Replace square/go-jose by go-jose/go-jose
#13526
Comments
|
This deprecated dependency is from $ go mod why -m gopkg.in/square/go-jose.v2
# gopkg.in/square/go-jose.v2
github.com/canonical/lxd/client
github.com/zitadel/oidc/v2/pkg/client/rp
gopkg.in/square/go-jose.v2Is there any blocker that prevents us from moving to |
This is on my to-do list for this pulse 😃 |
simondeziel
added a commit
to simondeziel/lxd
that referenced
this issue
Jun 7, 2024
…jose/go-jose.v2 This buys us time until canonical#13526 is properly fixed. Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
|
#13566 is a temporary fix for the security issue but it would be nice to keep this issue around until a proper fix lands. |
tomponline
pushed a commit
to tomponline/lxd
that referenced
this issue
Jun 11, 2024
…jose/go-jose.v2 This buys us time until canonical#13526 is properly fixed. Signed-off-by: Simon Deziel <simon.deziel@canonical.com>
|
@markylaing @simondeziel did this get completed by #13602 ? |
|
Yes, this is done. There is no |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
square/go-jose.v2is affected by https://github.com/canonical/lxd/security/dependabot/13 and the module is deprecated and superseded/replaced bygo-jose/go-jose:https://github.com/square/go-jose?tab=readme-ov-file:
We already depend on
github.com/go-jose/go-jose/v4for LXD andgit.luolix.top/go-jose/go-jose/v3for themini-oidc.Ideally, we'd probably settle on
github.com/go-jose/go-jose/v4for all.The text was updated successfully, but these errors were encountered: