Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update module github.com/lestrrat-go/jwx/v2 to v2.0.18 #49

Merged
merged 1 commit into from
Dec 18, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 7, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/lestrrat-go/jwx/v2 require patch v2.0.17 -> v2.0.18

Release Notes

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v2.0.18

Compare Source

v2.0.18 03 Dec 2023
[Security Fixes]
  * [jwe] A large number in p2c parameter for PBKDF2 based encryptions could cause a DoS attack,
    similar to https://nvd.nist.gov/vuln/detail/CVE-2022-36083.  All users who use JWE via this
    package should upgrade. While the JOSE spec allows for encryption using JWE on JWTs, users of
    the `jwt` package are not immediately susceptible unless they explicitly try to decrypt
    JWTs -- by default the `jwt` package verifies signatures, but does not decrypt messages.
    [GHSA-7f9x-gw85-8grf]

Configuration

📅 Schedule: Branch creation - "before 07:00 on Thursday" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@tjololo tjololo merged commit c9c35ca into main Dec 18, 2023
2 checks passed
@tjololo tjololo deleted the renovate/github.com-lestrrat-go-jwx-v2-2.x branch December 18, 2023 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant