Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update okta-sdk-golang to v3 to eliminate the dependency on go-jose.v2 #27899

Closed
letaoj opened this issue Jul 29, 2024 · 2 comments · Fixed by #28407
Closed

Update okta-sdk-golang to v3 to eliminate the dependency on go-jose.v2 #27899

letaoj opened this issue Jul 29, 2024 · 2 comments · Fixed by #28407
Labels
auth/okta dependencies Pull requests that update a dependency file

Comments

@letaoj
Copy link

letaoj commented Jul 29, 2024

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
gopkg.in/square/go-jose.v2 v2.6.0 contains CVE-2024-28180 which is depended by okta-sdk-golang v2 version.

Describe the solution you'd like
A clear and concise description of what you want to happen.
Bump okta-sdk-golang to v3 or higher

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
N/A

Explain any additional use-cases
If there are any use-cases that would help us understand the use/need/value please share them as they can help us decide on acceptance and prioritization.

Additional context
Add any other context or screenshots about the feature request here.

@heatherezell
Copy link
Contributor

Tagging @mickael-hc. Thanks!

@heatherezell heatherezell added auth/okta dependencies Pull requests that update a dependency file labels Jul 29, 2024
@synergiator
Copy link

synergiator commented Sep 5, 2024

confirming the CVE mentioned above also for 1.17.5. go-jose is in the meantime v5.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
auth/okta dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants