Refresh JWT chain in yarn.lock: jsonwebtoken 8→9, jws 3→4 (Wiz #11)

[claudesecuritypatcher]

Part of #11 (Wiz posture issue 29ccf336-36e1-4d5e-ba34-ce958b0c3f94).

Why this matters

This action signs a JWT with the GitHub App's private key and swaps it for an installation token. The signing goes through @octokit/auth-app → universal-github-app-jwt → jsonwebtoken. The lockfile still pinned jsonwebtoken 8.5.1 and jws 3.2.2. Both have known flaws in how keys and algorithms are checked, and in the worst case those let a token be forged or verified with the wrong key. The semver 5.x it drags in also has a regex that can be made to hang. This is runtime code: ncc bundles it into dist/index.js, which every workflow using the action runs. The action only signs and never verifies an untrusted token, so the practical exposure is small, but it is still the code path that handles the private key.

Risk of this change

This is a lockfile-only change and package.json is untouched. universal-github-app-jwt@^1.0.1 already allowed 1.2.0; the lock was just stale at 1.1.0. 1.2.0's only change is moving to jsonwebtoken@^9. jsonwebtoken 9's breaking changes are on the verify side: it rejects insecure key types and none-algorithm tokens by default. The action signs with an RSA key using RS256, which v9 still accepts. Nothing else in the tree moves apart from one duplicate that yarn-deduplicate collapsed.

Verification

I ran the steps from test.yml locally on Node with yarn 1.22.22:

• yarn install --frozen-lockfile passes.
• yarn run yarn-deduplicate --fail --strategy fewer passes.
• yarn run build passes (ncc, 561 kB dist/index.js).
• yarn run xo passes.
• yarn run prettier --check fails on README.md. It fails the same way on main (from commit f61e816), so it is not caused by this change.

The lock now resolves universal-github-app-jwt@1.2.0, jsonwebtoken@9.0.3, jws@4.0.1 and jwa@2.0.1. yarn audit --groups dependencies no longer reports any high-severity runtime advisory. I did not do a live token exchange against GitHub.

CI on this PR: Test fails only at the Format step, the same README.md prettier failure that main has; install, dedupe and build pass before it. Wiz Vulnerability Scanner is still red, which I expected because of the moderate and dev-only advisories listed below. Don't read this PR as making the branch scan clean.

These are still open, and are why this PR says "Part of":

• Unknown target package: the Wiz finding body doesn't name the package it flags (siblings Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities #12 and Open source code package in a code repository causing multiple Critical/High exploitable vulnerabilities #13 are the same policy). If Wiz still reports this branch after the rescan, the finding points at a package this PR doesn't touch.
• Moderate runtime advisories: @octokit/request <8.4.1, @octokit/request-error <5.1.1 and @octokit/plugin-paginate-rest <9.2.2 are ReDoS bugs in parsing GitHub API responses. Clearing them needs major bumps of @actions/github 5→6 and @octokit/auth-app 4→6, which is out of scope here. Dependabot Bump the npm_and_yarn group across 1 directory with 10 updates #10 attempts part of this and its Test check is red.
• uuid <11.1.1 via @actions/core: this one is moderate too and also needs a major bump.
• Dev-only advisories (xo/eslint tree): these never reach dist/ and are not touched here.

🤖 Generated with Claude Code

[wiz-7490d7165e]

 Vulnerability Finding

More Details

Vulnerabilities [semver:5.7.1]

Name	Severity	Source	Fixed version	CVSS score	CVSS exploitability score	Has public exploit	Has CISA KEV exploit
CVE-2022-25883		https://github.com/advisories/GHSA-c2qf-rxjj-qqgw	5.7.2	7.5	3.9	false	false

To ignore this finding as an exception, reply to this conversation with #wiz_ignore reason

If you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).

To get more details on how to remediate this issue using AI, reply to this conversation with #wiz remediate

[claudesecuritypatcher]

CI check after push. Test fails only at the Format step (yarn run prettier --check → [warn] README.md, run 37751361862). Install, dedupe and build pass before it. This PR changes only yarn.lock. README.md is identical to main (f61e816), and npx prettier --check README.md fails the same way there, so this was broken on the base before the PR. I have left the build alone. Wiz Vulnerability Scanner is still red, as the body expects: the moderate @octokit/* and uuid advisories still need major bumps, and the posture finding doesn't name its package. That is why this stays "Part of #11" and keeps the partial label.

[claudesecuritypatcher]

Its own checks are failing

Test, Wiz Vulnerability Scanner fails, so this PR cannot be merged as it stands. If the base has moved on since it was opened it may be obsolete; closing it with a one-line reason is a valid answer, and the finding returns to the automation against the current base.

Automated check on each sweep; this comment is rewritten in place. The security review, if any, is a separate comment.