jsonwebtoken unrestricted key type could lead to legacy keys usage

[DhanushNehru]

When configuring dependabot alerts for our repository we are running into an issue where the jsonwebtoken needs to be upgraded.

Possible to upgrade the jsonwebtoken used by cube with version greater than 9.0.0 would resolve this issue. Can it be upgraded by the cube team ?

[github-actions[bot]]

If you are interested in working on this issue, please leave a comment below and we will be happy to assign the issue to you. If this is the first time you are contributing a Pull Request to Cube.js, please check our contribution guidelines. You can also post any questions while contributing in the #contributors channel in the Cube.js Slack.

[paveltiunov]

@DhanushNehru Feel free to provide PR for that. We also have separate enterprise images, which have different set of dependencies and update cadence. Please contact us if you'd like to consider this option https://cube.dev/contact.

[DhanushNehru]

Hi @paveltiunov I have provided a PR, can you please check https://github.com/cube-js/cube.js/pull/6183

[DhanushNehru]

Hi @paveltiunov I have provided a PR, can you please check the updated one https://github.com/cube-js/cube/pull/6527