fix: update dependency jwks-rsa to v3

Open renovate[bot] opened this issue 3 years ago • 0 comments

This PR contains the following updates:

Package	Change	Age	Confidence
jwks-rsa	`^1.8.1` → `^3.0.0`

Release Notes

auth0/node-jwks-rsa (jwks-rsa)

`v3.2.1`

Compare Source

Full Changelog

Added

docs: Add Ask DeepWiki badge to README #445 (arpit-jn)

Fixed

fix: Migrate to WHATWG URL API from node's core url #465 (cschetan77)
fix: Moving @types/express to dev and re generating package lock #464 (cschetan77)

`v3.2.0`

Compare Source

Full Changelog

Changed

Bump express from 4.18.2 to 4.19.2 #408 (dependabot[bot])
Bump braces from 3.0.2 to 3.0.3 #413 (dependabot[bot])
Bump jose from 4.15.4 to 4.15.5 #402 (dependabot[bot])
Bump codecov/codecov-action from 3.1.4 to 3.1.5 #396 (dependabot[bot])
Bump actions/cache from 3 to 4 #395 (dependabot[bot])
Update automated release process to latest version #391 (frederikprijck)
Bump actions/github-script from 6 to 7 #387 (dependabot[bot])
chore(deps): Update Lockfile #386 (evansims)
Bump actions/setup-node from 3 to 4 #382 (dependabot[bot])
Bump @babel/traverse from 7.10.1 to 7.23.2 #381 (dependabot[bot])

Fixed

[Fix] Change type of unused req param to unknown to resolve type conflicts #394 (zackdotcomputer)
fix(compat): ensure WebCryptoAPI runtime imported keys are re-exportable #409 (panva)
fix: express-jwt types #412 (jfromaniello)

`v3.1.0`

Compare Source

Full Changelog

Changed

Bump express from 4.18.2 to 4.19.2 #408 (dependabot[bot])
Bump braces from 3.0.2 to 3.0.3 #413 (dependabot[bot])
Bump jose from 4.15.4 to 4.15.5 #402 (dependabot[bot])
Bump codecov/codecov-action from 3.1.4 to 3.1.5 #396 (dependabot[bot])
Bump actions/cache from 3 to 4 #395 (dependabot[bot])
Update automated release process to latest version #391 (frederikprijck)
Bump actions/github-script from 6 to 7 #387 (dependabot[bot])
chore(deps): Update Lockfile #386 (evansims)
Bump actions/setup-node from 3 to 4 #382 (dependabot[bot])
Bump @babel/traverse from 7.10.1 to 7.23.2 #381 (dependabot[bot])

Fixed

[Fix] Change type of unused req param to unknown to resolve type conflicts #394 (zackdotcomputer)
fix(compat): ensure WebCryptoAPI runtime imported keys are re-exportable #409 (panva)
fix: express-jwt types #412 (jfromaniello)

`v3.0.1`

Compare Source

Full Changelog

Added

feat: resolve bun/deno compat issues #374 (panva)

`v3.0.0`

Compare Source

Full Changelog

Fixed

update types/jsonwebtoken update v9.0.0 #349 (ToshihitoKon)
Bump jsonwebtoken from 8.5.1 to 9.0.0 #344 (dependabot[bot])

`v2.1.5`

Compare Source

Full Changelog

⚠️ BREAKING CHANGES

This release drops support for Node 10 and 12

[major] bump jose #333 (panva)

`v2.1.4`

Compare Source

Full Changelog

Fixed

Fix GetVerificationKey typing to include undefined #329 (AaronMoat)

`v2.1.3`

Compare Source

Full Changelog

Fixed

Type definitions depend on jsonwebtoken #314 (adamjmcgrath)

`v2.1.2`

Compare Source

Full Changelog

Fixed

Fix issue with ES Express import #310 (adamjmcgrath)

`v2.1.1`

Compare Source

Full Changelog

Fixed

fix: express build error #304 (blindperson)

`v2.1.0`

Compare Source

Full Changelog

Fixed

fix: types-compabitility for express-jwt @ 7 #301 (carboneater)

`v2.0.5`

Compare Source

Full Changelog

Added

add support for express-jwt@7 #297 (jfromaniello)

Fixed

fix(type): correct the wrong type of the getSigningKey function arg… #289 (stegano)

`v2.0.4`

Compare Source

Full Changelog

Fixed

Destroy the request when reaches the timeout (#270) #271 (amrsalama)
[SDK-2833] Fix issue where errors were being cached #268 (adamjmcgrath)

`v2.0.3`

Compare Source

Fixed

Fix retrieveSigningKeys error #242 (davidpatrick)

Security

Bump jose from 2.0.3 to 2.0.5 #244 (dependabot)

`v2.0.2`

Compare Source

Fixed

Interceptor bind client #237 (erikfried)
Update type def for getSigningKey #236 (davidpatrick)
Use hostname instead of host when creating request #233 (cjlpowers)

`v2.0.1`

Compare Source

Added

Callback backwards compatbility for getSigningKey #227 (davidpatrick)

Fixed

Fix typescript declarations for v2 #229 (davidpatrick)
Fix typescript types for fetcher #231 (itajaja)

With version 2 we have added full JWK/JWS support. With this we have bumped the node version to minimum 10. We have also removed Axios and exposed a fetcher option to allow user's to completely override how the request to the jwksUri endpoint is made.

Breaking Changes

Drops support for Node < 10
No more callbacks, using async/await(promises)
Removed Axios and changed the API to JwksClient

Changes

Added

Full JWK/JWS Support #205 (panva)

Changed

Simplify request wrapper #218 (davidpatrick)
Pins to Node Version 10,12,14 #212 (davidpatrick)
Migrate from callbacks to async/await #222 (davidpatrick)

Migration Guide from v1 to v2

Proxies

The proxy option has been removed from the JwksClient. Support for it was a little spotty through Axios, and we wanted to allow users to have more control over the flow. Now you can specify your proxy by overriding the requestAgent used with an agent with built-in proxy support, or by completely overriding the request library with the fetcher option.

// OLD
const oldClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  proxy: 'https://username:pass@address:port'
});

// NEW
const HttpsProxyAgent = require('https-proxy-agent');
const newClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgent: new HttpsProxyAgent('https://username:pass@address:port')
});

Request Agent Options

The library no longer gates what http(s) Agent is used, so we have removed requestAgentOptions and now expose the requestAgent option when creating a jwksClient.

// OLD
const oldClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgentOptions: {
    ca: fs.readFileSync(caFile)
  }
});

// NEW
const newClient = jwksClient({
  jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
  requestAgent: new https.Agent({
    ca: fs.readFileSync(caFile)
  })
});

Migrated Callbacks to Async/Await

The library no longer supports callbacks. We have migrated to async/await(promises).

// OLD
client.getSigningKey(kid, (err, key) => {
  const signingKey = key.getPublicKey();
});

// NEW
const key = await client.getSigningKey(kid);
const signingKey = key.getPublicKey();

`v1.12.3`

Compare Source

Added

Add alg to SigningKey types #220 (okko)

Fixed

Fix npmjs resolves #221 (adamjmcgrath)
Fix Import default Axios instance #216 (dsebastien)

`v1.12.2`

Compare Source

Fixed

Added coverage folders to .npmignore

`v1.12.1`

Compare Source

Security

Bump Axios to ^0.21.1 #208 (72636c)

`v1.12.0`

Compare Source

Added

Provide an alternative source for supplying keysets #202 (davidpatrick)

Deprecation We are deprecating passing in a jwksObject to the client for reasons laid out in #202. In order to load keys from anything other than the jwksUri, please use the getKeysInterceptor.

  const client = new JwksClient({ 
    jwksUri: 'https://my-enterprise-id-provider/.well-known/jwks.json',
    getKeysInterceptor: (cb) => {
      const file = fs.readFileSync(jwksFile);
      return cb(null, file.keys);
    }
  });