Instructure Canvas has supported LTIv1.2 for for some time, and currently supports LTIv1.3
The oauth-signature@1.5.0 is deprecated (not been updated in 8 years and as 8year old stale pulls) https://github.com/bettiolo/oauth-signature-js
The dependent crypto-js@3.1.9-1 lib is flagging security issues, and is nearly officially deprecated brix/crypto-js#512