CVE-2020-26160 vulnerability fix

[cheipol]

Is your feature request related to a problem? Please describe.
Viper has dgrijalva/jwt-go (actually v 3.2.0) as a dependency. This library has a known vulnerability CVE-2020-26160.
dgrijalva/jwt-go seem to have a fix for this issue in version release-4.0.0 but it's been abandoned since January 2020.

Describe the solution you'd like to see
There are some other solutions implemented.
Have you considered using one of them?

[github-actions]

👋 Thanks for reporting!

A maintainer will take a look at your issue shortly. 👀

In the meantime: We are working on Viper v2 and we would love to hear your thoughts about what you like or don't like about Viper, so we can improve or fix those issues.

⏰ If you have a couple minutes, please take some time and share your thoughts: https://forms.gle/R6faU74qPRPAzchZ9

📣 If you've already given us your feedback, you can still help by spreading the news,
either by sharing the above link or telling people about this on Twitter:

https://twitter.com/sagikazarmark/status/1306904078967074816

Thank you! ❤️

[sagikazarmark]

Hi!

jwt-go is not a dependency of this package. It's a transitive dependency of a package (etcd to be precise) that is not compiled into the final library.

The situation will be somewhat better once #1115 can be merged.