mod : Replace for OSV GO-2020-0017 JWT

The github.com/dgrijalva/jwt-go is no longer maintained
has this CVE https://github.com/advisories/GHSA-w73w-5m7g-f7qc

But it is being used by https://github.com/etcd-io/etcd/issues/13254
which `lnd` uses.

The https://github.com/golang-jwt/jwt/releases/tag/v3.2.1 is a fork of
the same version which was 3.2.0 with the security fix.
This commit is contained in:
naveen committed 2021-09-16 11:23:28 +00:00
1 parent 15ec974b15
commit 8b4bbfbf61
5 files changed
+10 -2

No files matched your search

+3
View File
@@ -81,6 +81,9 @@ replace github.com/lightningnetwork/lnd/kvdb => ./kvdb
replace git.schwanenlied.me/yawning/bsaes.git => github.com/Yawning/bsaes v0.0.0-20180720073208-c0276d75487e
// This replace is for https://github.com/advisories/GHSA-w73w-5m7g-f7qc
replace github.com/dgrijalva/jwt-go => github.com/golang-jwt/jwt v3.2.1+incompatible
// If you change this please also update .github/pull_request_template.md and
// docs/INSTALL.md.
go 1.15