npm audit report:
jsonwebtoken <=8.5.1
Severity: high
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken unrestricted key type could lead to legacy keys usage - https://github.com/advisories/GHSA-8cf7-32gw-wr33
fix available via `npm audit fix --force`
Will install auth0@3.0.1, which is a breaking change
node_modules/jsonwebtoken
auth0 2.13.0 - 3.0.0
Depends on vulnerable versions of jsonwebtoken
Depends on vulnerable versions of jwks-rsa
node_modules/auth0
jwks-rsa 1.5.1 - 1.12.3
Depends on vulnerable versions of jsonwebtoken
node_modules/jwks-rs
Test: npm install && npm run build:all && npm run test:unit
Change-Id: I47dfb353718cd3c40dd7060d2c31cb5e1ebaec43
67dda587bb