Vulnerability in dependencies (openid -> request)

[ZissisT]

Hello,

right now passport-openid depends on openid module -> depends on request@^2.61.0 which has a memory leak vulnerability (request/request#2938) .

I opened a ticket there but this module seems abandoned, havard/node-openid#175 so I don't think that this will be fixed there, soon.
Unfortunately there is no openid version (not even v2) that has this fixed, so I don't know how this could be fixed with passport-openid (maybe depend on a different module, other than openid ? )

Thank you

[YasharF]

It might be worth for passport-openid to migrate from the openid package to the better-maintained node-openid-client.