search

Vonage / vonage-go-sdk

A lightweight library to help Go users everywhere integrate with the Vonage APIs. Issues and PRs all really welcome!!
https://vonage.github.io/vonage-go-sdk/
Apache License 2.0
51 stars 32 forks source link

Upgrade JWT library dependency to fix CVE #69

Open rwhitworth opened 2 years ago

rwhitworth commented 2 years ago

It looks like dgrijalva/jwt-go has been superseded by the golang-jwt/jwt library. The older 'dgrijalva' library has security vulnerabilities logged against it. Could this repo change to use the golang-jwt/jwt library in its place?

rwhitworth commented 2 years ago

Adding this to my downstream project's go.mod seems to have upgraded the library:

replace github.com/dgrijalva/jwt-go => github.com/golang-jwt/jwt/v4 v4.1.0

Note that I do not claim to be a golang developer. This workaround may be incorrect. It seems to be working for now.