Skip to content
This repository has been archived by the owner on Apr 22, 2024. It is now read-only.

Upgrade to latest JWX v2 #80

Merged
merged 4 commits into from
Mar 7, 2024
Merged

Upgrade to latest JWX v2 #80

merged 4 commits into from
Mar 7, 2024

Conversation

nacx
Copy link
Member

@nacx nacx commented Mar 6, 2024

Upgrades the JWX dependency to v2 and its latest version, v2.0.20 to potentially address #79. In theory the version of the library we were using should contain the fix for the CVE, but it's probably a good idea to upgrade the library to the latest version anyway.

@nacx nacx requested a review from sergicastro March 6, 2024 22:43
Copy link

codecov bot commented Mar 6, 2024

Codecov Report

Attention: Patch coverage is 92.59259% with 2 lines in your changes are missing coverage. Please review.

Project coverage is 92.61%. Comparing base (d7909c6) to head (4c97988).

Additional details and impacted files
@@            Coverage Diff             @@
##             main      #80      +/-   ##
==========================================
- Coverage   92.69%   92.61%   -0.08%     
==========================================
  Files          23       23              
  Lines        1519     1530      +11     
==========================================
+ Hits         1408     1417       +9     
- Misses         68       69       +1     
- Partials       43       44       +1     
Files Coverage Δ
internal/authz/oidc.go 93.55% <100.00%> (ø)
internal/oidc/token.go 100.00% <100.00%> (ø)
internal/oidc/jwks.go 93.54% <92.00%> (-2.54%) ⬇️

@nacx nacx force-pushed the CVE-2024-21664 branch from 5d32061 to 33291c1 Compare March 6, 2024 22:54
sergicastro
sergicastro previously approved these changes Mar 7, 2024
internal/authz/oidc_test.go Outdated Show resolved Hide resolved
Copy link
Contributor

@sergicastro sergicastro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks 🙌🏼

@nacx nacx merged commit a633844 into tetrateio:main Mar 7, 2024
10 of 11 checks passed
@nacx nacx deleted the CVE-2024-21664 branch March 7, 2024 09:22
@nacx nacx mentioned this pull request Mar 7, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants