[Snyk] Security upgrade next-auth from 3.17.2 to 4.0.1

[bduff9]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-JOSE-3018688	Yes	No Known Exploit
	551/1000 Why? Recently disclosed, Has a fix available, CVSS 5.3	Resource Exhaustion SNYK-JS-JOSE-6419224	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: next-auth

The new version differs by 250 commits.

• fedb848 docs: add top contributors to package.json
• c0dddfb docs: upgrade README
• 50fe115 Release v4
• cc17ddf fix: Fallback to --color-text when no color-brand (#3313)
• 8644e55 Merge branch 'main' into beta
• d1d0db4 feat(providers): ensure GitHub provider always gives an email (#3302)
• b01f680 chore(providers): TS improvements (#3295)
• c44b860 feat(providers): refactor Apple provider (#2875)
• 22f74d7 fix(providers): correct authorization url for Atlassian (#2999)
• 2570168 fix: add custom error message when session required (#3288)
• 187a147 feat(oauth): expose `httpOptions` (#3287)
• 4dc7674 fix(providers): Rewrite EVEOnline in TS, fix default scopes (#2759)
• 35ee608 feat(providers): add Osu! provider (#3234)
• 0f132de feat(providers): add Pipedrive provider (#3011)
• 31426b9 fix(providers): match filename with 42 Provider's `id` (#3225)
• 64b2a2c fix: assert `action` when `req.query` isn't available (#3222)
• 7beb3ff refactor(providers): cleanup 42 (#3221)
• 432876c fix(providers): refactor Zoom
• 15d1fab fix: correct assertion when Credentials only (#3217)
• 5e803cd refactor(providers): convert 42 to TypeScript (#3211)
• 76bf524 feat: make missing secret an error (#3143)
• f9e0ef8 feat: introduce chunking when session cookie becomes too big (#3101)
• 38cefdd fix(providers): set 42 default scope (#3189)
• b871b47 fix: allow configuring http timeout (#3188)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)