I am trying to figure out whether i should pick(based on the adoption):

-

So, are developers picking jose4j, is it a good choice(am i being paranoid?) or should i move to nimbus(the Used By artifacts is more for nimbus, does it mean it s more widely adopted?)

CodePudding user response：

Looks like that vulnerability is in Logback, which is a dependency that's only used in the unit tests (further down that page you screenshotted shows the different dependency categorizations).

I need get that updated, obviously, but it doesn't impact the library itslef.