Repository: provectus/kafka-ui
Issue: bump nimbus-jose-jwt from 7.8 to 9.16 in kafka-ui-api
Labels: status/invalid
scope/backend
type/security

Current version in use is almost two years old.

https://mvnrepository.com/artifact/com.nimbusds/nimbus-jose-jwt

Issue comments:
Hi, I don't see this dependency anywhere in our project at all.
 appreciate the reply. tks.  Close my tickets then, maybe I was given bum info.....  I have  75mb jar file 
kafka-ui-api-0.2.1.jar 

When I expanded that jar, i get three folders:BOOT-INFMETA-INForg
There are 171 jars in here:\kafka-ui-api-0.2.1\BOOT-INF\lib\

Robert


    On Saturday, November 13, 2021, 09:05:22 AM EST, Roman Zabaluev ***@***.***> wrote:  
 
 


Hi, I don't see this dependency anywhere in our project at all.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications on the go with GitHub Mobile for iOS or Android.
  
This might be a transitive dependency. There's nothing wrong with it, considering we're getting notifications about security vulnerabilities via dependabot and sonar. But thanks for the concern! 
 We are getting our reports from Twistlock scans.  copy attached. I'll step back out of the issues for the moment.  tks for the replies.
Robert
    On Sunday, November 14, 2021, 09:08:04 AM EST, Roman Zabaluev ***@***.***> wrote:  
 
 


This might be a transitive dependency. There's nothing wrong with it, considering we're getting notifications about security vulnerabilities via dependabot and sonar. But thanks for the concern!

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications on the go with GitHub Mobile for iOS or Android.
  
If you’ve attached a copy via email it won’t work probably. Can you send it to me via ***REDACTED*** please?

> On 14 Nov 2021, at 18:49, rgsurfs ***@***.***> wrote:
> 
> ﻿
> We are getting our reports from Twistlock scans.  copy attached. I'll step back out of the issues for the moment.  tks for the replies.
> Robert
> On Sunday, November 14, 2021, 09:08:04 AM EST, Roman Zabaluev ***@***.***> wrote: 
> 
> 
> 
> 
> This might be a transitive dependency. There's nothing wrong with it, considering we're getting notifications about security vulnerabilities via dependabot and sonar. But thanks for the concern!
> 
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or unsubscribe.
> Triage notifications on the go with GitHub Mobile for iOS or Android.
> —
> You are receiving this because you modified the open/close state.
> Reply to this email directly, view it on GitHub, or unsubscribe.
> Triage notifications on the go with GitHub Mobile for iOS or Android. 

Current version of nimbus-jose-jwt (via spring-security) is 9.10.1.

Pull request review comments:

Patch that resolved the issue:
diff --git a/kafka-ui-react-app/package-lock.json b/kafka-ui-react-app/package-lock.json
index a82e88d5ea8..169f8df8523 100644
--- a/kafka-ui-react-app/package-lock.json
+++ b/kafka-ui-react-app/package-lock.json
@@ -7711,9 +7711,9 @@
       }
     },
     "eslint-import-resolver-node": {
-      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.5.tgz",
-      "integrity": "sha512-XMoPKjSpXbkeJ7ZZ9icLnJMTY5Mc1kZbCakHquaFsXPpyWOwK0TK6CODO+0ca54UoM9LKOxyUNnoVZRl8TeaAg==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.6.tgz",
+      "integrity": "sha512-0En0w03NRVMn9Uiyn8YRPDKvWjxCWkslUEhGNTdGx15RvPJYQ+lbOlqrlNI2vEAs4pDYK4f/HN2TbDmk5TP0iw==",
       "requires": {
         "debug": "^3.2.7",
         "resolve": "^1.20.0"


Test patch: