[Snyk] Security upgrade com.auth0:java-jwt from 4.3.0 to 4.6.0

[chrislin22]

Snyk has created this PR to fix 1 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pulsar-broker-auth-oidc/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Deserialization of Untrusted Data SNYK-JAVA-COMFASTERXMLJACKSONCORE-17440598	735	com.auth0:java-jwt: 4.3.0 -> 4.6.0 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

[chrislin22]

This is a minor version upgrade for java-jwt from 4.3.0 to 4.6.0. The releases within this range introduce dependency updates, bug fixes, and minor behavioral changes that require verification.

Key Changes:

• Dependency Updates: The library updated its Jackson dependency in version 4.4.0.
• Behavioral Fixes: A notable fix in version 4.4.0 ensures that an empty string aud (audience) claim is correctly deserialized as an empty string instead of being treated as null or absent.
• Java Support: The library now officially documents support for Java 21.

Potential Impact:

• The update to the Jackson dependency could introduce subtle changes in JSON processing behavior.
• Applications that rely on the previous behavior of how empty audience claims were handled may be affected.

Recommendation: Verify that your application's token validation logic, particularly concerning audience claims, functions as expected after the upgrade. A thorough regression test is advised to catch any unexpected behavior from the dependency updates.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.