JWT Security

[CODEheures]

I use JWT V7.0.2 in my project because of Security Fixes in V7.0.0
Can you upgrade this dependency please?

[dmartin00]

Hello,
Thanks for reaching out. I've filed an internal tracking ticket - DCM-15879 - for this request.

[ollyollyollyltd]

+1 for this, I cannot currently use this SDK as our base project requires firebase/php-jwt:^7.0.0

[ollyollyollyltd]

@dmartin00 is there any update to this?

[jdiaz-vicoland]

php-jwt v6.11.0 was discovered to contain weak encryption and the recommendation would be to go with php-jwt 7.0.0

GHSA-2x45-7fc3-mxwq

I'd say this needs urgently an update

[fabriciojs]

Hey - +1 here.

Would be great to have the version updated, which seems to include only the fix so should be straight forward to update, will try to get a PR on.

[syntlyx]

"firebase/php-jwt": "7.0.3 as 6.11.1", as a temporary solution

[wayne530]

@dmartin00 Drew, would it be possible to get an update on this? We aren't expecting Docusign to drop everything else to address this, but some visibility into how it's being prioritized or when it may be scheduled would be really helpful. In addition, you seem to have some open PRs where the community is attempting to help improve this SDK, but with no follow up (Examples: #239 #253). It would be helpful to understand whether Docusign wants community support for the SDK or not, and if so, what the process is for evaluating these open PRs to decide if they are appropriate to merge in. We really appreciate your assistance and some transparency and visibility here would help us know how best to assist the team.

[samgdev99]

Even this is a vulnerability of the package php-jwt, I just made a report to Docusign to see if this helps to make them pay atention to this issue:

[dmartin00]

I've passed this feedback over to the DevCenter team and requested a response regarding timelines/prioritization of this issue.

[dmartin00]

This issue is being prioritized. Per DevCenter Engineering:

To properly address the issue, we will need to upgrade to firebase/php-jwt v7.
An important consideration is that JWT v7 requires PHP 8+ (likely PHP 8.1 as the new baseline).
Since the SDK currently supports PHP 7.4, this introduces a breaking change that requires us to define a clear migration path for customers still running on PHP 7.4.
We are currently validating the upgrade by running the full test suite against PHP 8+.
Migration strategy for PHP 7.4 customers is being discussed, including:

• Recommended upgrade path
• Communication plan
• Proposed sunset timeline for PHP 7 support

[wayne530]

This issue is being prioritized. Per DevCenter Engineering:

To properly address the issue, we will need to upgrade to firebase/php-jwt v7.
An important consideration is that JWT v7 requires PHP 8+ (likely PHP 8.1 as the new baseline).
Since the SDK currently supports PHP 7.4, this introduces a breaking change that requires us to define a clear migration path for customers still running on PHP 7.4.
We are currently validating the upgrade by running the full test suite against PHP 8+.
Migration strategy for PHP 7.4 customers is being discussed, including:

• Recommended upgrade path
• Communication plan
• Proposed sunset timeline for PHP 7 support

Just my 2 cents, but couldn't you tag a new major version of the SDK with the fix first, then figure out the upgrade path and comms? Nothing forces php 7.4 users to switch to the new major version.

[ChangingTerry]

PHP 7.4 is not in official support anymore. If you need to support it, can't the continue on this version?