This pull request attempts to address the following four CVEs by upgrading the minimum required version of @octokit/auth-app from v4.0.7 to v4.0.9, which implicitly upgrades jsonwebtoken to version 9.

• CVE-2022-23529 - jsonwebtoken has insecure input validation in jwt.verify function
• CVE-2022-23539 - jsonwebtoken unrestricted key type could lead to legacy keys usage
• CVE-2022-23540 - jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
• CVE-2022-23541 - jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC

See Also

• AntelopeIO/github-app-token-action pull request 5