Bump jsonwebtoken to v9 on Auth0-SPA-JS v1 (#1065)

* Bump jsonwebtoken to v9

* fix test

Author: frederikprijck

.circleci/config.yml

@@ -40,7 +40,7 @@ jobs:
       - run: npx concurrently --raw --kill-others --success first "npm:dev" "wait-on http://127.0.0.1:3000/ && browserstack-cypress run --build-name $CIRCLE_BRANCH"
   test_gatsby:
     docker:
-      - image: << pipeline.parameters.docker_image >>
+      - image: cypress/browsers:node18.12.0-chrome106-ff106
     working_directory: ~/repo
     steps:
       - checkout:
@@ -140,7 +140,7 @@ jobs:
           working_directory: my-app
   test_angular:
     docker:
-      - image: << pipeline.parameters.docker_image >>
+      - image: cypress/browsers:node18.12.0-chrome106-ff106
     working_directory: ~/repo
     steps:
       - checkout:

__tests__/jwt.test.ts

@@ -20,14 +20,19 @@ const createPrivateKey = () => {
   });
 };
 
+const symmetricKey = 'shared secret';
+
 const DEFAULT_PAYLOAD = <any>{
   sub: 'id|123',
   payload: true,
   nonce: verifyOptions.nonce,
   azp: verifyOptions.aud
 };
-const createJWT = (payload = DEFAULT_PAYLOAD, options = {}) => {
-  const key = createPrivateKey();
+const createJWT = (
+  payload = DEFAULT_PAYLOAD,
+  options: Record<string, any> = {}
+) => {
+  const key = options.algorithm === 'HS256' ? symmetricKey : createPrivateKey();
   return jwt.sign(payload, key, {
     algorithm: 'RS256',
     audience: verifyOptions.aud,

package-lock.json

@@ -50,7 +50,7 @@
     "jest": "^27.3.1",
     "jest-junit": "^13.0.0",
     "jest-localstorage-mock": "^2.4.18",
-    "jsonwebtoken": "^8.5.1",
+    "jsonwebtoken": "^9.0.0",
     "oidc-provider": "^7.10.1",
     "prettier": "^2.4.1",
     "pretty-quick": "^3.1.2",