Gopkg.in/go-jose/go-jose.v2 v2.6.3 is deprecated

Show & Tell
1

Hi,
I noticed that the latest temporal.io server is still using deprecated library “gopkg.in/go-jose/go-jose.v2 v2.6.3” (in go.mod). It could be replace by the library GitHub - go-jose/go-jose: An implementation of JOSE standards (JWE, JWS, JWT) in Go withouth code reworking.

Thanks In advance
Regards
Marco

2

Would create issue in github here for this. thanks.

3

Hi,
I opened the issue https://github.com/temporalio/temporal/issues/7086. The go-jose/go-jose module is vulnerable to Denial of Service (DoS) attacks GHSA-2c7c-3mj9-8fqh

Could you help to provide a quick fix?
Best Regards
Marco