Bump express-openid-connect from 2.5.1 to 2.8.0 in /src/api

[dependabot[bot]]

Bumps express-openid-connect from 2.5.1 to 2.8.0.

Release notes

Sourced from express-openid-connect's releases.

v2.8.0

Added

• SDK-3503 Add *_jwt token endpoint auth methods #376 (adamjmcgrath)

v2.7.3

Fixed

• discovery errors should be handled in express middleware #371 (adamjmcgrath)
• Allow periods in cookie name #350 (moberegger)

v2.7.2

Security

• URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect GHSA-7p99-3798-f85c

v2.7.1

Fixed

• transactionCookie configuration should be optional #338 (BitPatty)

v2.7.0

Added

• SDK-3109 Add ability to pass custom logout params #329 (adamjmcgrath)
• SDK-3111 Add Oauth error props to http error when available #328 (adamjmcgrath)
• SDK-3110 Allow customising the UA header in client reqs #327 (adamjmcgrath)
• allow configuration of same site attribute on auth_verification cookie #323 (BitPatty)

Changed

• Looser cookie name validation #330 (adamjmcgrath)

v2.6.0

Added

• Add cross domain iframe support for modern browsers #317 (adamjmcgrath)

v2.5.2

Security

• Session fixation fix CVE-2021-41246

Fixed

• Fix refresh signature in ts defs #294 (adamjmcgrath)

Changelog

Sourced from express-openid-connect's changelog.

v2.8.0 (2022-07-20)

Full Changelog

Added

• [SDK-3503] Add *_jwt token endpoint auth methods #376 (adamjmcgrath)

v2.7.3 (2022-06-29)

Full Changelog

Fixed

• discovery errors should be handled in express middleware #371 (adamjmcgrath)
• Allow periods in cookie name #350 (moberegger)

v2.7.2 (2022-03-29)

Full Changelog

Security

• URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect GHSA-7p99-3798-f85c

v2.7.1 (2022-02-24)

Full Changelog

Fixed

• transactionCookie configuration should be optional #338 (BitPatty)

v2.7.0 (2022-02-17)

Full Changelog

Added

• [SDK-3109] Add ability to pass custom logout params #329 (adamjmcgrath)
• [SDK-3111] Add Oauth error props to http error when available #328 (adamjmcgrath)
• [SDK-3110] Allow customising the UA header in client reqs #327 (adamjmcgrath)
• allow configuration of same site attribute on auth_verification cookie #323 (BitPatty)

Changed

• Looser cookie name validation #330 (adamjmcgrath)

v2.6.0 (2022-01-31)

Full Changelog

Added

• Add cross domain iframe support for modern browsers #317 (adamjmcgrath)

v2.5.2 (2021-12-09)

Full Changelog

Security

• Session fixation fix CVE-2021-41246

... (truncated)

Commits

• 5a7f9b0 Release v2.8.0 (#377)
• 4d20689 [SDK-3503] Add *_jwt token endpoint auth methods (#376)
• b03615c Update Codecov (#375)
• 5df2f18 Create .semgrepignore
• fcb6f25 Create semgrep.yml
• 4ffdfa8 Replace experimental express-oauth2-bearer (#373)
• e10e329 Release v2.7.3 (#372)
• 0849939 discovery errors should be handled in express middleware (#371)
• 000dcff Update index.d.ts (#369)
• cf698b0 Update EXAMPLES.md (#368)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)