Bump xml2js and passport-openidconnect in /1. Auth Flow

[dependabot]

Removes xml2js. It's no longer used after updating ancestor dependency passport-openidconnect. These dependencies need to be updated together.

Removes xml2js

Updates passport-openidconnect from 0.0.2 to 0.1.1

Changelog

Sourced from passport-openidconnect's changelog.

[0.1.1] - 2021-11-29

Added

• Support for prompt option to authenticate().

[0.1.0] - 2021-11-17

Added

• Parsing profile.username from standard claims.
• Parsing profile.emails from standard claims.
• Support for loginHint options to authenticate().
• Support for state object passed as option to authenticate, which will be persisted in the session by state store.
• Support for responseMode options to Strategy constructor.
• Support for claims options to Strategy constructor.
• Added customHeaders option to Strategy constructor, matching functionality in passport-oauth2.
• Added proxy option to Strategy constructor, which can be set to true to indicate the app is behind a front-facing proxy. Used when resolving relative redirect URIs to an absolute URI.
• Added agent option to Strategy constructor, used to control http.Agent behavior.
• 5-arity form of verify function invoked with (iss, profile, context idToken, cb) arguments.
• 9-arity form of verify function invoked with (iss, uiProfile, idProfile, context, idToken, accessToken, refreshToken, params, cb) arguments.
• Added maxAge and nonce properties to state stored in session.
• Added issued property to state stored in session, only when maxAge option is used.
• Parsing of errors from token endpoint.

Changed

• By default, profile is parsed from ID token and UserInfo is not fetched, optimizing for network latency.
• The 3-arity form of verify function now invoked with (iss, profile, cb) arguments, rather than (iss, sub, cb).
• The 4-arity form of verify function now invoked with (iss, profile, context, cb) arguments, rather than (iss, sub, profile, cb).
• The 7-arity form of verify function now invoked with (iss, profile, context, idToken, accessToken, refreshToken, cb) arguments, rather than (iss, sub, profile, accessToken, refreshToken, params, cb).
• The 8-arity form of verify function now invoked with (iss, profile, context, idToken, accessToken, refreshToken, params, cb) arguments, rather than (iss, sub, profile, claims, accessToken, refreshToken, params, cb).
• prompt option can now take any value, rather than just defined values, in order to support values defined by extensions.
• display option can now take any value, rather than just defined values, in order to support values defined by extensions.

... (truncated)

Commits

• 6197df6 0.1.1
• a736090 Update changelog.:
• c473aa2 Support for prompt option to authenticate.
• e11a373 Update changelog.
• e97de90 Update changelog.
• 3134d41 0.1.0
• bfe8193 Update readme.
• 73f42a3 Update readme.
• 6d386e7 Update readme.
• 95afc66 Update readme.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.