GitHub auth to get emails uses ?access_token=... which is deprecated

[benjie]

Hi @benjie,

On February 4th, 2020 at 08:51 (UTC) your application (Graphile Starter (Heroku)) used an access token (with the User-Agent passport-github) as part of a query parameter to access an endpoint through the GitHub API:

https://api.github.com/user/emails

Please use the Authorization HTTP header instead as using the access_token query parameter is deprecated.

Depending on your API usage, we'll be sending you this email reminder once every 3 days for each token and User-Agent used in API calls made on your behalf.
Just one URL that was accessed with a token and User-Agent combination will be listed in the email reminder, not all.

Visit https://developer.github.com/changes/2019-11-05-deprecated-passwords-and-authorizations-api/#authenticating-using-query-parameters for more information.

Thanks,
The GitHub Team

Might be sufficient to just upgrade passport-github?

[singingwolfboy]

Relevant issue is here: jaredhanson/passport-github#75

Looks like passport-github is unmaintained, and we should probably switch to passport-github2

[benjie]

Lets give Jared a few days to respond first. I'd rather keep using the module from the Passport.js author if possible; if it is unmaintained hopefully he'll archive it and hand over the reins.

[benjie]

As per http://www.passportjs.org/packages/passport-github2/ it seems that switching is sensible and supported 👍