passport-openid is unmaintained and is using a vulnerable version of request
request *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
Depends on vulnerable versions of tough-cookie
No fix available
openid 1.0.0 - 2.0.8
Depends on vulnerable versions of request
node_modules/openid
passport-openid >=0.4.0
Depends on vulnerable versions of openid
node_modules/passport-openid
Steam is still using OpenID, but passport-steam-openid seems to be a maintained plugin that only depends on axios and passport (easier to fork and maintain as well).
New plan:
Drop passport-openid
Add passport-steam-openid to handle the Steam usecase.
passport-openid is unmaintained and is using a vulnerable version of request