Vulnerabilities in jose4j 0.9.6 dependency

[ntpruebas1]

This dependency has vulnerabilities

org.bitbucket.b_c jose4j 0.9.6

Ref: https://mvnrepository.com/artifact/org.bitbucket.b_c/jose4j/0.9.6

CVE-2024-30171
CVE-2024-29857
CVE-2023-6378
CVE-2023-33201

[brendandburns]

These appear to all be vulnerabilities in things that jose4j depends on, not vulnerabilities in jose4j itself.

For those dependencies, if you look through the versions that we depend on in our pom.xml all of those dependencies are updated past the vulnerable version.

As far as I know, Maven only uses a single version of the library when building/compiling, so I'm pretty sure that none of these vulnerabilities apply to this library.

I'm going to close this, please add a comment with /reopen if you need further assistance.