When using composer update I get a message about a vulnerability with version 5 of firebase/php-jwt installed with CiviCRM- how can I fix this?

Question

I have CiviCRM 5.63.1 installed with the latest Drupal 9 (9.5.10) - when running composer update I get a message about a vulnerability with firebase/php-jwt with versions less than 6. Looking in the composer.lock file in the root of my site, civicrm/civicrm-core is expecting a version less than 6. I have tried altering the composer.json file in the vendor/civicrm/civicrm-core location to bring in version 6 but each time this lock file reverts to downloading v5.5.1 instead. How can I get version 6 installed so the vulnerability alert will disappear?

Extract of the composer.lock file below (see last line).

        {
        "name": "civicrm/civicrm-core",
        "version": "5.63.1",
        "source": {
            "type": "git",
            "url": "https://github.com/civicrm/civicrm-core.git",
            "reference": "27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58"
        },
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/civicrm/civicrm-core/zipball/27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58",
            "reference": "27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58",
            "shasum": ""
        },
        "require": {
            "adrienrn/php-mimetyper": "0.2.2",
            "brick/money": "~0.5",
            "civicrm/civicrm-cxn-rpc": "~0.20.12.01 || ~0.19.01.10",
            "civicrm/composer-compile-lib": "~0.6 || ~1.0",
            "civicrm/composer-downloads-plugin": "^3.0",
            "composer-runtime-api": "~2.0",
            "cweagans/composer-patches": "~1.0",
            "dompdf/dompdf": "~2.0.2",
            "ext-fileinfo": "*",
            "ext-intl": "*",
            "ext-json": "*",
            "ezyang/htmlpurifier": "^4.13",
            "firebase/php-jwt": ">=3 <6",

Many thanks for your help in advance.