Update go-jose. Fixes #607 #608
Conversation
| gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect | ||
| gopkg.in/square/go-jose.v2 v2.6.0 // indirect |
There was a problem hiding this comment.
Two different module paths, /square vs. /go-jose are present. Does this even fix the issue? Any Code that uses the other path will still use the vulnerable code, no?
There seems to be a repo migration issue here. The original GitHub repo moved and it appears that gopk.in uses the older repo as a source.
I think the only way to address this in the SDK and controller is to get the downstream repo to fix its module reference.
There was a problem hiding this comment.
FYI I pulled the branch and looked at the deptree from this project and the only go-jose tree I see is from zitadel so if 2.6.3 has the vulnerability fixed, it seems to me that this would resolve the issue here
|
@andrewpmartinez is working on getting the library updated in zitiadel. |
No description provided.