Repository: go-kit/kit
Pull request #1172 (2021-07-27 15:49:52)

Switch to github.com/golang-jwt/jwt
Closes https://github.com/go-kit/kit/issues/1026

This PR switches to `github.com/golang-jwt/jwt` to address security vulnerability. More details in the issue and https://github.com/advisories/GHSA-w73w-5m7g-f7qc

peterbourgon: @sagikazarmark Look good to you?
sagikazarmark: After taking a more thorough look at the implementation, I'm not _sure_ that there is a breaking change, but I _suspect_ there might be.

Basically, those different types referenced in the public API are all interfaces and I assume the new package didn't break those overnight, so in _theory_ the replaced types could be backwards compatible with the old library.

In practice, though, some of the types used internally (eg. standard claims struct) are not interfaces, so those could break.

A simple test to check if there is a breaking change would be (temporarily) changing back the packages in tests to the old module to see if it works with the new code.

I'm not particularly worried about a breaking change (the library is basically abandoned after all), but if there is a breaking change, it should be released in a minor version, not a patch. Go 1.17 is just around the corner and Chris wants to cut a new release after that (hoping that we can further reduce the amount of dependency downloads).
peterbourgon: OK let's bench this until the next release.
vovinacci: @peterbourgon Do you have any preliminary release date in mind?
AliLogic: Any updates on this?
vovinacci: @sagikazarmark Done
shogo82148: I recommend to upgrade to Go 1.17 pruned module graphs.

https://golang.org/doc/go1.17#go-command

```
go mod tidy -go=1.17
```

It enables some optimizations, such as [Lazy module loading](https://golang.org/ref/mod#lazy-loading).
eli-darkly: @shogo82148 If that would require setting the minimum version to 1.17 in go.mod, I would very strongly prefer that they _not_ make that change, at least not yet. Go 1.17 was just released and we can't all immediately update our projects to require it.
sagikazarmark: > I recommend to upgrade to Go 1.17 pruned module graphs.

This is already in progress on another branch. Not sure which will be merged first yet.

Patch:
diff --git a/auth/jwt/README.md b/auth/jwt/README.md
index 97a3720..58b7d91 100644
--- a/auth/jwt/README.md
+++ b/auth/jwt/README.md
@@ -12,7 +12,7 @@ will be added to the context via the `jwt.JWTClaimsContextKey`.
 
 ```go
 import (
-	stdjwt "github.com/dgrijalva/jwt-go"
+	stdjwt "github.com/golang-jwt/jwt/v4"
 
 	"github.com/go-kit/kit/auth/jwt"
 	"github.com/go-kit/kit/endpoint"
@@ -34,7 +34,7 @@ the token string and add it to the context via the `jwt.JWTContextKey`.
 
 ```go
 import (
-	stdjwt "github.com/dgrijalva/jwt-go"
+	stdjwt "github.com/golang-jwt/jwt/v4"
 
 	"github.com/go-kit/kit/auth/jwt"
 	"github.com/go-kit/kit/endpoint"
@@ -65,7 +65,7 @@ Example of use in a client:
 
 ```go
 import (
-	stdjwt "github.com/dgrijalva/jwt-go"
+	stdjwt "github.com/golang-jwt/jwt/v4"
 
 	grpctransport "github.com/go-kit/kit/transport/grpc"
 	"github.com/go-kit/kit/auth/jwt"
diff --git a/auth/jwt/middleware.go b/auth/jwt/middleware.go
index b1c75a6..b7c89ce 100644
--- a/auth/jwt/middleware.go
+++ b/auth/jwt/middleware.go
@@ -4,9 +4,8 @@ import (
 	"context"
 	"errors"
 
-	jwt "github.com/dgrijalva/jwt-go"
-
 	"github.com/go-kit/kit/endpoint"
+	"github.com/golang-jwt/jwt/v4"
 )
 
 type contextKey string
diff --git a/go.mod b/go.mod
index 473e73b..9bf43e0 100644
--- a/go.mod
+++ b/go.mod
@@ -12,12 +12,12 @@ require (
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/clbanning/x2j v0.0.0-20191024224557-825249438eec // indirect
 	github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd // indirect
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/edsrzf/mmap-go v1.0.0 // indirect
 	github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db // indirect
 	github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8 // indirect
 	github.com/go-kit/log v0.1.0
 	github.com/go-zookeeper/zk v1.0.2
+	github.com/golang-jwt/jwt/v4 v4.0.0
 	github.com/hashicorp/consul/api v1.8.1
 	github.com/hudl/fargo v1.3.0
 	github.com/influxdata/influxdb1-client v0.0.0-20200827194710-b269163b24ab
diff --git a/go.sum b/go.sum
index 7f238d2..d1345a6 100644
--- a/go.sum
+++ b/go.sum
@@ -54,8 +54,6 @@ github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSV
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
-github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
 github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
@@ -93,6 +91,8 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.0.0 h1:RAqyYixv1p7uEnocuy8P1nru5wprCh/MH2BIlW5z5/o=
+github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=


Test patch:
diff --git a/auth/jwt/middleware_test.go b/auth/jwt/middleware_test.go
index fc7032f..32538c1 100644
--- a/auth/jwt/middleware_test.go
+++ b/auth/jwt/middleware_test.go
@@ -8,8 +8,8 @@ import (
 
 	"crypto/subtle"
 
-	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/go-kit/kit/endpoint"
+	"github.com/golang-jwt/jwt/v4"
 )
 
 type customClaims struct {