[Snyk] Upgrade oauth4webapi from 2.10.3 to 2.17.0

[ralphbean]

Snyk has created this PR to upgrade oauth4webapi from 2.10.3 to 2.17.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 11 versions ahead of your current version.

• The recommended version was released on 3 months ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-7361793	551	Proof of Concept
	Asymmetric Resource Consumption (Amplification) SNYK-JS-BODYPARSER-7926860	551	No Known Exploit
	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	551	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	551	Proof of Concept
	Improper Handling of Extra Parameters SNYK-JS-FOLLOWREDIRECTS-6141137	551	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	551	Proof of Concept
	Path Traversal SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555	551	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-AXIOS-6671926	551	No Known Exploit
	Cross-site Scripting (XSS) SNYK-JS-COOKIE-8163060	551	No Known Exploit
	Open Redirect SNYK-JS-EXPRESS-6474509	551	No Known Exploit
	Cross-site Scripting SNYK-JS-EXPRESS-7926867	551	No Known Exploit
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	551	Proof of Concept
	Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	551	Proof of Concept
	Improper Input Validation SNYK-JS-NANOID-8492085	551	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-7925106	551	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHTOREGEXP-8482416	551	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-SERIALIZEJAVASCRIPT-6147607	551	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-WEBPACK-7840298	551	Proof of Concept
	Cross-site Scripting SNYK-JS-SEND-7926862	551	No Known Exploit
	Cross-site Scripting SNYK-JS-SERVESTATIC-7926865	551	No Known Exploit

Release notes

Package name: oauth4webapi

• 2.17.0 - 2024-09-22
  

  Features

  • support client use_mtls_endpoint_aliases metadata (60c9df4)

  Documentation

  • fix calculatePKCECodeChallenge description (ac014f2)

  Refactor

  • deprecate the useMtlsAlias symbol and options (d2b7cb0)
  • use as Type for type assertions instead of (a0ccf56)
• 2.16.0 - 2024-09-16
  

  Features

  • add a hook for decrypting JWE assertions (62795a6)
  • allow to modify issued JWT headers and payloads before signing (30931ba)

  Documentation

  • update docs on useMtlsAlias (006db55)
• 2.15.0 - 2024-09-15
  

  Features

  • support generic token endpoint grant requests (2f454b5)
• 2.14.0 - 2024-09-15
  

  Features

  • add non-repudiation signature validation methods (0916de2)

  Documentation

  • update JSDoc to use more link syntax (d78f090)
  • update various comments and documentation (9c3f1ed)
• 2.13.0 - 2024-09-10
  

  Features

  • build: add jsr.io distribution (dc6157f)
• 2.12.2 - 2024-09-09
  

  Refactor

  • error msg when ID Token aud is an array and azp is missing (68e0338)
  • remove redundant checks (763b3d0)

  Documentation

  • remove non-described parameter JSDoc tags (b1507b9)
  • update README.md (9d1377b)
• 2.12.1 - 2024-09-03
  

  Fixes

  • use correct "htm" in DPoP Proof via protectedResourceRequest (3ce3be2), closes #132
• 2.12.0 - 2024-08-19
  

  Features

  • graduate jwksCache to stable API (0e0e1d2)

  Documentation

  • move clockSkew and clockTolerance docs to the symbol (3b5d2ea)
  • update clockSkew and clockTolerance docs (c97313a)
• 2.11.1 - 2024-06-20
  

  Fixes

  • allow ID Token auth_time to be present even if client.require_auth_time is false (caa9ab3)
• 2.11.0 - 2024-06-19
  

  Features

  • add experimental support for edge compute runtimes JWKS caching (15b7aff)

  Refactor

  • update maxAge option type check error message (7fe3454)

  Documentation

  • clarify documentation is more an API Reference (c96c8e0)
  • update example import (651e8ea)
  • updates for readability and consistency (b1b8b7d)
• 2.10.4 - 2024-03-29
• 2.10.3 - 2024-02-07

from oauth4webapi GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs