fix: Moving @types/express to dev and re generating package lock#464
fix: Moving @types/express to dev and re generating package lock#464cschetan77 merged 5 commits intomasterfrom
Conversation
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
| "dev": true, | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/express-jwt-v6/node_modules/jsonwebtoken": { |
There was a problem hiding this comment.
Risk: Affected versions of jsonwebtoken are vulnerable to Improper Authentication. Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC.
Manual Review Advice: A vulnerability from this advisory is reachable if you are using a poorly implemented key retrieval function and your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function.
Fix: Upgrade this library to at least version 9.0.0 at node-jwks-rsa/package-lock.json:2306.
Reference(s): GHSA-hjrf-2m68-5959, CVE-2022-23541
🧁 Fixed in commit 6a5d56a 🧁
| "dev": true, | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/express-jwt-v6/node_modules/jsonwebtoken": { |
There was a problem hiding this comment.
Risk: Affected versions of jsonwebtoken are vulnerable to Use Of A Broken Or Risky Cryptographic Algorithm. The library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.
Manual Review Advice: A vulnerability from this advisory is reachable if you are using a legacy, insecure key type with a supported algorithm; for example, DSA keys could be used with the RS256 algorithm
Fix: Upgrade this library to at least version 9.0.0 at node-jwks-rsa/package-lock.json:2306.
Reference(s): GHSA-8cf7-32gw-wr33, CVE-2022-23539
🥳 Fixed in commit 6a5d56a 🥳
2 participants
Description
Changes -
@typeps/expressfrom main dependency to dev dependency.@types/expresshas no usage in the SDK's type def file. The minimal types needed from express-jwt are custom defined.References
FIxes #423 #446 #428 #436
Testing
@types/expressand its associated transitive dependencies.expressJwtSecret.