Dependency jwk-rs is unmaintained

[howardjohn]

Currently https://github.com/nhynes/jwk-rs is a dependency, pulling in some critical crypto operations (ring, etc), but is seemingly abandoned. This transitively pulls in things like a 3 year old version of ring, etc, which is not great. Maintenance PRs against the dep are going unmerged for years: nhynes/jwk-rs#13, etc.

It would be good to plan an alternative strategy for this dependency

[maxlambrecht]

hi @howardjohn, thanks for pointing this out. I see the issue with relying on an unmaintained library, especially for critical crypto operations. I’ll look into other options.

Do you have any alternative libraries in mind that could replace jwk-rs?

[howardjohn]

Do you have any alternative libraries in mind that could replace jwk-rs?

At the moment I don't, I don't have a ton of experience in this space. There may be one, haven't had a chance to explore much.

[bleggett]

We should maybe just use https://github.com/Keats/jsonwebtoken directly.