Latest version of the package is compiled with System.Text.Json 8.0.0 which has known vulnerabilities.

[dougmorris]

It would be better compile with 8.0.5 of System.Text.Json

[dvsekhvalnov]

it's actually referencing 5.0.2 for .netstandard 2.1 only.

but guess can bump up dependencies, why not.

[dougmorris]

[dvsekhvalnov]

yeah, i guess it's resolution thing, here is reference: https://github.com/dvsekhvalnov/jose-jwt/blob/master/jose-jwt/jose-jwt.csproj#L105

i'll update package on nuget, but pretty sure you can specify fixed version in your project in a mean time.