Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update module github.com/lestrrat-go/jwx/v2 to v2.0.18 #1190

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 3, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/lestrrat-go/jwx/v2 require patch v2.0.17 -> v2.0.18

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v2.0.18

Compare Source

v2.0.18 03 Dec 2023
[Security Fixes]
  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users who use JWE via this
    package should upgrade. While the JOSE spec allows for encryption using JWE on JWTs, users of
    the `jwt` package are not immediately susceptible unless they explicitly try to decrypt
    JWTs -- by default the `jwt` package verifies signatures, but does not decrypt messages.
    [GHSA-7f9x-gw85-8grf]

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from a team as a code owner December 3, 2023 09:59
@renovate renovate bot added the renovate label Dec 3, 2023
@sven-urbanski-freiheit-com sven-urbanski-freiheit-com merged commit 0bc2e86 into main Dec 5, 2023
10 checks passed
@sven-urbanski-freiheit-com sven-urbanski-freiheit-com deleted the renovate/git.luolix.top-lestrrat-go-jwx-v2-2.x branch December 5, 2023 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant