Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade go-jose from v2 to v4 #269

Open
6 tasks done
jamestelfer opened this issue Apr 30, 2024 · 6 comments
Open
6 tasks done

Upgrade go-jose from v2 to v4 #269

jamestelfer opened this issue Apr 30, 2024 · 6 comments
Labels
bug This issue reports a suspect bug or issue with the SDK itself

Comments

@jamestelfer
Copy link

Checklist

  • I have looked into the README and have not found a suitable solution or answer.
  • I have looked into the documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have upgraded to the latest version of this SDK and the issue still persists.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

This was previously addressed in #239, but I think this issue might need to be reopened.

On main, the "Versions" section says:

The old square/go-jose repo contains the prior v1 and v2 versions, which are still useable but not actively developed anymore.

Now, a version 2.6.3 was released in March owing to a security vulnerability, so it's possible that some security issues will be backported.

However, the security policy states clearly that only v3 and v4 are supported versions.

It would be good to investigate an upgrade, given the stability and security improvements since v2.

Reproduction

go.mod references go-jose v2.x

Go JWT Middleware version

2.2.1

Go version

1.22
@jamestelfer jamestelfer added the bug This issue reports a suspect bug or issue with the SDK itself label Apr 30, 2024
@mwiesenbauer mwiesenbauer mentioned this issue Jun 5, 2024
Closed
1 task
@maxime-gaudron
Copy link

@sergiught Hello, mentioning you as the main contributor of the repo.
As Auth0 clients we're facing the same issue and as we're working in a regulated domain it's a bit sensitive for us.
Would there be any chance you could look at this?
Thank you!

@pat-git023
Copy link

is there any update on this?
since go-jose 2.x has reached end-of-live we also get security warnings and need to react on that.
any chance that the open PR #275 will be merged in a timely manner?

Thank you very much

@cantutar
Copy link

Im absolutely agreed with above users. Please update the dependecy it has a security vulnerability.

@sergiught
Copy link
Contributor

Hey folks, apologies for the delay as I have missed getting notified on this. Unfortunately I am no longer a maintainer of this project as I have transitioned to a new team, however I've immediately alerted the owning team and it will be looked at ASAP.

CC: @developerkunal, @arpit-jn

@developerkunal
Copy link
Contributor

Hey folks,
I apologize for the delay in addressing this vulnerability; it was unfortunately overlooked. At this time, we're unable to upgrade to JoseV4 due to the breaking changes it would introduce, which would require a major version release. However, I’ve already scheduled improvements and version upgrades that will be included in an upcoming major release.

In the meantime, we’ve released a security patch to address the issue. If you encounter any further problems, please don’t hesitate to tag me or open a new issue, and I’ll respond as quickly as possible.

Thank you for your understanding.

@abiabsurd
Copy link

What's the timeline for the upcoming major release that will include this support for jose v4? Anything contributors can help with?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug This issue reports a suspect bug or issue with the SDK itself
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

use go-jose v4 mwiesenbauer/go-jwt-middleware
7 participants
@jamestelfer @abiabsurd @maxime-gaudron @sergiught @developerkunal @cantutar @pat-git023