Could we get a new tagged release with the JWT CVE patched

[pete-woods]

• At present v4.5.3 is the latest version, but does not include the fix.
• This means dependency tools such as dependabot and rennovate do not create PRs.

[pete-woods]

Actually, it turns out that the go.mod needed updating to work: #288

[LyricTian]

Cool 👍🏻