build(deps): Bump firebase/php-jwt from 7.0.1 to 7.0.2 #16635
Conversation
dependabot
bot
added
dependencies
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Bumps [firebase/php-jwt](https://github.com/firebase/php-jwt) from 7.0.1 to 7.0.2. - [Release notes](https://github.com/firebase/php-jwt/releases) - [Changelog](https://github.com/firebase/php-jwt/blob/main/CHANGELOG.md) - [Commits](firebase/php-jwt@v7.0.1...v7.0.2) --- updated-dependencies: - dependency-name: firebase/php-jwt dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Signed-off-by: Joas Schilling <[email protected]>
nickvergessen
force-pushed
the
dependabot/composer/firebase/php-jwt-7.0.2
branch
from
9b28dd9 to
1e40905
Compare
| if (str_starts_with($alg, 'ES')) { | ||
| $privKey = openssl_pkey_new([ | ||
| 'curve_name' => 'prime256v1', | ||
| 'curve_name' => $alg === 'ES384' ? 'secp384r1' : 'prime256v1', |
There was a problem hiding this comment.
@fancycode Not sure this has any impact on the code you need in the HPB?
From general side, I guess this means we have to regenerate the key on updating when that algorithm is used? Because the generated key is too weak otherwise:
1) OCA\Talk\Tests\php\ConfigTest::testSignalingTicketV2User with data set #0 ('ES384')
DomainException: Provided key is too short
/home/nickv/Nextcloud/33/server/appsbabies/spreed/lib/Vendor/Firebase/JWT/JWT.php:745
/home/nickv/Nextcloud/33/server/appsbabies/spreed/lib/Vendor/Firebase/JWT/JWT.php:274
/home/nickv/Nextcloud/33/server/appsbabies/spreed/lib/Vendor/Firebase/JWT/JWT.php:232
/home/nickv/Nextcloud/33/server/appsbabies/spreed/lib/Config.php:673
/home/nickv/Nextcloud/33/server/appsbabies/spreed/lib/Config.php:491
/home/nickv/Nextcloud/33/server/appsbabies/spreed/tests/php/ConfigTest.php:411
There was a problem hiding this comment.
The signaling server should already support these 384 bit keys:
https://github.com/strukturag/nextcloud-spreed-signaling/blob/9ba9256edbdc11c219c6746833c0c9f883cd012e/hub.go#L1474-L1481
I'll try to test the PR the coming days.
nickvergessen
added
2. developing
feature: signaling 📶
fancycode
left a comment
fancycode
left a comment
There was a problem hiding this comment.
👍 No changes required in the signaling server. EC384 tokens are working fine.
However you need to re-generate existing keys if they are too short, similar to what you are already doing in the check for matching public/private keys.
Bumps firebase/php-jwt from 7.0.1 to 7.0.2.
Release notes
Sourced from firebase/php-jwt's releases.
Changelog
Sourced from firebase/php-jwt's changelog.
... (truncated)
Commits
5645b43chore(main): release 7.0.2 (#616)7044f9afix: add key length validation for ec keys (#615)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)