We went ahead and released a version 4.1.0 on a separate project -- feel free to install that to cover and resolve any vulnerabilities

[dannyreg]

https://github.com/node-oauth/node-oauth2-server

See the changelog for what we did, we removed a lot of unneeded dependencies and updated dependencies that had vulnerabilities.

You can still this version by running

npm i @node-oauth/oauth2-server, should just be a drop in replacement