[MAINT]: Upgrade jsonwebtoken dependency to v9.0.0

[ChuckCox]

Describe the need

The jsonwebtoken v8.5.1 package is reporting a high security vulnerability.

Could this dependency be upgraded to v9.0.0 (https://github.com/auth0/node-jsonwebtoken/tags)?

Here is the npm audit report about the issue:

# npm audit report

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
fix available via `npm audit fix --force`
Will install octokit@0.10.4, which is a breaking change
node_modules/jsonwebtoken
  universal-github-app-jwt  <=2.0.0
  Depends on vulnerable versions of jsonwebtoken
  node_modules/universal-github-app-jwt
    @octokit/auth-app  >=2.1.0
    Depends on vulnerable versions of universal-github-app-jwt
    node_modules/@octokit/auth-app
      @octokit/app  >=10.0.0-beta.1
      Depends on vulnerable versions of @octokit/auth-app
      node_modules/@octokit/app
        octokit  >=1.0.0-beta.1
        Depends on vulnerable versions of @octokit/app
        node_modules/octokit

Here is a link to the known SNYK: https://security.snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180020

SDK Version

No response

API Version

No response

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[wolfy1339]

There is an ongoing discussion in another repo for this exact reason.

octokit/auth-app.js#430

Let me sum it up:

• The Octokit packages are CommonJS
• universal-github-app-jwt is now an ESM module as of v2
• The jsonwebtoken dependency was upgraded to v9 in v2.1 of universal-github-app-jwt
• We are waiting for a backport to v1 of universal-github-app-jwt

On another note, we don't use any of the methods described in the CVE affecting jsonwebtoken

[ryanmr]

We use octokit for some integrations / automations, but our automated cve scanner picked this up.

If anyone comes across this issue until this is fixed upstream in the package, and you use yarn, you can use yarn resolutions to specifically override the jsonwebtoken package:

In your package.json:

  "resolutions": {
    "jsonwebtoken": "^9.0.0"
  }

If you use npm 8.19.3 or later, you can also use npm overrides for similar overriding functionality.

Thanks all, for the great package.

[wolfy1339]

Does that work for published packages?
It would be a good stop-gap measure if it did

[gr2m]

We are waiting for a backport to v1 of universal-github-app-jwt

done: universal-github-app-jwt@1.1.1

deleting node_modules and your lock file and installing from scratch should fix the problem.

@octokit/js @octokit/auth-app should be updated next to force the update to v1.1.1
https://github.com/octokit/auth-app.js/blob/96291b7d942bb80a185fc5712c1af55bc2dacb8c/package.json#L34

[github-actions]

🎉 This issue has been resolved in version 2.0.11 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀