chore(repo): bump jwks-rsa from 3.2.2 to 4.1.0

apps/backend/jest.config.cjs

@@ -50,5 +50,29 @@ module.exports = {
         isolatedModules: true,
       },
     ],
+    // jwks-rsa 4 depends on jose 6, which is ESM-only ("type": "module", no
+    // require condition). This backend is CommonJS, so Jest cannot parse it and
+    // every suite that transitively reaches the auth stack fails on
+    // `Unexpected token 'export'`. Transpile it for the test run only; the
+    // application build is unaffected because tsc never touches node_modules.
+    "^.+\\.m?js$": [
+      "ts-jest",
+      {
+        diagnostics: false,
+        isolatedModules: true,
+        tsconfig: {
+          allowJs: true,
+          module: "CommonJS",
+          target: "ES2022",
+          esModuleInterop: true,
+        },
+      },
+    ],
   },
+  // Everything in node_modules stays untransformed except jose. The alternation
+  // covers both segments of the pnpm layout: the store directory
+  // (node_modules/.pnpm/jose@6.2.8/) and the link inside it
+  // (.../node_modules/jose/), so neither position matches and the files are
+  // handed to the transform above.
+  transformIgnorePatterns: ["node_modules/(?!\\.pnpm/jose@|jose/)"],
 };

apps/backend/package.json

@@ -50,7 +50,7 @@
     "google-auth-library": "^10.9.1",
     "helmet": "^8.3.0",
     "jsonwebtoken": "9.0.3",
-    "jwks-rsa": "^3.2.0",
+    "jwks-rsa": "^4.1.0",
     "moment": "2.30.1",
     "moment-timezone": "^0.6.3",
     "multer": "2.2.0",

packages/auth/package.json

@@ -20,7 +20,7 @@
   "dependencies": {
     "supertokens-node": "^24.0.3",
     "jsonwebtoken": "9.0.3",
-    "jwks-rsa": "^3.2.0"
+    "jwks-rsa": "^4.1.0"
   },
   "peerDependencies": {
     "cors": "^2.8.5",