Is firebase-admin affected by CVE-2022-23529 ?

[amirbilu]

GHSA-27h2-hvpr-p74q

[google-oss-bot]

I found a few problems with this issue:

• I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
• This issue does not seem to follow the issue template. Make sure you provide all the required information.

[lahirumaramba]

Thanks @amirbilu! I think the impact is minor as the sdk does not directly expose the verify() function. However, there is a chance that some build tools and deploy workflows might get blocked by having a vulnerable dependency in the dependency chain. #2025 Bumps jsonwebtoken from 8.5.1 to 9.0.0.

We will also do an emergency patch release today that includes the fixes.

[lahirumaramba]

Fixed in v11.4.1 https://github.com/firebase/firebase-admin-node/releases/tag/v11.4.1
Thanks everyone!