fix: update jose to fix nextjs edge error with middleware

[belgattitude]

☕️ Reasoning

Just a update of latest jose dependency, will fix #5374

Basically when building a nextjs-app, you'll get

A Node.js API is used (process.versions at line: 6) which is not supported in the Edge Runtime.
Import trace for requested module:
../../node_modules/jose/dist/browser/runtime/jwk_to_key.js (...)
./src/middleware.ts

$ yarn why
├─ next-auth@npm:4.10.3
│  └─ jose@npm:4.3.7 (via npm:^4.3.7)

The problem was fixed upstream in the jose library v4.8.0.

As I installed next-auth long ago and wasn't using middlewares, jose wasn't updated in the lock file by subsequent updates. So I still got the old one (at least with yarn 3+, not sure about npm, pnpm)

This P/R just prevent this issue, by requiring a version that at least works in the edge/workers.

PS:

Workarounds:

• explicitly add jose as a direct dep in my project and dedupe: like this belgattitude/nextjs-monorepo-example@f7d8b1f
• recreate the lock file (less a good idea)

🧢 Checklist

• Documentation
• Tests
• Ready to be merged

🎫 Affected issues

Will close this: #5372

PS: another has been closed before: #4806, but I suspect the author did recreate a new lock file

📌 Resources

• Contributing guidelines
• Code of conduct
• Contributing to Open Source

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Ignored Deployment

Name	Status	Preview	Updated
next-auth	⬜️ Ignored (Inspect)		Sep 17, 2022 at 5:28PM (UTC)

[ThangHuuVu]

Thanks for the PR!
So from my understanding, the check for Node.js version won't show the warning anymore in Next.js 12.2 and up
It's still nice to have this version bump in NextAuth.js