JWT Security Issue CVE-2020-26160

[ddibiasi]

Issue Description

Echo is using github.com/dgrijalva/jwt-go, which is officially unmaintained since April.

Today I received a notification from Github, that this library is affected by a major security issue GHSA-w73w-5m7g-f7qc. It is recommended to migrate to https://github.com/golang-jwt/jwt.

Is there currently any change planned to use golang-jwt instead of dgrijalva/jwt-go?

Checklist

• Dependencies installed
• No typos
• Searched existing issues and docs

Version/commit

Echo 4.4.0

[ddibiasi]

Seems to be already discussed: #1663 (comment)
#1873 #1916

[aldas]

summary + current workarounds #1916 (comment)