Repository: etcd-io/etcd (language: go)

Issue:
[3.5] Bump golang-jwt/jwt to 4.5.1 to address GO-2024-3250
### Bug report criteria

- [ ] This bug report is not security related, security issues should be disclosed privately via [etcd maintainers](mailto:etcd-maintainers@googlegroups.com).
- [ ] This is not a support request or question, support requests or questions should be raised in the etcd [discussion forums](https://github.com/etcd-io/etcd/discussions).
- [ ] You have read the etcd [bug reporting guidelines](https://github.com/etcd-io/etcd/blob/main/Documentation/contributor-guide/reporting_bugs.md).
- [ ] Existing open issues along with etcd [frequently asked questions](https://etcd.io/docs/latest/faq) have been checked and this is not a duplicate.

### What happened?

```
Vulnerability #1: GO-2024-3250
    Improper error handling in ParseWithClaims and bad documentation may cause
    dangerous situations in github.com/golang-jwt/jwt
  More info: https://pkg.go.dev/vuln/GO-2024-3250
  Module: github.com/golang-jwt/jwt/v4
    Found in: github.com/golang-jwt/jwt/v4@v4.4.2
    Fixed in: github.com/golang-jwt/jwt/v4@v4.5.1
    Example traces found:
Error:       #1: auth/jwt.go:48:26: auth.tokenJWT.info calls jwt.Parse

```

### What did you expect to happen?

No CVE failures

### How can we reproduce it (as minimally and precisely as possible)?

Refer to https://github.com/etcd-io/etcd/actions/runs/11851990849/job/33029399184?pr=18829

### Anything else we need to know?

_No response_

### Etcd version (please run commands below)

<details>

```console
$ etcd --version
# paste output here

$ etcdctl version
# paste output here
```

</details>


### Etcd configuration (command line flags or environment variables)

<details>

# paste your configuration here

</details>


### Etcd debug information (please run commands below, feel free to obfuscate the IP address or FQDN in the output)

<details>

```console
$ etcdctl member list -w table
# paste output here

$ etcdctl --endpoints=<member list> endpoint status -w table
# paste output here
```

</details>


### Relevant log output

_No response_


Discussion / hints:
Release 3.4 is not affected because it uses github.com/golang-jwt/jwt v3 (3.2.1), not v4. The GO-2024-3250 is reported only for v4. Running `govulncheck` in the release-3.4 branch doesn't raise any issues.

#18899 addresses 3.5, so we should be able to close this issue. Thanks, @ahrtr and @tjungblu for quickly reporting and addressing it :tada: :bow: 

/retitle [3.5] Bump golang-jwt/jwt to 4.5.1 to address GO-2024-3250
Do we want to add this to the CHANGELOG?
> Do we want to add this to the CHANGELOG?

Yes please. 

Fix patch:
diff --git a/CHANGELOG/CHANGELOG-3.5.md b/CHANGELOG/CHANGELOG-3.5.md
index 64097f816ae..31b6046c301 100644
--- a/CHANGELOG/CHANGELOG-3.5.md
+++ b/CHANGELOG/CHANGELOG-3.5.md
@@ -5,6 +5,9 @@ Previous change logs can be found at [CHANGELOG-3.4](https://github.com/etcd-io/
 
 ## v3.5.18 (TBC)
 
+## Dependencies
+- Bump [golang-jwt/jwt to 4.5.1 to address GO-2024-3250](https://github.com/etcd-io/etcd/pull/18899).
+
 <hr>
 
 ## v3.5.17 (2024-11-12)


Test patch: