Skip to content

#168 Upgrade Golang-jwt package to maintained branch of 5.x#169

Open
taz77 wants to merge 7 commits into
bradleyfalzon:masterfrom
taz77:master
Open

#168 Upgrade Golang-jwt package to maintained branch of 5.x#169
taz77 wants to merge 7 commits into
bradleyfalzon:masterfrom
taz77:master

Conversation

@taz77

@taz77 taz77 commented Oct 2, 2025

Copy link
Copy Markdown

A PR to address open security vulnerabilities with ghinstallation inherited from Go JWT package. See linked issue with CVE's

wlynch added a commit to wlynch/ghinstallation that referenced this pull request Oct 10, 2025
This is masking build errors, since go get will auto-modify go.mod.

I noticed this in bradleyfalzon#169 -
the test didn't fail because it re-added jwt/v4 as part of the get,
but golangci-lint failed because it didn't do a similar change.
@wlynch

wlynch commented Oct 10, 2025

Copy link
Copy Markdown
Collaborator

@taz77 Thanks for the PR!

I think the references to v4 need to be updated in the rest of the source files - e.g.

jwt "github.com/golang-jwt/jwt/v4"

@taz77

taz77 commented Oct 11, 2025

Copy link
Copy Markdown
Author

@wlynch Opps. Yeah, missed all that. I fixed that along with several other problems. Updated README too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants