Skip to content

chore: Update jsonwebtoken to 9.0.3 to resolve jws HMAC vulnerability#1172

Merged
manisha1997 merged 2 commits intomainfrom
copilot/update-jsonwebtoken-dependency
Feb 19, 2026
Merged

chore: Update jsonwebtoken to 9.0.3 to resolve jws HMAC vulnerability#1172
manisha1997 merged 2 commits intomainfrom
copilot/update-jsonwebtoken-dependency

Conversation

Copy link
Contributor

Copilot AI commented Feb 19, 2026 •
edited
Loading

Problem

jsonwebtoken@9.0.2 depends on jws@3.2.2, which contains a HIGH severity vulnerability (GHSA-869p-cjfg-cm3x) in HMAC signature verification.

Changes

  • Update jsonwebtoken dependency from ^9.0.2 to ^9.0.3

This resolves the transitive dependency:

jsonwebtoken@9.0.2 → jws@3.2.2 (vulnerable)
jsonwebtoken@9.0.3 → jws@4.0.1 (patched)

No API changes or breaking changes.

Original prompt

This section details on the original issue you should resolve

<issue_title>Security: jsonwebtoken dependency uses vulnerable jws@3.2.2</issue_title>
<issue_description>## Summary
The twilio package depends on jsonwebtoken@9.0.2 which in turn uses jws@3.2.2, which has a HIGH severity vulnerability (GHSA-869p-cjfg-cm3x) regarding improper HMAC signature verification.

Vulnerability Details

  • Package: jws
    • Vulnerable versions: <3.2.3
      • Patched versions: >=3.2.3

Request

Please update jsonwebtoken to a version that uses jws@3.2.3 or later, or update the dependency chain to resolve this vulnerability.

Current Path

`twilio@5.11.1 </issue_description>

Comments on the Issue (you are @copilot in this section)

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

@manisha1997
Security fix: Update jsonwebtoken to ^9.0.3 to resolve jws vulnerability
019ae1a 
Co-authored-by: manisha1997 <28821901+manisha1997@users.noreply.github.com>
Copilot AI changed the title [WIP] Update jsonwebtoken to address jws vulnerability Security: Update jsonwebtoken to 9.0.3 to resolve jws HMAC vulnerability Feb 19, 2026
Copilot AI requested a review from manisha1997 February 19, 2026 08:32
@manisha1997 manisha1997 marked this pull request as ready for review February 19, 2026 08:37
@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 19, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@manisha1997 manisha1997 changed the title Security: Update jsonwebtoken to 9.0.3 to resolve jws HMAC vulnerability chore: Update jsonwebtoken to 9.0.3 to resolve jws HMAC vulnerability Feb 19, 2026
@manisha1997 manisha1997 merged commit 9b11787 into main Feb 19, 2026
13 of 17 checks passed
@manisha1997 manisha1997 deleted the copilot/update-jsonwebtoken-dependency branch February 19, 2026 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kridai kridai kridai approved these changes

+1 more reviewer

@manisha1997 manisha1997 manisha1997 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@manisha1997 manisha1997

Copilot code review Copilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Security: jsonwebtoken dependency uses vulnerable jws@3.2.2

3 participants

@kridai @manisha1997