Replace vulnerable dependency to `jwk-to-pem` with function from `node:crypto` [SOLVED] (by using a shim, see comment in this issue)

[mn4367]

Grant uses jwk-to-pem that has a dependency to elliptic which itself has a vulnerability but seems to be abandoned.

jwk_to_pem can be replaced completely by two functions which are part of the Node.js crypto module: createPublicKey and createPrivateKey.

In the case of grant it's sufficient to replace

var pem = require('jwk-to-pem');
return pem(jwk, { private: true });

in oidc.js (lines 29,30) with

return crypto.createPrivateKey({
  key: jwk,
  format: "jwk"
}).export({
  type: "pkcs8",
  format: "pem"
});

and to remove the jwk-to-pem dependency from package.json. See also Brightspace/node-jwk-to-pem#193.

[mn4367]

Update for users wanting to avoid the audit vulnerability caused by jwk-to-pem in grant; the original jwk-to-pem can now be replaced with this (dependency free) shim without even touching grant:

@mn4367/jwk-to-pem.

See there for instructions, the fix is just a one-liner in package.json.