Skip to content

chore(deps): bump jose from 6.2.1 to 6.2.3 in /web - #8

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/jose-6.2.3
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/web/jose-6.2.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 17, 2026

Copy link
Copy Markdown
Contributor

Bumps jose from 6.2.1 to 6.2.3.

Release notes

Sourced from jose's releases.

v6.2.3

Refactor

  • cleanly reject invalid PBES2 p2c (0cdb851)

v6.2.2

Fixes

  • reject failed decompression with JWEInvalid error (043b181)
Changelog

Sourced from jose's changelog.

6.2.3 (2026-04-27)

Refactor

  • cleanly reject invalid PBES2 p2c (0cdb851)

6.2.2 (2026-03-18)

Fixes

  • reject failed decompression with JWEInvalid error (043b181)
Commits
  • 41ad7e9 chore(release): 6.2.3
  • 988e90f chore: account for commit-and-tag-version instead of standard-version
  • 4b24656 chore: update CHANGELOG.md header
  • 0cdb851 refactor: cleanly reject invalid PBES2 p2c
  • a0b261e test: update Bun expectations
  • b39dc1a chore: use fs.globSync
  • 0675be1 build: replace rollup umd build with a custom esbuild iife wrap
  • 9b03323 chore: bump packages
  • 914b73d chore(deps-dev): bump lodash
  • 9dce817 chore: bump packages
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot @github

dependabot Bot commented on behalf of github May 17, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested a review from acamarata as a code owner May 17, 2026 19:21
@vercel

vercel Bot commented May 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
islamwiki Ready Ready Preview, Comment Jun 13, 2026 2:42pm
ummat-islamwiki Ready Ready Preview, Comment Jun 13, 2026 2:42pm

Request Review

@github-actions

Copy link
Copy Markdown

🔒 Dependency Audit Failed — 10 HIGH/CRITICAL vulnerability(s)

Package Severity Advisory Fix
next HIGH 1117930 Upgrade to version 16.2.5 or later
@opentelemetry/auto-instrumentations-node HIGH 1117941 Upgrade to version 0.75.0 or later
@opentelemetry/sdk-node HIGH 1117942 Upgrade to version 0.217.0 or later
@opentelemetry/exporter-prometheus HIGH 1117943 Upgrade to version 0.217.0 or later
next HIGH 1118938 Upgrade to version 16.2.6 or later
next HIGH 1118949 Upgrade to version 16.2.5 or later
next HIGH 1118953 Upgrade to version 16.2.5 or later
next HIGH 1118955 Upgrade to version 16.2.5 or later
next HIGH 1118959 Upgrade to version 16.2.5 or later
next HIGH 1118961 Upgrade to version 16.2.5 or later

To resolve: upgrade the affected packages or add an accepted-risk entry to web/.audit-allowlist.json.

Allowlist format
{
  "GHSA-xxxx-xxxx-xxxx": {
    "reason": "No fix available; mitigated by WAF rule #123",
    "expires": "2026-12-31"
  }
}

Bumps [jose](https://github.com/panva/jose) from 6.2.1 to 6.2.3.
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.1...v6.2.3)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant