fix: update dependency jwks-rsa to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
jwks-rsa	^1.8.1 → ^4.0.0

---

Release Notes

auth0/node-jwks-rsa (jwks-rsa)

v4.1.0

Compare Source

Full Changelog

Added

• feat: add cacheMaxAgeFallback and onStaleCacheFallback for graceful JWKS degradation during outages #​502 (cschetan77)

v4.0.1

Compare Source

Full Changelog

Changed

• chore: update lru-memoizer to v3 #​476 (isidrok)

v4.0.0

Compare Source

Full Changelog

Changed

• chore: update lru-memoizer to v3 #​476 (isidrok)

v3.2.2

Compare Source

Full Changelog

⚠️ BREAKING CHANGES

• Drops support for Node 14, 16, and 18. The minimum supported Node versions are now 20.19.0, 22.12.0, and 23.0.0.
• Drops support for the ES256K algorithm (secp256k1 curve). Keys using ES256K will be ignored. Users must transition to a supported curve (e.g., ES256/P-256) or handle legacy keys externally.
• Relies on Node's native require(esm) support - Loading ECMAScript modules using require(). Non-standard module runtimes such as Jest (uses vm.Script) that do not support this feature may fail while loading ESM. See #​493 for details.
• feat: upgrade jose dependency to v6 #​486 (cschetan77)
• chore: upgrade minimum Node.js runtime to 20.19.0 #​485 (cschetan77)

v3.2.1

Compare Source

Full Changelog

Fixed

• fix: jwksUri should be optional when custom fetcher is provided #​477 (cschetan77)

v3.2.0

Compare Source

Full Changelog

Added

• docs: Add Ask DeepWiki badge to README #​445 (arpit-jn)

Fixed

• fix: Migrate to WHATWG URL API from node's core url #​465 (cschetan77)
• fix: Moving @​types/express to dev and re generating package lock #​464 (cschetan77)

v3.1.0

Compare Source

Full Changelog

Changed

• Bump express from 4.18.2 to 4.19.2 #​408 (dependabot[bot])
• Bump braces from 3.0.2 to 3.0.3 #​413 (dependabot[bot])
• Bump jose from 4.15.4 to 4.15.5 #​402 (dependabot[bot])
• Bump codecov/codecov-action from 3.1.4 to 3.1.5 #​396 (dependabot[bot])
• Bump actions/cache from 3 to 4 #​395 (dependabot[bot])
• Update automated release process to latest version #​391 (frederikprijck)
• Bump actions/github-script from 6 to 7 #​387 (dependabot[bot])
• chore(deps): Update Lockfile #​386 (evansims)
• Bump actions/setup-node from 3 to 4 #​382 (dependabot[bot])
• Bump @​babel/traverse from 7.10.1 to 7.23.2 #​381 (dependabot[bot])

Fixed

• [Fix] Change type of unused req param to unknown to resolve type conflicts #​394 (zackdotcomputer)
• fix(compat): ensure WebCryptoAPI runtime imported keys are re-exportable #​409 (panva)
• fix: express-jwt types #​412 (jfromaniello)

v3.0.1

Compare Source

Full Changelog

Added

• feat: resolve bun/deno compat issues #​374 (panva)

v3.0.0

Compare Source

Full Changelog

Fixed

• update types/jsonwebtoken update v9.0.0 #​349 (ToshihitoKon)
• Bump jsonwebtoken from 8.5.1 to 9.0.0 #​344 (dependabot[bot])

v2.1.5

Compare Source

Full Changelog

⚠️ BREAKING CHANGES

This release drops support for Node 10 and 12

• [major] bump jose #​333 (panva)

v2.1.4

Compare Source

Full Changelog

Fixed

• Fix GetVerificationKey typing to include undefined #​329 (AaronMoat)

v2.1.3

Compare Source

Full Changelog

Fixed

• Type definitions depend on jsonwebtoken #​314 (adamjmcgrath)

v2.1.2

Compare Source

Full Changelog

Fixed

• Fix issue with ES Express import #​310 (adamjmcgrath)

v2.1.1

Compare Source

Full Changelog

Fixed

• fix: express build error #​304 (blindperson)

v2.1.0

Compare Source

Full Changelog

Fixed

• fix: types-compabitility for express-jwt @​ 7 #​301 (carboneater)

v2.0.5

Compare Source

Full Changelog

Added

• add support for express-jwt@​7 #​297 (jfromaniello)

Fixed

• fix(type): correct the wrong type of the getSigningKey function arg… #​289 (stegano)

v2.0.4

Compare Source

Full Changelog

Fixed

• Destroy the request when reaches the timeout (#​270) #​271 (amrsalama)
• [SDK-2833] Fix issue where errors were being cached #​268 (adamjmcgrath)

v2.0.3

Compare Source

Fixed

• Fix retrieveSigningKeys error #​242 (davidpatrick)

Security

• Bump jose from 2.0.3 to 2.0.5 #​244 (dependabot)

v2.0.2

Compare Source

Fixed

• Interceptor bind client #​237 (erikfried)
• Update type def for getSigningKey #​236 (davidpatrick)
• Use hostname instead of host when creating request #​233 (cjlpowers)

v2.0.1

Compare Source

Added

• Callback backwards compatbility for getSigningKey#​227 (davidpatrick)

Fixed

• Fix typescript declarations for v2 #​229 (davidpatrick)
• Fix typescript types for fetcher #​231 (itajaja)

v2.0.0

Compare Source

With version 2 we have added full JWK/JWS support. With this we have bumped the node version to minimum 10. We have also removed Axios and exposed a fetcher option to allow user's to completely override how the request to the jwksUri endpoint is made.

Breaking Changes

• Drops support for Node < 10
• No more callbacks, using async/await(promises)
• Removed Axios and changed the API to JwksClient

Changes

Added

• Full JWK/JWS Support #​205 (panva)

Changed

• Simplify request wrapper #​218 (davidpatrick)
• Pins to Node Version 10,12,14 #​212 (davidpatrick)
• Migrate from callbacks to async/await #​222 (davidpatrick)

Migration Guide from v1 to v2

Proxies

The proxy option has been removed from the JwksClient. Support for it was a little spotty through Axios, and we wanted to allow users to have more control over the flow. Now you can specify your proxy by overriding the requestAgent used with an agent with built-in proxy support, or by completely overriding the request library with the fetcher option.

// OLDconstoldClient=jwksClient({jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',proxy: 'https://username:pass@address:port'});// NEWconstHttpsProxyAgent=require('https-proxy-agent');constnewClient=jwksClient({jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',requestAgent: newHttpsProxyAgent('https://username:pass@address:port')});

Request Agent Options

The library no longer gates what http(s) Agent is used, so we have removed requestAgentOptions and now expose the requestAgent option when creating a jwksClient.

// OLDconstoldClient=jwksClient({jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',requestAgentOptions: {ca: fs.readFileSync(caFile)}});// NEWconstnewClient=jwksClient({jwksUri: 'https://sandrino.auth0.com/.well-known/jwks.json',requestAgent: newhttps.Agent({ca: fs.readFileSync(caFile)})});

Migrated Callbacks to Async/Await

The library no longer supports callbacks. We have migrated to async/await(promises).

// OLDclient.getSigningKey(kid,(err,key)=>{constsigningKey=key.getPublicKey();});// NEWconstkey=awaitclient.getSigningKey(kid);constsigningKey=key.getPublicKey();

v1.12.5

Compare Source

v1.12.4

Compare Source

v1.12.3

Compare Source

Added

• Add alg to SigningKey types #​220 (okko)

Fixed

• Fix npmjs resolves #​221 (adamjmcgrath)
• Fix Import default Axios instance #​216 (dsebastien)

v1.12.2

Compare Source

Fixed

• Added coverage folders to .npmignore

v1.12.1

Compare Source

Security

• Bump Axios to ^0.21.1 #​208 (72636c)

v1.12.0

Compare Source

Added

• Provide an alternative source for supplying keysets #​202 (davidpatrick)

Deprecation
We are deprecating passing in a jwksObject to the client for reasons laid out in #​202. In order to load keys from anything other than the jwksUri, please use the getKeysInterceptor.

constclient=newJwksClient({jwksUri: 'https://my-enterprise-id-provider/.well-known/jwks.json',getKeysInterceptor: (cb)=>{constfile=fs.readFileSync(jwksFile);returncb(null,file.keys);}});

v1.11.0

Compare Source

Added

• Add ability to configure proxy with env vars #​188 (lubomir-haralampiev)

v1.10.1

Compare Source

Fixed

• fix proxy agent for http #​182 (NShahri)
• fix dependencies for --production flag with npm #​180 (alexrqs)

v1.10.0

Compare Source

Added

• getSigningKeys return algorithm #​168 (moander)

Fixed

• Add missing async methods to Typescript type definitions #​163 (mwgamble)
• Fixing proxy on Axios #​176 (davidpatrick)
• Fix caching and rateLimiting on getSigningKeyAsync #​177 (davidpatrick)

v1.9.0

Compare Source

Added

• Add promisified methods to JwksClient #​161 (jimmyjames)
• Update express-jwt ^6.0.0 #​157 (davidpatrick)

Fixed

• Update Buffer initialization to non-deprecated method #​154 (cwardcode)
• Use axios url parameter instead of baseURL #​153 (novascreen)

Security

• Bump lodash from 4.17.15 to 4.17.19 [#​152](https://github.com/auth0/node-jwks

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.