Update to nimbus-jose-jwt:9.31

[sjohnr]

Update to nimbus-jose-jwt:9.31

[stefanocke]

Meanwhile, this causes a dependency convergency error between Spring Auth Server 1.1.0 and Spring Security because of the downgrade to nimbus-jose-jwt:9.24.4 in spring-projects/spring-security@4ffece7
(Spring Boot 3.1.5 dependency management)

[jgrandja]

@stefanocke com.nimbusds:oauth2-oidc-sdk is not used by this project. How is this causing an issue?

[stefanocke]

@jgrandja , the convergence error that we have seen came from nimbus-jose-jwt itself, wich comes as depenedency from spring-security-oauth2 , but also from spring authorization server itself, as seen above.
I was assuming, that it was caused by spring-projects/spring-security@4ffece7 , since there the version of com.nimbusds:nimbus-jose-jwt has been downgraded from 9.31 to 9.24.4. But such a downgrade was not done in Spring Auth Server as well. Maybe I misunderstood the Spring Security issue, but we have definitely seen the convergence error above when using Spring Boot 3.1 + Spring Auth Server 1.1.0

But please see it more as a hint to others than a bug. It can be easily fixed by some depnedencyManagement section in the pom.xml.