Upgrade org.json transitive dependency to latest

[shashikanthgadgay0804]

Describe the bug
Vulnerability in org.json package. More details here
https://nvd.nist.gov/vuln/detail/CVE-2022-45688
stleary/JSON-java#708

They have released a new version yesterday, is it possible for you to upgrade and release a new version of jjwt ?
https://github.com/stleary/JSON-java/releases/tag/20230227

[lhazlewood]

Thanks for reporting this! We will upgrade and release as soon as is feasible.

But don't forget - it is always possible (and recommended) to exclude any undesirable transitive dependency and explicitly declare the newly-fixed/updated org.json dependency yourself:

Maven: https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html#dependency-exclusions

Gradle: https://docs.gradle.org/current/userguide/dependency_downgrade_and_exclude.html#sec:excluding-transitive-deps

This way you (or anyone else) does not have to wait for a new JJWT release. HTH!