Update dependency jsonwebtoken to v4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jsonwebtoken	^0.3.0 -> ^4.2.2

GitHub Vulnerability Alerts

CVE-2015-9235

Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.

Recommendation

Update to version 4.2.2 or later.

---

Release Notes

auth0/node-jsonwebtoken

v4.2.2

Compare Source

Fixed

• [asymmetric-keys] Fix verify for RSAPublicKey formated keys (jfromaniello - awlayton)
  auth0/node-jsonwebtoken@4027946
  auth0/node-jsonwebtoken@8df6aab

v4.2.1

Compare Source

Fixed

• [asymmetric-keys] Fixed issue when public key starts with BEING PUBLIC KEY (RS256 problem 4.2.x auth0/node-jsonwebtoken#70) (jfromaniello)
  auth0/node-jsonwebtoken@7017e74

v4.2.0

Compare Source

Security

• [asymmetric-keys] Making sure a token signed with an asymmetric key will be verified using a asymmetric key.
  When the verification part was expecting a token digitally signed with an asymmetric key (RS/ES family) of algorithms an attacker could send a token signed with a symmetric algorithm (HS* family).

The issue was caused because the same signature was used to verify both type of tokens (verify method parameter: secretOrPublicKey).

This change adds a new parameter to the verify called algorithms. This can be used to specify a list of supported algorithms, but the default value depends on the secret used: if the secretOrPublicKey contains the string BEGIN CERTIFICATE the default is [ 'RS256','RS384','RS512','ES256','ES384','ES512' ] otherwise is [ 'HS256','HS384','HS512' ]. (jfromaniello)
auth0/node-jsonwebtoken@c2bf7b2
auth0/node-jsonwebtoken@1bb584b

v4.1.0

Compare Source

Changed

• Assume the payload is JSON even when there is no typ property. 5290db1

v4.0.0

Compare Source

Changed

• The default encoding is now utf8 instead of binary. 92d33bd
• Add encoding as a new option to sign. 1fc385e
• Add ignoreExpiration to verify. 8d4da27
• Add expiresInSeconds to sign. dd156cc

Fixed

• Fix wrong error message when the audience doesn't match. 44e3c8d
• Fix wrong error message when the issuer doesn't match. 44e3c8d
• Fix wrong iat and exp values when signing with noTimestamp. 331b7bc

v3.2.2

Compare Source

v3.2.1

Compare Source

v3.2.0

Compare Source

v3.1.1

Compare Source

v3.1.0

Compare Source

v3.0.0

Compare Source

v2.0.0

Compare Source

v1.1.2

Compare Source

---

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box.

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[similar-code-searcher]

Similar files are