67dda587bb
npm audit report: jsonwebtoken <=8.5.1 Severity: high jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6 jsonwebtoken unrestricted key type could lead to legacy keys usage - https://github.com/advisories/GHSA-8cf7-32gw-wr33 fix available via `npm audit fix --force` Will install auth0@3.0.1, which is a breaking change node_modules/jsonwebtoken auth0 2.13.0 - 3.0.0 Depends on vulnerable versions of jsonwebtoken Depends on vulnerable versions of jwks-rsa node_modules/auth0 jwks-rsa 1.5.1 - 1.12.3 Depends on vulnerable versions of jsonwebtoken node_modules/jwks-rs Test: npm install && npm run build:all && npm run test:unit Change-Id: I47dfb353718cd3c40dd7060d2c31cb5e1ebaec43