Changelog

All notable changes to this project will be documented in this file. See commit-and-tag-version for commit guidelines.

9.11.3 (2026-08-08)

Fixes

• omit undefined response parameters (0c65aa6)

Refactor

• drop the @koa/cors runtime dependency (4eca0f2)
• drop the eta runtime dependency (f0da9d2)
• drop the jsesc runtime dependency (b2f6c0c)
• drop the nanoid runtime dependency (86a42da)
• drop the quick-lru runtime dependency (e818a6d)
• drop the raw-body runtime dependency (9312ca7)
• replace @koa/router with an internal router (3b33e5f)

9.11.2 (2026-08-03)

Fixes

• adapter: apply memory entry expiration correctly (ff6c0d9)
• adapter: isolate default memory storage per provider (b4d27aa)
• cimd: bound the metadata document cache (62e1f66)
• grants: isolate feature-specific grant parameters (5490fc9)

Refactor

• adapter: maintain memory adapter indexes (3196032)
• add cause to provider errors (b329354)
• dpop: centralize replay detection (1d764c8)
• ensure incoming Configuration is not mutated (e59fd60)
• grants: share source lifecycle checks (d12f969)
• resources: share access token validation (1770bcf)
• retain memory entries through clock tolerance (72ea716)

Performance

• cimd: coalesce concurrent document fetches (5248ff2)
• configuration: reuse defaults during draft validation (1b1306d)
• jwt: stop key iteration after successful crypto (d428277)
• models: cache payload allowlists (1b781c9)
• params: scan duplicate parameters once (b572798)

9.11.1 (2026-07-27)

Fixes

• correct typos and grammar in user-facing messages (1be723e)
• derive server challenges from the clock rather than a timer (ba9d960), closes #1438
• don’t dereference a skipped refresh token lookup (fe6f90e)
• don’t emit grant.revoked twice during logout (a41d043)
• only recognize dpop_jkt when DPoP is enabled (8c38630)
• use the effective scope when resolving ID Token claims (ab1f41b)

Documentation

• correct stale configuration documentation (6096bef)
• document the missing emitted events (c295623)

Refactor

• remove unused OIDCContext resolvedClaims (5fe6807)

9.11.0 (2026-07-26)

Features

• allow customizing the OpenID4VCI Credential Endpoint expected audience (313eaa6)

9.10.0 (2026-07-20)

Features

• Experimental support for OpenID for Verifiable Credential Issuance (43a5a88)
• update Attestation-Based Client Authentication to -10 (b833e2f)

9.9.1 (2026-07-07)

Fixes

• ignore stale clients during logout confirmation (7216f2b)

9.9.0 (2026-07-06)

Features

• bump CIMD draft to -02 (6a26aff)

9.8.6 (2026-06-26)

Fixes

• don’t call revokeByGrantId with no grantId (0bc71ad), closes #1431

9.8.5 (2026-06-15)

Fixes

• escape default html helper output in shouldChange functions (f688321)

Documentation

• note helpers requiring deployment customization (567e551)

9.8.4 (2026-05-29)

Refactor

• detect non-node runtimes before checking for LTS (b3be0fd), closes #1424
• isolate SSRF dispatcher protection (1f64996)

9.8.3 (2026-04-27)

Fixes

• await registration token policy (6269602)
• pass ciba user code to verifier (a340869)
• reject malformed dpop htu with a clearer message (1b6146c)
• select signing keys for jwt access tokens (1d6df9c)
• validate ciba notification tokens (2807a8f)

9.8.2 (2026-04-17)

Fixes

• html-escape debug data sent to development-only interactions (924d25c), closes #1414

9.8.1 (2026-04-15)

Refactor

• relax native app custom URI scheme validation (75be6ce), closes #1411

9.8.0 (2026-04-07)

Features

• promote rpMetadataChoices to stable (cc8cfcc)

Refactor

• do not depend on undici being part of the bundle (2ffec73)

9.7.1 (2026-03-18)

Refactor

• CIMD: filter unrecognized array members before validating (969edba), closes #1398
• fetch_body_check.js now returns early when limit is Infinite (a794f51)
• fixup grant_types and response_types mismatch instead of rejecting (81538bf)
• process client schema after custom metadata processing (35fb736)
• pull csrf into a shared module (6239f17)

9.7.0 (2026-03-06)

Features

• add configuration for limiting external resource body limits (0c424cd)
• experimental support for Client ID Metadata Document (CIMD) (d5323f4)
• prevent fetching special-use IP address resources (1548834)

Documentation

• align section titles and auto-generate toc (287bfa8)
• description fixes and various editorial edits (a8f4f15)
• fix attestClientAuth link (9c6f095)
• solve generated nested lists (d1ebcd2)
• update README.md prose for experimental features (b029f47)
• update the generated content to reflect the jsdoc structure (aa9f83b)

Refactor

• extract setWWWAuthenticateHeader to a shared module (bb66e62)

9.6.1 (2026-02-19)

Refactor

• extract NON_REJECTABLE_CLAIMS into shared constant (2b7c025)
• extract shared grant handler helpers to reduce duplication (f5eee9e)
• extract shared token finder for introspection and revocation (666c2b0)

Fixes

• required PAR should not affect CIBA and DAG (8167bd0)

9.6.0 (2025-12-07)

Features

• add RAR support to CIBA flows (0fc5893), closes #1358

Documentation

• update spec links (019fa43)

9.5.2 (2025-10-24)

Refactor

• change new Debug() to debug() (#1363) (b86b47c)

9.5.1 (2025-08-29)

Fixes

• safeguard global navigator access (1caae21)

9.5.0 (2025-08-29)

Features

• support ML-DSA JWS algorithm identifiers (f308b09)

Refactor

• add a warning for more unsupported runtimes (c55d58e)
• make warn/info warnings colorization a no-op in nonTTY (0c0a5b6)

9.4.2 (2025-08-23)

Fixes

• check for native logout redirect allowed same way as during auth (419f286), closes #1351

9.4.1 (2025-08-11)

Documentation

• add an getAttestationSignaturePublicKey example (3a7730c)

Refactor

• avoid code generation from strings by pre-compiling eta views (f997073)
• drop the default implementation of pairwiseIdentifier (6a2338a)
• remove oidc-token-hash dependency (b607491)

9.4.0 (2025-07-17)

Features

• Experimental support for Attestation-Based Client Authentication (d655ebd)

Refactor

• consistently lowercase header names and use req/res aliases (1748a54)
• cors: update default client-based cors helper (77e06eb)
• reconcile dpop and attestation challenge implementations (e31f639)

Documentation

• updated documentation for configuration options (5710d61)

9.3.0 (2025-07-16)

Features

• revocation: add an allowed token revocation policy helper (a7e47e4)

Documentation

• update README.md (857c34d)

Fixes

• introspection: use unsupported_token_type to indicate structured jwt tokens cannot be introspected (c9001be)
• revocation: use unsupported_token_type to indicate structured jwt tokens cannot be revoked (b45b00c)

Refactor

• pull structured token rejection to a shared middleware (30367af)

9.2.0 (2025-06-24)

Features

• expose RFC8414 Authorization Server Metadata route (c5bd90f)

9.1.3 (2025-06-02)

Fixes

• ensure an account’s accountId and claims().sub is the same (9b89153), closes #1336

9.1.2 (2025-05-28)

Fixes

• ignore allowOmittingSingleRegisteredRedirectUri when FAPI 2.0 is used (e2de529)

9.1.1 (2025-04-28)

Refactor

• oidc-provider now uses koa@3 (3a83d32)

---

Older entries →