Bump jose from 1.12.1 to 2.0.5 in /bgw-auth-service

[dependabot]

Bumps jose from 1.12.1 to 2.0.5.

Release notes

Sourced from jose's releases.

v2.0.5

Bug Fixes

• defer AES CBC w/ HMAC decryption after tag verification passes (812e03f), fixes CVE-2021-29443

v2.0.4

Performance

• improve base64url encoding when available in Node.js (d5af559)

v2.0.3

Bug Fixes

• allow stubbing of the JWT.decode function (6c3b92f)

v2.0.2

Bug Fixes

• esm: include esm files in the published package (1956746)

v2.0.1

Bug Fixes

• allow plugins such as jose-chacha to work in newer node runtime (30f1dc2)

v2.0.0

⚠ BREAKING CHANGES

• the JWE.decrypt option algorithms was removed and replaced with contentEncryptionAlgorithms (handles enc allowlist) and keyManagementAlgorithms (handles alg allowlist)
• the JWT.verify profile option was removed, use e.g. JWT.IdToken.verify instead.
• removed the maxAuthAge JWT.verify option, this option is now only present at the specific JWT profile APIs where the auth_time property applies.
• removed the nonce JWT.verify option, this option is now only present at the specific JWT profile APIs where the nonce property applies.
• the acr, amr, nonce and azp claim value types will only be checked when verifying a specific JWT profile using its dedicated API.
• using the draft implementing APIs will emit a one-time warning per process using process.emitWarning
• JWT.sign function options no longer accept a nonce property. To create a JWT with a nonce just pass the value to the payload.
• due to added ESM module support Node.js version with ESM implementation bugs are no longer supported, this only affects early v13.x versions. The resulting Node.js semver range is >=10.13.0 < 13 || >=13.7.0
• deprecated method JWK.importKey was removed
• deprecated method JWKS.KeyStore.fromJWKS was removed
• the use of unregistered curve name P-256K for secp256k1 was removed
• jose.JWE.Encrypt constructor aad and unprotectedHeader arguments swapped places
• jose.JWE.encrypt.flattened header (unprotectedHeader) and aad arguments swapped places
• jose.JWE.encrypt.general header (unprotectedHeader) and aad arguments swapped places
• JWS.verify returned payloads are now always buffers
• JWS.verify options encoding and parse were removed

Features

... (truncated)

Changelog

Sourced from jose's changelog.

2.0.5 (2021-04-09)

Bug Fixes

• defer AES CBC w/ HMAC decryption after tag verification passes (812e03f)

2.0.4 (2021-01-18)

Performance

• improve base64url encoding when available in Node.js (d5af559)

2.0.3 (2020-10-29)

Bug Fixes

• allow stubbing of the JWT.decode function (6c3b92f)

2.0.2 (2020-09-14)

Bug Fixes

• esm: include esm files in the published package (1956746)

2.0.1 (2020-09-10)

Bug Fixes

• allow plugins such as jose-chacha to work in newer node runtime (30f1dc2)

2.0.0 (2020-09-08)

⚠ BREAKING CHANGES

• the JWE.decrypt option algorithms was removed and replaced with contentEncryptionAlgorithms (handles enc allowlist) and keyManagementAlgorithms (handles alg allowlist)
• the JWT.verify profile option was removed, use e.g. JWT.IdToken.verify instead.
• removed the maxAuthAge JWT.verify option, this option is now only present at the specific JWT profile APIs where the auth_time property applies.
• removed the nonce JWT.verify option, this option is now only present at the specific JWT profile APIs where the

... (truncated)

Commits

• 2269f4b chore(release): 2.0.5
• 812e03f fix: defer AES CBC w/ HMAC decryption after tag verification passes
• b8b668e lint: fix lint
• 828bd37 chore(release): 2.0.4
• 647290b chore: update changelog standard-version types
• d5af559 perf: improve base64url encoding when available in Node.js
• 35f5613 ci: skip submitting to codecov
• 85c9f23 docs: update links, v3.x notice
• c803d1b chore(release): 2.0.3
• 921737f style: upgrade standard
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.