chore(deps-dev): bump oauth4webapi from 2.17.0 to 3.1.2

[dependabot]

Bumps oauth4webapi from 2.17.0 to 3.1.2.

Release notes

Sourced from oauth4webapi's releases.

v3.1.2

Refactor

• shake the supported function when not needed (c390093)
• types: update indexable on MTLSEndpointAliases to be a string (a405c89)

v3.1.1

Refactor

• simpler consume of Request bodies (bcf0b86)

v3.1.0

Features

• add support for form_post Request instance in hybrid response mode validate response functions (5e22d9d)

v3.0.1

Refactor

• gracefully handle non-number expires_in (c7cc858), closes #47 #71 #77 #112
• update assertCryptoKey error message (999a373)

v3.0.0

⚠ BREAKING CHANGES

• build target is now ES2022
• jweDecrypt is no longer an allowed symbol on the Client interface, it is instead an option passed to functions that may encounter encrypted assertions
• specifying Ed448 curve for EdDSA is no longer supported, EdDSA is now just an alias for the fully-specified Ed25519 JWS algorithm
• assertions signed with an Ed25519 CryptoKey will now use the Ed25519 JWS alg value instead of EdDSA. This can be reverted using the modifyAssertion symbol export
• the audience of a Private Key JWT and Client Secret JWT client assertions is now just the issuer identifier
• remove modifyAssertion from the PrivateKey interface
• optional (non-repudiation) signature validation of ID Token JWS Signatures is now done the same way as JWT UserInfo and JWT Introspection is done, with a Response instance rather than a TokenEndpointResponse object
• validateJwtIntrospectionSignature is now validateApplicationLevelSignature
• validateJwtUserInfoSignature is now validateApplicationLevelSignature
• validateIdTokenSignature is now validateApplicationLevelSignature
• DPoP request options are now obtained by calling the DPoP() exported function. This returns a handle that also maintains its own LRU nonce caches
• client authentication is now an explicit argument to authenticated functions
• processAuthorizationCodeOpenIDResponse() method was removed in favour of processAuthorizationCodeResponse()
• processAuthorizationCodeOAuth2Response() method was removed in favour of processAuthorizationCodeResponse()
• All grant functions that execute against the Token Endpoint will now validate ID Token when there is one in the response. This has already been the behaviour of functions such as processRefreshTokenResponse() or processDeviceCodeResponse()
• Presence of auth_time is now required in all ID Tokens if client.default_auth_time is set
• encode client_secret_basic - _ . ! ~ * ' ( ) characters
• remove all deprecated options
• remove the useMtlsAlias symbol and options
• all functions now reject interacting with non-TLS HTTP endpoints. You can use the allowInsecureRequests in the HttpRequestOptions interface to revert this behaviour.
• removed the isOAuth2Error() helper, all functions that used to possibly return an OAuth2Error now reject with ResponseBodyError or AuthorizationResponseError instead
• removed parseWwwAuthenticateChallenges(), all functions verify process Response now reject with WWWAuthenticateChallengeError instead
• removed protectedResourceRequest() now rejects with WWWAuthenticateChallengeError when the Response has one

Features

... (truncated)

Changelog

Sourced from oauth4webapi's changelog.

3.1.2 (2024-10-24)

Refactor

• shake the supported function when not needed (c390093)
• types: update indexable on MTLSEndpointAliases to be a string (a405c89)

3.1.1 (2024-10-14)

Refactor

• simpler consume of Request bodies (bcf0b86)

3.1.0 (2024-10-14)

Features

• add support for form_post Request instance in hybrid response mode validate response functions (5e22d9d)

3.0.1 (2024-10-13)

Refactor

• gracefully handle non-number expires_in (c7cc858), closes #47 #71 #77 #112
• update assertCryptoKey error message (999a373)

3.0.0 (2024-10-07)

⚠ BREAKING CHANGES

• build target is now ES2022
• jweDecrypt is no longer an allowed symbol on the Client interface, it is instead an option passed to functions that may encounter encrypted assertions
• specifying Ed448 curve for EdDSA is no longer supported, EdDSA is now just an alias for the fully-specified Ed25519 JWS algorithm
• assertions signed with an Ed25519 CryptoKey will now use the Ed25519 JWS alg value instead of EdDSA. This can be reverted using the modifyAssertion symbol export
• the audience of a Private Key JWT and Client Secret JWT client assertions is now just the issuer identifier
• remove modifyAssertion from the PrivateKey interface
• optional (non-repudiation) signature validation of ID Token JWS Signatures is now done the same way as JWT UserInfo and

... (truncated)

Commits

• 49470eb chore(release): 3.1.2
• f8b1368 chore: update README.md
• 6d327b4 test: run tap:electron with tsx
• b939baa chore: bump packages
• aded09a chore: update README.md
• a1658c8 chore: bump dev deps
• 11d5f6f chore: bump dev deps
• e96f64f test: set conformance suite timeout to 3 seconds
• 6e7dc12 ci: use default CodeQL
• 9a565bc chore: bump dev deps
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)