go.mod: replace dgrijalva/jwt-go with form3tech-oss/jwt-go

[bb7133]

What problem does this PR solve?

The github.com/dgrijalva/jwt-go is introduced indirectly, but it is not maintained anymore but contains a security vulnerability marked as high. See CVE-2020-26160.

Problem Summary:

What is changed and how it works?

Update go.mod to replace dgrijalva/jwt-go with form3tech-oss/jwt-go(it may NOT a good idea either since this repo is also archived, the recommended replacement is golang-jwt/jwt).

Check List

Tests

• No code

Documentation

Alternatives

• Tried to replace dgrijalva/jwt-go with golang-jwt/jwt v3.2.2, but the error is reported for go mod tidy: "used for two different module paths".
• Tried to replace dgrijalva/jwt-go with golang-jwt/jwt v3.2.1, but the fix is not included(upstream fix for security vulnerability from form3tech-oss/jwt-go fork golang-jwt/jwt#40).
• Tried to replace dgrijalva/jwt-go with dgrijalva/jwt-go@release_4_0_0, but the import path has been changed because of the semantic version of Go.

Release note

None

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• dveeden
• morgo

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[morgo]

The dependency is from etcd:

$ go mod why github.com/dgrijalva/jwt-go
warning: ignoring symlink /home/morgo/go/src/github.com/morgo/tidb/plugin/audit
# github.com/dgrijalva/jwt-go
github.com/pingcap/tidb/ddl/util
github.com/pingcap/tidb/ddl/util.test
go.etcd.io/etcd/etcdserver
go.etcd.io/etcd/auth
github.com/dgrijalva/jwt-go

The etcd dependency is also holding back the package google.golang.org/grpc. From some quick googling it looks like we might be importing it from an older location, but someone who understands it better might want to take a look.

[zhangjinpeng87]

@bb7133 Please address comments

[zhangjinpeng87]

Can we using https://github.com/golang-jwt/jwt directly?

[bb7133]

Can we using https://github.com/golang-jwt/jwt directly?

I've tried but it doesn't work(see "Alternatives" in description and the commit history).

[bb7133]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: eeba4da