ory / fosite

Extensible security first OAuth 2.0 and OpenID Connect SDK for Go.
https://www.ory.sh/?utm_source=github&utm_medium=banner&utm_campaign=fosite
Apache License 2.0
2.28k stars 356 forks source link

Consider upgrading to github.com/go-jose/go-jose/v4 #797

Open mitar opened 4 months ago

mitar commented 4 months ago

Preflight checklist

Ory Network Project

No response

Describe your problem

github.com/go-jose/go-jose/v3 dependency has made a new github.com/go-jose/go-jose/v4 version. It breaks backwards compatibility to improve security:

This release makes some breaking changes in order to more thoroughly address the vulnerabilities discussed in Three New Attacks Against JSON Web Tokens, "Sign/encrypt confusion", "Billion hash attack", and "Polyglot token".

I think it is not critical, but it would be beneficial to do so sooner than later.

Describe your ideal solution

We upgrade.

Workarounds or alternatives

We do not.

Version

latest master

Additional Context

No response

mitar commented 1 month ago

@aeneasr: What about this?