kinde-node-express icon indicating copy to clipboard operation
kinde-node-express copied to clipboard
verified publisher icon kinde-oss

[Snyk] Upgrade aws-jwt-verify from 5.0.0 to 5.1.1

Open DanielRivers opened this issue 2 months ago • 1 comments

snyk-top-banner

Snyk has created this PR to upgrade aws-jwt-verify from 5.0.0 to 5.1.1.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 2 versions ahead of your current version.

  • The recommended version was released 25 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Improper Handling of Unexpected Data Type
SNYK-JS-ONHEADERS-10773729		 222 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 222 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 222 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ESLINTPLUGINKIT-10847878		 222 Proof of Concept
Release notes
Package name: aws-jwt-verify
  • 5.1.1 - 2025-10-02

    What's Changed

    New Contributors

    Full Changelog: v5.1.0...v5.1.1

  • 5.1.0 - 2025-05-05

    What's Changed

    New Contributors

    Full Changelog: v5.0.0...v5.1.0

  • 5.0.0 - 2025-01-08

    Notable new features in v5.0.0:

    • Support for ECDSA and EdDSA algorithms:
      • ES256
      • ES384
      • ES512
      • Ed25519
      • Ed448
    • Allow padding characters (even though non-standard) so e.g. AWS ALB JWTs can be verified with this library (however work is still underway to make that easier still, see #176 )
    • The default response timeout of the JWKS fetcher was increased from 1500 ms. to 3000 ms. because multiple users reported the previous 1500 ms. being too low--they were hitting timeouts too often. We believe the 3000 ms. is a better, more reasonable, default value.

    Breaking changes

    This release includes breaking changes, hence moving to major version 5.0.0:

    • Dropped support for Node.js 14, now 16 is the minimum.
    • The fetchJson interface was changed and renamed to fetch. Thus the JsonFetcher was renamed to Fetcher, and corresponding changes were made in the SimpleJwksCache see #167. So, this affects users who were using the SimpleJsonFetcher, potentially to increase the response timeout (maybe that's no longer needed now, as we raised the default value from 1500 ms. to 3000 ms.).
    • It is now allowed to use an explicit null as issuer when creating the verifier, to cater for issuers that create JWTs without iss field (which is non-standard): see #183 . Previously, you couldn't create a verifier for issuer null and JWTs without iss field would always throw JwtInvalidIssuerError. This change likely is breaking to no-one, but technically this is a breaking change. So if your code was explicitly using JwtInvalidIssuerError (e.g. because you imported it), check if it still TS-compiles and works.
    • We renamed the JwtRsaVerifier to JwtVerifier as it handles ECDSA and EdDSA now too but created a top level (immediately deprecated) alias to JwtVerifier so if you do import { JwtRsaVerifier } from "aws-jwt-verifier" that still works. This will break though: import { JwtRsaVerifier } from "aws-jwt-verifier/jwt-rsa" and should become import { JwtVerifier } from "aws-jwt-verifier/jwt-verifier" (if for some reason you were importing like that and not from top-level).

    What's Changed

    Full Changelog: v4.0.1...v5.0.0

from aws-jwt-verify GitHub release notes

[!IMPORTANT]

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

DanielRivers avatar Oct 27 '25 09:10 DanielRivers

[!IMPORTANT]

Review skipped

Ignore keyword(s) in the title.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • [ ] Create PR with unit tests
  • [ ] Post copyable unit tests in a comment
  • [ ] Commit unit tests in branch snyk-upgrade-54f1200f39a2731b537b1a8cfee31ba8

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

coderabbitai[bot] avatar Oct 27 '25 09:10 coderabbitai[bot]