Bug Report: [SECURITY] OIDC Connector bundles vulnerable nimbus-jose-jwt

[lprimak]

Brief Summary

fish.payara.security.connectors:security-connector-oidc-client:4.0.0.Alpha3
bundles nimbus-jose-jwt via the shade plugin, which is flagging as having CVE / vulnerability.
This is brought in by Payara which makes the whole thing flag as moderate severity

Expected Outcome

security connector needs to be upgraded with fixed nimbus-jose-jwt module

Current Outcome

Payara is being flagged as moderate vuln

Reproducer

N/A

Operating System

Any

JDK Version

Any

Ecosystem Tool

Security Connectors

[artur-mal]

Thank you for the report.
I have escalated it to the platform development team under internal reference FISH-13036.

[lprimak]

A better question: Why does OIDC bundle jose-numbus-jwt via shade plugin?
Why not just have a regular maven transitive dependency?
This way, security update can be handled externally.