twilio / twilio-node

Node.js helper library
MIT License
1.37k stars 497 forks source link

fix: update jsonwebtoken to v9.0.0 #885

Closed jfuginay closed 1 year ago

jfuginay commented 1 year ago

Fixes #884

Raises jsonwebtoken in package.json to 9.0.0 to move past the v8 with newly found security vulnerabilities.

https://unit42.paloaltonetworks.com/jsonwebtoken-vulnerability-cve-2022-23529/

Checklist

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

claudiachua commented 1 year ago

Closing this PR as changes have been made to twilio-node v4 release candidate.

jimpopovitch commented 1 year ago

This fix should be merged at least until such a time that the v4 release candidate is ready for production use.

sergioutama commented 1 year ago

We need this for v3 at least, please reopen

jfuginay commented 1 year ago

The MR I made is v3, with only the jsonwebtoken package upgraded. It passed all tests. An organization that cares about their users and their safety would merge this immediately.

This is taking too long and I have began refactoring our products to use aws sms.

On Thu, Jan 19, 2023 at 12:16 AM Sergio Utama @.***> wrote:

We need this for v3 at least, please reopen

— Reply to this email directly, view it on GitHub https://github.com/twilio/twilio-node/pull/885#issuecomment-1396594095, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACZ7S2SHXNPKD3H5CUTF4PDWTDZ4FANCNFSM6AAAAAATYQJKXI . You are receiving this because you authored the thread.Message ID: @.***>

-- J. Wylie