JWT is a security relevant gem, but we're currently pinning it to a rather old version (~> 2.2.2, which resolves to 2.2.3 April 2021 currently).
The latest version is 2.5.0 (from August 2022) and while I couldn't find any explicit issues in the changelog that would affect us, any security updates that would come now, would come for that branch, not 2.2.z.