[Snyk] Upgrade passport from 0.4.1 to 0.7.0

[trabab]

Snyk has created this PR to upgrade passport from 0.4.1 to 0.7.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.

• The recommended version was released 3 years ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Session Fixation SNYK-JS-PASSPORT-2840631	454	No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: passport

• 0.7.0 - 2023-11-27
  

  0.7.0

• 0.6.0 - 2022-05-20
  

  0.6.0

• 0.5.3 - 2022-05-16
  

  0.5.3

• 0.5.2 - 2021-12-16
  

  0.5.2

• 0.5.1 - 2021-12-15
  

  0.5.1

• 0.5.0 - 2021-09-23
  

  0.5.0

• 0.4.1 - 2019-12-09
  

  0.4.1

from passport GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[trabab]

This major version upgrade of Passport introduces several significant breaking changes, primarily related to session management and asynchronous operations.

Key Breaking Changes:

• Session Regeneration (v0.6.0): To enhance security against session fixation attacks, req.logIn() and req.logOut() now regenerate the session and clear its information by default. This can affect any logic that relies on session data persisting across login/logout events. A keepSessionInfo: true option is available to prevent this.
• Asynchronous req.logOut() (v0.6.0): The req.logOut() function is now asynchronous and requires a callback function. Code that previously called req.logOut() synchronously will need to be updated to handle the callback.
• Internal API Changes (v0.5.x): Version 0.5.0 changed how functions like login(), logout(), isAuthenticated(), etc., are added to the request object, moving this responsibility from the initialize() middleware to the authenticate() middleware. While a compatibility layer was added in v0.5.2 for older strategies, this internal shift could cause unexpected behavior.

Recommendation:
This upgrade requires careful code review and modification.

1. Update all instances of req.logOut() to be asynchronous and handle the required callback.
2. Review session-dependent logic to ensure it is compatible with the new default session regeneration behavior on login and logout.
3. Thoroughly test authentication flows, especially if using older Passport strategies, to verify compatibility with the internal API changes from v0.5.x.

Source: Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.