Skip to content
This repository has been archived by the owner on Oct 9, 2023. It is now read-only.

Bumping fosite version to use community maintained JWT implementation #538

Merged
merged 1 commit into from
Mar 21, 2023

Conversation

hamersaw
Copy link
Contributor

TL;DR

The existing JWT implementation is no longer maintained and has a existing security CVE of HIGH. By increasing the fosite version we instead use the community maintained, backwards compatible JWT implementation which has no known security issues.

Type

  • Bug Fix
  • Feature
  • Plugin

Are all requirements met?

  • Code completed
  • Smoke tested
  • Unit tests added
  • Code documentation added
  • Any pending items have an associated Issue

Complete description

^^^

Tracking Issue

fixes flyteorg/flyte#3368

Follow-up issue

NA

Signed-off-by: Daniel Rammer <daniel@union.ai>
@codecov
Copy link

codecov bot commented Mar 10, 2023

Codecov Report

Merging #538 (9ec5841) into master (188b982) will increase coverage by 1.51%.
The diff coverage is n/a.

❗ Current head 9ec5841 differs from pull request most recent head 4c721bf. Consider uploading reports for the commit 4c721bf to get more accurate results

@@            Coverage Diff             @@
##           master     #538      +/-   ##
==========================================
+ Coverage   60.14%   61.65%   +1.51%     
==========================================
  Files         169      169              
  Lines       15095    12417    -2678     
==========================================
- Hits         9079     7656    -1423     
+ Misses       5215     3960    -1255     
  Partials      801      801              
Flag Coverage Δ
unittests ?

Flags with carried forward coverage won't be shown. Click here to find out more.

see 155 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@kumare3
Copy link
Contributor

kumare3 commented Mar 20, 2023

cc @EngHabu / @wild-endeavor

@hamersaw hamersaw merged commit dea5b2a into master Mar 21, 2023
@hamersaw hamersaw deleted the security/jwt branch March 21, 2023 07:14
eapolinario pushed a commit that referenced this pull request Sep 6, 2023
Signed-off-by: Daniel Rammer <daniel@union.ai>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Housekeeping] Avoid using archived github.com/dgrijalva/jwt-go
4 participants