[cschetan77]

Changes

Raises the minimum versions of two production dependencies so that npm consumers and the CDN bundle pick up their fixes. The lockfile was still resolving auth0-js@10.2.1 and qs@6.16.0, which is also why the Snyk check is failing on master.

package.json

• auth0-js: ^10.0.0 → ^10.3.0. 10.3.0 validates the ID token and auth time against the requested max age (Snyk: SNYK-JS-AUTH0JS-20936882, Insufficient Session Expiration).
• qs: ^6.16.0 → ^6.16.1 (Snyk: SNYK-JS-QS-20943482, Uncaught Exception). 6.16.1 also carries several parse/stringify fixes.

package-lock.json

• auth0-js 10.2.1 → 10.3.0 and qs 6.16.0 → 6.16.1.
• Dev-only socket.io-adapter 2.5.5 → 2.5.8, which drops its nested ws@8.17.1 in favour of the already-present ws@8.21.0.
• resolved fields are stripped by the existing pre-commit hook, so some entries added by earlier Dependabot PRs lose theirs.

References

• auth0-js v10.3.0: https://github.com/auth0/auth0.js/releases/tag/v10.3.0
• qs 6.16.1 changelog: https://github.com/ljharb/qs/blob/main/CHANGELOG.md

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed