Bump lcobucci/jwt from 3.4.2 to 3.4.6 #1

Closed

dependabot[bot] wants to merge 1 commit from dependabot/composer/lcobucci/jwt-3.4.6 into master

dependabot[bot] commented

2021-09-29 10:14:01 -07:00

(Migrated from github.com)

Bumps lcobucci/jwt from 3.4.2 to 3.4.6.

Release notes

Sourced from lcobucci/jwt's releases.

3.4.6

Release Notes for 3.4.6

This patch ships a minor security fix to prevent misuse of the LocalFileReference key.

More info: More info: https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf

3.4.6

Total issues resolved: 1

Total pull requests resolved: 0

Total contributors: 3

3.4.5

Release Notes for 3.4.5

This release fixes an issue with the compatibility layer that disallowed us to use composer's classmap-authoritative autoload.

3.4.5

Total issues resolved: 1

Total pull requests resolved: 1

Total contributors: 1

Bug

667: Support composer classmap-authoritative option thanks to @fyrye

3.4.4

Release Notes for 3.4.4

This release fixes a gap on our forward compatibility layer with v4 for multiple audience support, improving the documentation to state how users can migrate their code.

3.4.4

Total issues resolved: 0

Total pull requests resolved: 2

Total contributors: 2

Bug

656: Fix forward compatibility layer gap for audience claim thanks to @lcobucci

Documentation,Improvement

630: Improve deprecation for aud claims thanks to @SvenRtbg

3.4.3

![Build Status]

... (truncated)

Commits

3ef8657 Merge pull request from GHSA-7322-jrq4-x5hf
c45bb8b Ensure key contents is used for all hashing algorithms
511629a Merge pull request #667 from fyrye/patch-1
d246711 Support composer classmap-authoritative option
ff92156 Merge pull request #630 from SvenRtbg/feature/improve_deprecation_for_aud
ef06886 Add test case for array audience case
24b6b64 Add deprecation message in Token
5cea9a9 Update migration guide with details for audience claims
be54104 Merge pull request #656 from lcobucci/fix-fc-layer-gap
e48ecb7 Document migration path for multiple audiences
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [lcobucci/jwt](https://github.com/lcobucci/jwt) from 3.4.2 to 3.4.6. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lcobucci/jwt/releases">lcobucci/jwt's releases</a>.</em></p> <blockquote> <h2>3.4.6</h2> <h3>Release Notes for <a href="https://github.com/lcobucci/jwt/milestone/31">3.4.6</a></h3> <p>This patch ships a minor security fix to prevent misuse of the <code>LocalFileReference</code> key.</p> <p>More info: More info: <a href="https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf">https://github.com/lcobucci/jwt/security/advisories/GHSA-7322-jrq4-x5hf</a></p> <h3>3.4.6</h3> <ul> <li>Total issues resolved: <strong>1</strong></li> <li>Total pull requests resolved: <strong>0</strong></li> <li>Total contributors: <strong>3</strong></li> </ul> <h2>3.4.5</h2> <h3>Release Notes for <a href="https://github.com/lcobucci/jwt/milestone/30">3.4.5</a></h3> <p>This release fixes an issue with the compatibility layer that disallowed us to use composer's classmap-authoritative autoload.</p> <h3>3.4.5</h3> <ul> <li>Total issues resolved: <strong>1</strong></li> <li>Total pull requests resolved: <strong>1</strong></li> <li>Total contributors: <strong>1</strong></li> </ul> <h4>Bug</h4> <ul> <li><a href="https://github-redirect.dependabot.com/lcobucci/jwt/pull/667">667: Support composer classmap-authoritative option</a> thanks to <a href="https://github.com/fyrye"><code>@fyrye</code></a></li> </ul> <h2>3.4.4</h2> <h3>Release Notes for <a href="https://github.com/lcobucci/jwt/milestone/29">3.4.4</a></h3> <p>This release fixes a gap on our forward compatibility layer with v4 for multiple audience support, improving the documentation to state how users can migrate their code.</p> <h3>3.4.4</h3> <ul> <li>Total issues resolved: <strong>0</strong></li> <li>Total pull requests resolved: <strong>2</strong></li> <li>Total contributors: <strong>2</strong></li> </ul> <h4>Bug</h4> <ul> <li><a href="https://github-redirect.dependabot.com/lcobucci/jwt/pull/656">656: Fix forward compatibility layer gap for audience claim </a> thanks to <a href="https://github.com/lcobucci"><code>@lcobucci</code></a></li> </ul> <h4>Documentation,Improvement</h4> <ul> <li><a href="https://github-redirect.dependabot.com/lcobucci/jwt/pull/630">630: Improve deprecation for aud claims</a> thanks to <a href="https://github.com/SvenRtbg"><code>@SvenRtbg</code></a></li> </ul> <h2>3.4.3</h2> <p><a href="https://github.com/lcobucci/jwt/actions?query=workflow%3A%22PHPUnit+Tests%22+branch%3A3.4.3">![Build Status]</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lcobucci/jwt/commit/3ef8657a78278dfeae7707d51747251db4176240"><code>3ef8657</code></a> Merge pull request from GHSA-7322-jrq4-x5hf</li> <li><a href="https://github.com/lcobucci/jwt/commit/c45bb8b961a8e742d8f6b88ef5ff1bd5cca5d01c"><code>c45bb8b</code></a> Ensure key contents is used for all hashing algorithms</li> <li><a href="https://github.com/lcobucci/jwt/commit/511629a54465e89a31d3d7e4cf0935feab8b14c1"><code>511629a</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/lcobucci/jwt/issues/667">#667</a> from fyrye/patch-1</li> <li><a href="https://github.com/lcobucci/jwt/commit/d24671193d1a820ba0b3794cc80c4cfc7071ce5a"><code>d246711</code></a> Support composer classmap-authoritative option</li> <li><a href="https://github.com/lcobucci/jwt/commit/ff92156cd27d3abe7fc8814516ae0615215f01ae"><code>ff92156</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/lcobucci/jwt/issues/630">#630</a> from SvenRtbg/feature/improve_deprecation_for_aud</li> <li><a href="https://github.com/lcobucci/jwt/commit/ef06886c4c36bdd9daacaa310fa060ca182c6b45"><code>ef06886</code></a> Add test case for array audience case</li> <li><a href="https://github.com/lcobucci/jwt/commit/24b6b646970d74d52450426bdc80ed45c27875e3"><code>24b6b64</code></a> Add deprecation message in Token</li> <li><a href="https://github.com/lcobucci/jwt/commit/5cea9a98cadd78df36fedce69c5b16c63e069ba7"><code>5cea9a9</code></a> Update migration guide with details for audience claims</li> <li><a href="https://github.com/lcobucci/jwt/commit/be54104c4a711d53e62b198658d687c4a00c3795"><code>be54104</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/lcobucci/jwt/issues/656">#656</a> from lcobucci/fix-fc-layer-gap</li> <li><a href="https://github.com/lcobucci/jwt/commit/e48ecb7a18ba6138ecbfd62d7cb86338e7d36eb4"><code>e48ecb7</code></a> Document migration path for multiple audiences</li> <li>Additional commits viewable in <a href="https://github.com/lcobucci/jwt/compare/3.4.2...3.4.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lcobucci/jwt&package-manager=composer&previous-version=3.4.2&new-version=3.4.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/sciactive/tilmeld-server/network/alerts). </details>

dependabot[bot] commented

2022-12-11 10:41:39 -08:00

(Migrated from github.com)

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting `@dependabot ignore this major version` or `@dependabot ignore this minor version`. If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Commenting is not possible because the repository is archived.

No reviewers