Hi folks,

This package currently depends on https://github.com/dgrijalva/ that has an un-patched security vulnerability. There are more details in:

• The initial bug report Security Vulnerability: failed type assertion leads to bypassing Audience verification dgrijalva/jwt-go#422
• A proposed PR Fix security issue with aud validation dgrijalva/jwt-go#429
• Ongoing conversation where they're trying to get support to merge this in High Severity Security Vulnerability - Access Restriction Bypass dgrijalva/jwt-go#428

I'm wondering whether it's possible to update adal to use another package (it seems a few places are moving to https://github.com/square/go-jose), or perhaps a fixed fork of jwt-go (https://github.com/form3tech-oss/jwt-go/)

Thanks!