Skip to content

Upgrade golang-jwt/jwt to v5#752

Open
NitheshKG wants to merge 1 commit into
andygrunwald:mainfrom
NitheshKG:upgrade-jwt-v5
Open

Upgrade golang-jwt/jwt to v5#752
NitheshKG wants to merge 1 commit into
andygrunwald:mainfrom
NitheshKG:upgrade-jwt-v5

Conversation

@NitheshKG

Copy link
Copy Markdown

What type of PR is this?

bug

What this PR does / why we need it:

This PR upgrades the github.com/golang-jwt/jwt dependency to address a security vulnerability reported by Snyk.

The affected versions are vulnerable to Asymmetric Resource Consumption (Amplification) through the ParseUnverified function, where a crafted Authorization header containing excessive period (.) characters can trigger high memory allocation.

The upgrade ensures the project uses a non-vulnerable version of the JWT package and maintains compatibility with existing authentication flows.

Which issue(s) this PR fixes:

Vulnerability

Fixes #

Special notes for your reviewer:

  1. Updated JWT package imports and compatibility changes required for v5 migration.
  2. Executed dependency cleanup using go mod tidy.
  3. Verified the project builds and existing authentication-related flows continue to work as expected.

Additional documentation e.g., usage docs, etc.:

  1. Snyk vulnerability reference related to github.com/golang-jwt/jwt
  2. No functional API changes introduced outside dependency migration updates.

@github-actions github-actions Bot added jira-onpremise Changes related to the Jira On-Premise client jira-cloud Changes related to the Jira Cloud client labels May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

jira-cloud Changes related to the Jira Cloud client jira-onpremise Changes related to the Jira On-Premise client

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant