Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
upgrade github.com/golang-jwt/jwt package to fix CVE-2024-51744
My investigation indicates that neither our code, nor our dependencies use the functions in question, but at the same time, the impact of upgrading them is minimal, so it feels like the less risky path to just upgrade and not have to worry. This seems to be related to the issue that caused CVE-2024-45338, and I think the fix is ultimately the same, but snyk insists that the old version of golang-jwt/jwt is susceptible, despite us having upgraded to x/net/html package previously. Perhaps they cut and pasted some code or something. Either way, let's fix it up. BACK-3351
- Loading branch information