Please upgrade dependencies about node-jwks-rsa

[icco]

I attempted to do this in https://github.com/auth0/node-jwks-rsa/pull/365/files but could not get the tests to pass.

[adamjmcgrath]

Hi @icco - thanks for raising this

The dependency jsonwebtoken has three medium security vulns this package brings in.

This dependency (same with superagent and formidible) are dev dependencies, used in testing - so this library doesn't bring any of them in when you install this package.

Also, the version of jsonwebtoken that it uses in its testing has been patched for the vulnerabilities you've mentioned

I attempted to do this in #365 (files) but could not get the tests to pass.

Thank you for attempting to update the dev dependencies, we'll take a look at updating them shortly

[icco]

Hmm, npm (and various security scanners such as snyk and sonatype) think the jsonwebtoken dependency is bringing vulnerabilities into this package.

I wonder if there's some weird dependency resolution happening because of the multiple versions of express-jwt in dev

[adamjmcgrath]

Don't see any issues in Snyk https://snyk.io/advisor/npm-package/jwks-rsa - let me investigate further

[adamjmcgrath]

Ah ok, it looks like they're being picked up in the example packages eg https://github.com/auth0/node-jwks-rsa/tree/2fd4582d2be5f3e4fd6ed0d6f2d8bd7103f7434d/examples/koa-demo

I'll make sure we update them when we update the dev dependencies