Bump passport-saml from 1.3.5 to 3.2.2

[renovate-pagopa]

This PR contains the following updates:

Package	Change	Age	Confidence
passport-saml	1.3.5 -> 3.2.2

For further information on security, please refer to the Confluence page link

---

Release Notes

node-saml/passport-saml (passport-saml)

v3.2.2

Compare Source

• Merge pull request from GHSA-m974-647v-whv7 (8b7e3f5)

v3.2.1

Compare Source

• deps: upgrade release-it, npm dedupe (8f3ffcd)
• deps: npm audit fix (b81c36c)
• Export AuthenticateOptions type (#​657) (ef1dcfc)
• test: update error message to match new xml-encryption format. (3e908fa)
• Update xml-encryption to get rid of vulnerable node-forge (#​667) (b9de63b)

v3.2.0

Compare Source

• Update dependencies (#​640) (e21a04b)

v3.1.2

Compare Source

• Update xmldom to 0.7.2 (#​633) (9aef839)

v3.1.1

Compare Source

💣 Major Changes

• deps: use node-saml v4. See node-saml changelog for breaking changes: https://github.com/node-saml/node-saml/blob/master/CHANGELOG.md#v400-2022-10-28 #​796
• Update node-saml to beta 5 -- See node-saml changelog for breaking changes #​783
• Update node-saml dependency #​770
• Update to support node-saml@​4.0.0-beta.3 #​707
• Update passport to 0.6.x -- See passport changelog for breaking changes #​698
• Update packages; set minimum Node to 14 #​685
• [security] Check user matches logout request before reporting logout success #​619
• Remove node-saml code and use an import instead #​612

🚀 Minor Changes

• Add support for multiple signing certs in metadata #​655

🔗 Dependencies

• [javascript] Bump @​xmldom/xmldom from 0.7.5 to 0.7.6 #​794
• [javascript] Bump @​types/mocha from 9.1.1 to 10.0.0 #​781
• [javascript] Bump @​types/express from 4.17.13 to 4.17.14 #​785
• [javascript] Bump @​types/chai from 4.3.1 to 4.3.3 #​787
• [javascript] Bump @​typescript-eslint/parser from 5.36.2 to 5.40.0 #​786
• [javascript] Bump eslint from 8.23.0 to 8.25.0 #​784
• [github_actions] Bump codecov/codecov-action from 3.1.0 to 3.1.1 #​782
• [javascript] Bump @​types/passport from 1.0.10 to 1.0.11 #​778
• [javascript] Bump vm2 from 3.9.9 to 3.9.11 #​777
• [javascript] Bump concurrently from 7.3.0 to 7.4.0 #​773
• [javascript] Bump @​types/node from 14.18.22 to 14.18.28 #​772
• [javascript] Bump @​types/passport from 1.0.9 to 1.0.10 #​771
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.7 to 5.36.2 #​766
• [javascript] Bump eslint from 8.20.0 to 8.23.0 #​759
• [javascript] Bump @​typescript-eslint/parser from 5.30.7 to 5.36.2 #​767
• [javascript] Bump concurrently from 7.2.2 to 7.3.0 #​741
• [javascript] Bump @​types/node from 14.18.21 to 14.18.22 #​740
• [javascript] Bump @​typescript-eslint/parser from 5.30.5 to 5.30.7 #​737
• [javascript] Bump eslint from 8.19.0 to 8.20.0 #​736
• [javascript] Bump @​types/sinon from 10.0.12 to 10.0.13 #​738
• [javascript] Bump ts-node from 10.8.2 to 10.9.1 #​732
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.5 to 5.30.7 #​739
• [javascript] Bump parse-url from 6.0.0 to 6.0.2 #​730
• [javascript] Bump @​typescript-eslint/parser from 5.30.3 to 5.30.5 #​726
• [javascript] Bump eslint-plugin-prettier from 4.0.0 to 4.2.1 #​722
• [javascript] Bump eslint from 8.18.0 to 8.19.0 #​719
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.3 to 5.30.5 #​725
• [javascript] Bump ts-node from 10.8.0 to 10.8.2 #​723
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.29.0 to 5.30.3 #​716
• [javascript] Bump @​types/sinon from 10.0.11 to 10.0.12 #​717
• [javascript] Bump @​typescript-eslint/parser from 5.29.0 to 5.30.3 #​718
• [github_actions] Bump actions/checkout from 2 to 3 #​713
• [github_actions] Bump github/codeql-action from 1 to 2 #​712
• Update dependencies #​696
• Bump follow-redirects from 1.14.4 to 1.15.1 #​695
• Bump npm from 8.6.0 to 8.12.0 #​694
• [security] Bump ansi-regex from 4.1.0 to 4.1.1 #​688
• Move TypeScript-required types to dependencies from devDependencies #​686
• Code cleanup in preparation for logout validation #​658
• Update packages #​641

🐛 Bug Fixes

• add MultiStrategyConfig type export #​675

📚 Documentation

• Update changelog and changelog building tools #​774
• Update badges for scoped package #​710
• Update badges for scoped package #​709
• docs: move history note to the bottom and expand it. #​708
• Update README to remove an insecure suggestion #​704
• Document passive option #​660
• Read me update for authnContext example for ADFS #​647

⚙️ Technical Tasks

• Clean working folder before doing a release build #​793
• Update changelog build tools #​792
• Add prerelease script #​775
• Reduce dependabot update frequency #​765
• Have dependabot update package.json too #​764
• Have dependabot update package.json too #​724
• Add dependabot config file #​711
• Move to NPM organization #​705
• Add code coverage workflow #​706
• Replace integration tests with unit tests #​702
• Add code coverage #​701
• Adjust .mochars.json #​699
• Migrate from "should" to "chai" #​687
• Update issue templates #​652
• Fix main path in package.json #​623

---

v3.1.0

Compare Source

💣 Major Changes

• deps: use node-saml v4. See node-saml changelog for breaking changes: https://github.com/node-saml/node-saml/blob/master/CHANGELOG.md#v400-2022-10-28 #​796
• Update node-saml to beta 5 -- See node-saml changelog for breaking changes #​783
• Update node-saml dependency #​770
• Update to support node-saml@​4.0.0-beta.3 #​707
• Update passport to 0.6.x -- See passport changelog for breaking changes #​698
• Update packages; set minimum Node to 14 #​685
• [security] Check user matches logout request before reporting logout success #​619
• Remove node-saml code and use an import instead #​612

🚀 Minor Changes

• Add support for multiple signing certs in metadata #​655

🔗 Dependencies

• [javascript] Bump @​xmldom/xmldom from 0.7.5 to 0.7.6 #​794
• [javascript] Bump @​types/mocha from 9.1.1 to 10.0.0 #​781
• [javascript] Bump @​types/express from 4.17.13 to 4.17.14 #​785
• [javascript] Bump @​types/chai from 4.3.1 to 4.3.3 #​787
• [javascript] Bump @​typescript-eslint/parser from 5.36.2 to 5.40.0 #​786
• [javascript] Bump eslint from 8.23.0 to 8.25.0 #​784
• [github_actions] Bump codecov/codecov-action from 3.1.0 to 3.1.1 #​782
• [javascript] Bump @​types/passport from 1.0.10 to 1.0.11 #​778
• [javascript] Bump vm2 from 3.9.9 to 3.9.11 #​777
• [javascript] Bump concurrently from 7.3.0 to 7.4.0 #​773
• [javascript] Bump @​types/node from 14.18.22 to 14.18.28 #​772
• [javascript] Bump @​types/passport from 1.0.9 to 1.0.10 #​771
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.7 to 5.36.2 #​766
• [javascript] Bump eslint from 8.20.0 to 8.23.0 #​759
• [javascript] Bump @​typescript-eslint/parser from 5.30.7 to 5.36.2 #​767
• [javascript] Bump concurrently from 7.2.2 to 7.3.0 #​741
• [javascript] Bump @​types/node from 14.18.21 to 14.18.22 #​740
• [javascript] Bump @​typescript-eslint/parser from 5.30.5 to 5.30.7 #​737
• [javascript] Bump eslint from 8.19.0 to 8.20.0 #​736
• [javascript] Bump @​types/sinon from 10.0.12 to 10.0.13 #​738
• [javascript] Bump ts-node from 10.8.2 to 10.9.1 #​732
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.5 to 5.30.7 #​739
• [javascript] Bump parse-url from 6.0.0 to 6.0.2 #​730
• [javascript] Bump @​typescript-eslint/parser from 5.30.3 to 5.30.5 #​726
• [javascript] Bump eslint-plugin-prettier from 4.0.0 to 4.2.1 #​722
• [javascript] Bump eslint from 8.18.0 to 8.19.0 #​719
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.30.3 to 5.30.5 #​725
• [javascript] Bump ts-node from 10.8.0 to 10.8.2 #​723
• [javascript] Bump @​typescript-eslint/eslint-plugin from 5.29.0 to 5.30.3 #​716
• [javascript] Bump @​types/sinon from 10.0.11 to 10.0.12 #​717
• [javascript] Bump @​typescript-eslint/parser from 5.29.0 to 5.30.3 #​718
• [github_actions] Bump actions/checkout from 2 to 3 #​713
• [github_actions] Bump github/codeql-action from 1 to 2 #​712
• Update dependencies #​696
• Bump follow-redirects from 1.14.4 to 1.15.1 #​695
• Bump npm from 8.6.0 to 8.12.0 #​694
• [security] Bump ansi-regex from 4.1.0 to 4.1.1 #​688
• Move TypeScript-required types to dependencies from devDependencies #​686
• Code cleanup in preparation for logout validation #​658
• Update packages #​641

🐛 Bug Fixes

• add MultiStrategyConfig type export #​675

📚 Documentation

• Update changelog and changelog building tools #​774
• Update badges for scoped package #​710
• Update badges for scoped package #​709
• docs: move history note to the bottom and expand it. #​708
• Update README to remove an insecure suggestion #​704
• Document passive option #​660
• Read me update for authnContext example for ADFS #​647

⚙️ Technical Tasks

• Clean working folder before doing a release build #​793
• Update changelog build tools #​792
• Add prerelease script #​775
• Reduce dependabot update frequency #​765
• Have dependabot update package.json too #​764
• Have dependabot update package.json too #​724
• Add dependabot config file #​711
• Move to NPM organization #​705
• Add code coverage workflow #​706
• Replace integration tests with unit tests #​702
• Add code coverage #​701
• Adjust .mochars.json #​699
• Migrate from "should" to "chai" #​687
• Update issue templates #​652
• Fix main path in package.json #​623

---

v3.0.0

Compare Source

🐛 Bug Fixes

• [security] Limit transforms for signed nodes #​595
• Fix: Conflicting profile properties between profile and attributes #​593
• Fix validateInResponseTo null check #​596

📚 Documentation

• Rebuild changelog for 3.0.0 #​605
• Fix typo OnBefore -> NotBefore #​611
• Update README with new Cache Provider interface #​608

---

v2.2.0

Compare Source

• Resolve XML-encoded carriage returns during signature validation (#​578) (08c626c)
• Add deprecation notices for renamed variables (#​568) (8114d4c)

v2.1.0

Compare Source

• Update xml-encryption to v1.2.3 (#​566) (7fcd8b6)
• Revert "Update xml-encryption to v1.2.3 (#​562)" (#​565) (2833848)
• Update xml-encryption to v1.2.3 (#​562) (e5f1151)
• Update xml-crypto to v2.1.1 (#​557) (b589bd7)

v2.0.6

Compare Source

• bump xmldom to 0.5.x since all lower versions have security issue (#​551) (3d98c75)

v2.0.5

Compare Source

⚙️ Technical Tasks

• Ignore test folder when building npm package #​526

---

v2.0.4

Compare Source

⚙️ Technical Tasks

• Generating changelog using gren #​518

---

v2.0.2

Compare Source

🐛 Bug Fixes

• normalize line endings before signature validation #​498

---

v2.0.1

Compare Source

🐛 Bug Fixes

• Add deprecation notice for privateCert; fix bug #​492

---

v1.5.0

Compare Source

🚀 Minor Changes

• validateSignature: Support XML docs that contain multiple signed node… #​481
• validateSignature: Support XML docs that contain multiple signed nodes #​455

🐛 Bug Fixes

• Revert "validateSignature: Support XML docs that contain multiple signed nodes" #​480

⚙️ Technical Tasks

• outdated Q library was removed #​478

---

v1.4.2

Compare Source

⚙️ Technical Tasks

• Primary files use typescript #​477

---

v1.4.1

Compare Source

⚙️ Technical Tasks

• compatibility with @​types/passport-saml, fixes #​475 #​476

---

v1.4.0

Compare Source

💣 Major Changes

• Drop support for Node 8 #​462

🚀 Minor Changes

• try to use curl when wget is not available #​468

🔗 Dependencies

• bumped xml-crypto from 1.5.3 to 2.0.0 #​470
• Upgrade xml-crypto dependency #​465

🐛 Bug Fixes

• Only make an attribute an object if it has child elements #​464
• fix: add catch block to NameID decryption #​461

📚 Documentation

• Add PR template #​473
• Fix typo #​434

⚙️ Technical Tasks

• Ts secondary files #​474
• support typescript compilation #​469
• Add GitHub Actions as Continuos Integration provider #​463

---

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

Jira Pull request Link

It seems this Pull Request has no issues that refers to Jira!!!
Please check it out.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud