Remove jose dependency, fix readme example

[bluefoxy009]

The current implementation of XboxTokenManager uses the exportJWK method of jose. Internally, jose ensures the type of the provided key to be KeyObject (available since Node v11.6.0 and in Bun v1.0.5) and returns the value of it's export method. This adds overhead and causes compatibility issues (see #95). By directly calling the export method of the KeyObject in the constructor, we remove the need for jose and achieve compatibility with multiple runtimes.

The second part of the pull request fixes the example in the README, where getMinecraftJavaToken doesn't automatically fetch the profile. The example has been updated to include the option fetchProfile: true so the expected response is accurate to what would actually be returned by the example.

This PR closes #88 and #95

[socket-security]

Removed dependencies detected. Learn more about Socket for GitHub ↗︎

🚮 Removed packages: npm/[email protected]

View full report↗︎

[extremeheat]

The JWK export method if I recall was only added into in node 18 by the creator of Jose. But it seems that since we’ve recently updated the CI to v20 it indeed would make sense to use the standard method here.

[bluefoxy009]

i don't know who added it but node's docs show v15.6.0, but reguardless it's implemented so good to use it

[extremeheat]

18 came shortly after 16 because of a security issue. When the code was written we were on 14. My comment was that we did discuss using new 16/18 methods but we didn’t want to break compat by requiring 18 as mineflayer and all the other PrismarineJS were still supporting >=v14 of node. But yes this shouldn’t be a problem anymore.

[extremeheat]

Thanks for looking into this, LGTM.