllow conversion between Algorithm and KeyAlgorithm (#516)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)