[Snyk] Security upgrade node-jose from 2.0.0 to 2.1.0

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	No	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-jose

The new version differs by 26 commits.

• 38dc55c Merge pull request chore(deps): bump eslint from 8.8.0 to 8.9.0 opengovsg/mockpass#345 from justaugustus/release-v2.1.0
• de3ea9f v2.1.0: Release commit
• 427c640 Merge pull request chore(deps): bump expiry-map from 1.1.0 to 2.0.0 opengovsg/mockpass#344 from justaugustus/dep-fixes
• 5538311 package.json: Replace `gulp-util` with `fancy-log`
• 653c629 Merge pull request Dependabot updates opengovsg/mockpass#342 from justaugustus/dep-fixes
• 34a66ca .github: Add baseline dependabot config
• dd1b68b package.json: Dependency updates
• f626e9d lib/jwk: Explicitly use uuid v4
• 10cc052 package.json: Update to [email protected]
• 7d430f2 package.json: Dependency updates
• 8757eb7 generated: Run `npm update`
• ae5a809 Merge pull request chore(deps): bump dotenv from 14.3.2 to 15.0.1 opengovsg/mockpass#340 from cisco/dependabot/npm_and_yarn/cached-path-relative-1.1.0
• 90a3637 build(deps): bump cached-path-relative from 1.0.2 to 1.1.0
• 81d35de Merge pull request chore(deps): bump lint-staged from 12.3.2 to 12.3.3 opengovsg/mockpass#339 from cisco/fluffy-dep1
• ce03583 upgrade to node-forge 1.2.1
• 5464642 Merge pull request chore(deps): bump lint-staged from 12.3.1 to 12.3.2 opengovsg/mockpass#334 from cisco/dependabot/npm_and_yarn/node-forge-1.0.0
• 69ec9f2 Merge pull request chore(deps): bump eslint from 8.5.0 to 8.6.0 opengovsg/mockpass#313 from TechTeamer/fix/decrypt-default-options
• 20515e5 Merge pull request chore(deps): bump @commitlint/travis-cli from 16.0.2 to 16.0.3 opengovsg/mockpass#326 from dlh3/patch-1
• 6e1bdc8 build(deps): bump node-forge from 0.10.0 to 1.0.0
• afafbe1 Merge pull request Replace node-jose with jose opengovsg/mockpass#328 from bloxsome/develop
• 43045fe updated changelog and incremented package.json
• 683eed7 dependency update
• 9a1b1fb Minor README example fixes
• 58bd293 add test case

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic