chore(deps): bump jose from 6.2.2 to 6.2.3 - #193
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
fa28eba to
b836494
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b836494. Configure here.
| vitest: | ||
| specifier: ^4.1.2 | ||
| version: 4.1.3(@types/node@25.5.2)(@vitest/coverage-v8@4.1.3)(jsdom@29.0.2(@noble/hashes@2.0.1))(vite@8.0.6(@types/node@25.5.2)(esbuild@0.28.0)(jiti@2.6.1)(tsx@4.21.0)(yaml@2.8.3)) | ||
| version: 4.1.3(@types/node@25.5.2)(@vitest/coverage-v8@4.1.3)(jsdom@29.0.2)(vite@8.0.6(@types/node@25.5.2)(esbuild@0.27.4)(jiti@2.6.1)(tsx@4.21.0)(yaml@2.8.3)) |
There was a problem hiding this comment.
Auth package still resolves to old jose version
Medium Severity
The packages/auth package — which is the primary consumer of jose for jwtVerify operations — still resolves to jose@6.2.2 in the lockfile. Its peerDependencies specifier in packages/auth/package.json was not bumped, so pnpm kept the old resolution. This means jose@6.2.2 is retained in the lockfile alongside 6.2.3, and the auth package's own test environment runs against the version without the PBES2 p2c rejection fix.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b836494. Configure here.
2bbd900 to
4cd3533
Compare
876a09a to
e1ea239
Compare
dcd5ffd to
7fe0596
Compare
Bumps [jose](https://github.com/panva/jose) from 6.2.2 to 6.2.3. - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.2...v6.2.3) --- updated-dependencies: - dependency-name: jose dependency-version: 6.2.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
7fe0596 to
552cd39
Compare
Bumps jose from 6.2.2 to 6.2.3.
Release notes
Sourced from jose's releases.
Changelog
Sourced from jose's changelog.
Commits
41ad7e9chore(release): 6.2.3988e90fchore: account for commit-and-tag-version instead of standard-version4b24656chore: update CHANGELOG.md header0cdb851refactor: cleanly reject invalid PBES2 p2ca0b261etest: update Bun expectationsb39dc1achore: use fs.globSync0675be1build: replace rollup umd build with a custom esbuild iife wrap9b03323chore: bump packages914b73dchore(deps-dev): bump lodash9dce817chore: bump packages