gopkg.in/go-jose/go-jose.v2 v2.6.3 is deprecated

[marimp]

I noticed that the latest temporal.io server is still using deprecated library “gopkg.in/go-jose/go-jose.v2 v2.6.3” (in go.mod). It could be replace by the library GitHub - go-jose/go-jose: An implementation of JOSE standards (JWE, JWS, JWT) in Go withouth code reworking.

Thanks In advance
Regards
Marco

[marimp]

Have you got update about this issue?
The go-jose/go-jose module is vulnerable to Denial of Service (DoS) attacks GHSA-2c7c-3mj9-8fqh

Thanks
Regards

[yiminc]

#7404