Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor: upgrade jwks-rsa from 1.12.3 to 2.0.5 #7800

Merged
merged 1 commit into from
Feb 9, 2022
Merged

refactor: upgrade jwks-rsa from 1.12.3 to 2.0.5 #7800

merged 1 commit into from
Feb 9, 2022

Conversation

snyk-bot
Copy link
Contributor

@snyk-bot snyk-bot commented Feb 9, 2022

Snyk has created this PR to upgrade jwks-rsa from 1.12.3 to 2.0.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 6 versions ahead of your current version.
  • The recommended version was released 4 months ago, on 2021-10-15.
Release notes
Package name: jwks-rsa
  • 2.0.5 - 2021-10-15

    Fixed

  • 2.0.4 - 2021-07-16

    …386317c08d8

    [Snyk] Upgrade debug from 4.1.1 to 4.3.2

  • 2.0.3 - 2021-04-22

    [2.0.3] - (2021-04-20)

    Fixed

    Security

  • 2.0.2 - 2021-03-25

    [2.0.2] - (2021-03-24)

    Fixed

  • 2.0.1 - 2021-03-13

    [2.0.1] - (2021-03-12)

    Added

    Fixed

  • 2.0.0 - 2021-03-11

    With version 2 we have added full JWK/JWS support, bumped Node version support to minimum 10, removed Axios, and exposed a fetcher option to allow user's to completely override how the request to the jwksUri endpoint is made.

    Please take note of the breaking changes and the migration guide below.

    Breaking Changes

    • Drops support for Node < 10
    • No more callbacks, using async/await(promises)
    • Removed Axios and changed the API to JwksClient

    Changes

    Added

    Changed

    Migration Guide from v1 to v2

    Proxies

    The proxy option has been removed from the JwksClient. Support for it was a little spotty through Axios, and we wanted to allow users to have more control over the flow. Now you can specify your proxy by overriding the requestAgent used with an agent with built-in proxy support, or by completely overriding the request library with the fetcher option.

    https://sandrino.auth0.com/.well-known/jwks.json',
    requestAgent: new HttpsProxyAgent('https://username:pass@address:port')
    });">
    // OLD
    
const oldClient = jwksClient({
    
jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
    
proxy: 'https://username:pass@address:port'
    
});
    

    // NEW
    
const HttpsProxyAgent = require('https-proxy-agent');
    
const newClient = jwksClient({
    
jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
    
requestAgent: new HttpsProxyAgent('https://username:pass@address:port')
    
});

    Request Agent Options

    The library no longer gates what http(s) Agent is used, so we have removed requestAgentOptions and now expose the requestAgent option when creating a jwksClient.

    https://sandrino.auth0.com/.well-known/jwks.json',
    requestAgent: new https.Agent({
    ca: fs.readFileSync(caFile)
    })
    });">
    // OLD
    
const oldClient = jwksClient({
    
jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
    
requestAgentOptions: {
    
ca: fs.readFileSync(caFile)
    
}
    
});
    

    // NEW
    
const newClient = jwksClient({
    
jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',
    
requestAgent: new https.Agent({
    
ca: fs.readFileSync(caFile)
    
})
    
});

    Migrated Callbacks to Async/Await

    The library no longer supports callbacks. We have migrated to async/await(promises).

    // OLD
    client.getSigningKey(kid, (err, key) => {
    const signingKey = key.getPublicKey();
    });

    // NEW
    const key = await client.getSigningKey(kid);
    const signingKey = key.getPublicKey();




  • 1.12.3 - 2021-02-26

    [1.12.3] - (2021-02-25)

    Added

    • Add alg to SigningKey types #220 (okko)

    Fixed

from jwks-rsa GitHub release notes
Commit messages
Package name: jwks-rsa

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Upgrade jwks-rsa from 1.12.3 to 2.0.5 refactor: upgrade jwks-rsa from 1.12.3 to 2.0.5 Feb 9, 2022
@codecov
Copy link

codecov bot commented Feb 9, 2022 •
edited
Loading

Codecov Report

Merging #7800 (139b0de) into alpha (c6b2032) will decrease coverage by 0.00%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##            alpha    #7800      +/-   ##
==========================================
- Coverage   94.20%   94.20%   -0.01%     
==========================================
  Files         182      182              
  Lines       13587    13587              
==========================================
- Hits        12800    12799       -1     
- Misses        787      788       +1
Impacted Files Coverage Δ
src/batch.js 92.98% <0.00%> (-1.76%) ⬇️
src/ParseServerRESTController.js 96.96% <0.00%> (-1.52%) ⬇️
src/Adapters/Files/GridFSBucketAdapter.js 80.32% <0.00%> (+0.81%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c6b2032...139b0de. Read the comment docs.

@mtrezza mtrezza merged commit fc9d77f into alpha Feb 9, 2022
@mtrezza mtrezza deleted the snyk-upgrade-4b7fd496db381cf3855af20cdb1a47b8 branch February 9, 2022 18:07
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.0.0-alpha.24

@parseplatformorg parseplatformorg added the state:released-alpha Released as alpha version label Feb 10, 2022
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.0.0-beta.10

@parseplatformorg parseplatformorg added the state:released-beta Released as beta version label Mar 15, 2022
@parseplatformorg
Copy link
Contributor

🎉 This change has been released in version 5.1.0

@parseplatformorg parseplatformorg added the state:released Released as stable version label Mar 18, 2022
@parseplatformorg parseplatformorg mentioned this pull request Mar 3, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
state:released Released as stable version state:released-alpha Released as alpha version state:released-beta Released as beta version
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@snyk-bot @parseplatformorg @mtrezza