[Snyk] Upgrade jose from 5.3.0 to 6.1.3

[nerdy-tech-com-gitub]

Snyk has created this PR to upgrade jose from 5.3.0 to 6.1.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 35 versions ahead of your current version.

• The recommended version was released 2 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	57	Proof of Concept
	Command Injection SNYK-JS-GLOB-14040952	57	Proof of Concept
	Insecure Randomness SNYK-JS-UNDICI-8641354	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITENDPOINT-8730856	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITPLUGINPAGINATEREST-8730855	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITREQUEST-8730853	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-OCTOKITREQUESTERROR-8730854	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	57	Proof of Concept
	Missing Release of Memory after Effective Lifetime SNYK-JS-UNDICI-10176064	57	Proof of Concept

Release notes

Package name: jose

• 6.1.3 - 2025-12-02
  

  Refactor

  • avoid export * as for google closure's compiler sake (6303d98), closes #832
• 6.1.2 - 2025-11-15
  

  Refactor

  • fallback to checking instanceof for CryptoKey (901cd90), closes #765 #803 #821 #827 #828
• 6.1.1 - 2025-11-09
  

  Documentation

  • add link to RFC9864 (767edde)
  • link to ML-DSA for JOSE (ed4252c)
  • remove mention of Edge Runtime from the readme (94fdde7)
  • update README.md (25098ef)

  Refactor

  • eliminate named exports in the source code (f6ae30d)
  • expose setKeyManagementParameters also on a GeneralEncrypt Recipient (16e6b23)
  • faster path for symmetric key checks (a44c2ec)
  • improve en/decoding overheads (daee426)
• 6.1.0 - 2025-08-27
  

  Features

  • support AKP JWKs in calculateJwkThumbprint and calculateJwkThumbprintUri (cf2092a)
  • support for the ML-DSA PQC Algorithm Identifiers (25ddce4)
• 6.0.13 - 2025-08-21
  

  Refactor

  • more readability in ecdhes.ts (84da9de)
  • update asn1.ts helpers (b4f8fb3)
• 6.0.12 - 2025-07-15
  

  Documentation

  • add known caveats to customFetch (02e1f1e)
  • mention the apu/apv parameter names in setKeyManagementParameters (6274d5a)
  • update compact setKeyManagementParameters (2f44381)
  • use GitHub Flavored Markdown for notes and warnings (f6b4ffc)

  Refactor

  • createPublicKey is not a constructor (61ded78)
  • update asn1.ts helper functions (b2b611c)
• 6.0.11 - 2025-05-05
  

  Fixes

  • typ checking edge-cases when it contains a slash (/) character (31e4baf)
• 6.0.10 - 2025-03-12
  

  Refactor

  • removed unused claims methods (74719cf)
  • reorganize jwt claim set utils (1f12d88)
• 6.0.9 - 2025-03-11
  

  Documentation

  • add more symbol document, ignore ts-private fields (8b73687)
  • bump typedoc (6163a8b)
  • drop cdnjs links in README (a910038)
  • drop denoland/x links in README and add jsr (3662b9e)
  • fix key export links from docs/README.md (c8edfc2)

  Refactor

  • always assume structuredClone is present (f7898a9)
  • hide internal private fields and drop ProduceJWT inheritance (ab18881)
  • less objects when JWE JWT Replicated Header Parameters are used (c763a0e)
• 6.0.8 - 2025-02-26
  

  Fixes

  • export [customFetch] symbol from the default entrypoint (1615614), closes #762
• 6.0.7 - 2025-02-25
• 6.0.6 - 2025-02-23
• 6.0.5 - 2025-02-23
• 6.0.4 - 2025-02-22
• 6.0.3 - 2025-02-22
• 6.0.2 - 2025-02-22
• 6.0.1 - 2025-02-22
• 6.0.0 - 2025-02-22
• 5.10.0 - 2025-02-17
• 5.9.6 - 2024-10-20
• 5.9.5 - 2024-10-20
• 5.9.4 - 2024-10-11
• 5.9.3 - 2024-09-22
• 5.9.2 - 2024-09-14
• 5.9.1 - 2024-09-13
• 5.9.0 - 2024-09-13
• 5.8.0 - 2024-08-26
• 5.7.0 - 2024-08-19
• 5.6.3 - 2024-07-03
• 5.6.2 - 2024-06-27
• 5.6.1 - 2024-06-27
• 5.6.0 - 2024-06-27
• 5.5.0 - 2024-06-26
• 5.4.1 - 2024-06-18
• 5.4.0 - 2024-06-03
• 5.3.0 - 2024-05-10

from jose GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs