Fix CVE-2022-23541
#66
Conversation
This PR updates the version of `jsonwebtoken` used in order to resolve `CVE-2022-23541`. See the link below for more details. GHSA-hjrf-2m68-5959
|
🎉 This PR is included in version 2.0.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
|
Hey @gr2m can you backport this to |
|
@wolfy1339 @gr2m I forked the project, updated the version of jsonewebtoken, and ran However, since there isn't a branch for v1 currently and I don't have permission to create one, I'm not sure what the best strategy is from here. @gr2m maybe would you mind creating a v1-cve-backport branch that I could PR to and we could release as v1.2.0? What do you think would be the best way forward? |
|
Yes, please back-port. Popular libraries depend on 1.x and can't easily upgrade to 2.x because 2.x is ESM. |
|
@gr2m I think this is still an issue. Would it be okay to backport to v1? If given appropriate permissions I'm happy to do it myself. |
|
It is backported to v1 |
|
Awesome, thank you! |
This PR updates the version of
jsonwebtokenused in order to resolveCVE-2022-23541.See the link below for more details.
GHSA-hjrf-2m68-5959