8000 fix(deps): update dependency openid-client to v6 (develop) by renovate[bot] · Pull Request #6795 · hedgedoc/hedgedoc · GitHub
[go: up one dir, main page]
Skip to content

fix(deps): update dependency openid-client to v6 (develop) - #6795

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/develop-openid-client-6.x
Open

fix(deps): update dependency openid-client to v6 (develop)#6795
renovate[bot] wants to merge 1 commit into
developfrom
renovate/develop-openid-client-6.x

Conversation

@renovate
@renovate renovate Bot commented Aug 30, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
openid-client 5.7.1 → 6.8.9 age confidence

Release Notes

panva/openid-client (openid-client)

v6.8.9

Compare Source

Fixes

v6.8.8

Compare Source

Fixes
  • apply the default HTTP request timeout (af32783)
  • calculate token lifetimes using elapsed time (e816bf0)
  • isolate lazy client authentication handler caches (d687796)
  • passport: handle rejected async verification callbacks (d730f80)
  • preserve clock settings across DCR nonce retries (5433d68)
  • release: separate changelog sections (57fcbc6)
  • retain polling abort signals through response processing (b26170e)
  • select a unique decryption key when kid is omitted (10ba026)
Refactor
  • share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Compare Source

Fixes

v6.8.6

Compare Source

Fixes
  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #​885

v6.8.5

Compare Source

Fixes
  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)
Documentation
  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

v6.8.4

Compare Source

Fixes
  • apply optional non-repudiation on generic grant ID Tokens (6202888)
  • filter jwe decryption keys by algorithm (34e2ffd)
  • preserve poll abort signals on requests (96a2d17)
  • retry dpop nonce errors for generic grants (498c4d9)

v6.8.3

Compare Source

Documentation
  • note a workaround for redirect_uri with query string or bare origin (e9689de), closes #​868
Fixes
  • passport: delete one-time state on callback (1e7dd2e)

v6.8.2

Compare Source

Fixes
  • use duplex: half for fetchProtectedResource with ReadableStream body input (f6f84e2)

v6.8.1

Compare Source

Refactor
  • workaround dpop nonce caching caveats with customFetch (a9eb50f)

v6.8.0

Compare Source

Features
  • respect retry-after in CIBA and Device Authorization Grant polling (6ce3411)
Documentation
  • remove mention of Edge Runtime from the readme (2e41ad5)

v6.7.1

Compare Source

Fixes
  • passport: include req.host from express@​5 for ease of use in express@​4 (81f6c12)

v6.7.0

Compare Source

Features
  • support for the ML-DSA Algorithm Identifiers (9543da5)

v6.6.4

Compare Source

Fixes
  • recognize N_A in the token exchange grant (770b177)

v6.6.3

Compare Source

Documentation
  • fix TokenEndpointResponseHelpers.claims() note (b77c786)
Refactor
  • passport: allow custom logic to drive initiating auth requests (0b57115), closes #​811

v6.6.2

Compare Source

Fixes
  • RFC8414: strip any terminating "/" when pathname is present (e884302)

v6.6.1

Compare Source

Refactor
  • revert use 303 See Other for the redirect (54f2170)

v6.6.0

Compare Source

Features
  • passport: automatically use form_post response mode when using hybrid response types (c9f2993)
  • passport: easier way to use id_token_hint without overloads (afe24ae)
  • passport: easier way to use login_hint without overloads (264db00)
  • passport: easier way to use OAuth 2.0 Resource Indicators without overloads (7eb3076)
  • passport: easier way to use OAuth 2.0 Rich Authorization Requests without overloads (af0f9d6)
Refactor
  • passport: align use of callbackURL with other strategies and user expectations (333ad31)
  • passport: use 303 See Other for the redirect (4004070)
Documentation
  • passport: add clarity to oauth-specific AuthenticateOptions (dba27f3)
  • passport: expand descriptions and structure (0a173ce)

v6.5.3

Compare Source

Fixes
  • passport: handle JARM responses with authorizationCodeGrant instead of authorizationRequest (e734bec)

v6.5.2

Compare Source

Fixes
  • passport: allow custom query params in the initial authenticate() invocation (deb9925)

v6.5.1

Compare Source

Documentation
  • update implicitAuthentication and useIdTokenResponseType (4036242)
  • use GitHub Flavored Markdown for notes and warnings (a2482c7)
Refactor
  • use native Uint8Array<->base64 when available in the runtime (daf9118)

v6.5.0

Compare Source

Features
  • support response_type=id_token OIDC Authentication Responses (94bba9d)
Fixes
  • handle POST method Request inputs for non-hybrid responses (92faadc)
Documentation
  • add WWW-Authenticate parameter descriptions and RS Metadata related parameters (38f3448)
  • update implicitAuthentication and authorizationCodeGrant inline examples (b1f0a28)

v6.4.2

Compare Source

Documentation
  • add more resources for DCR (e9b978d)
  • hardcode spec revision links (e.g. final or errata) (afef152)
Fixes
  • properly handle a number of edge-cases in www-authenticate header parsing (56f0ed1)

v6.4.1

Compare Source

Fixes
  • allow client secret based auth factories to be used with DCR (d125b30)

v6.4.0

Compare Source

Features
  • add support for Dynamic Client Registration (15f6953)
Fixes
  • handle max_age=0 in buildAuthorizationUrlWithJAR() (5a5a7c9)

v6.3.4

Compare Source

Documentation
Refactor
  • use subpath export for JWE decryption dependency (f8c39fc)

v6.3.3

Compare Source

v6.3.2

Compare Source

Documentation
  • improve docs for default client authentication (3c9f0d9), closes #​761

v6.3.1

Compare Source

Refactor
  • passport: allow dpop handle to be retrieved with an async function (4491f70)
  • passport: bind authorization code to a DPoP Key (b536d0a)
  • passport: use the supportsPKCE() metadata helper (e13fb37)

v6.3.0

Compare Source

Features
  • add a helper to DPoPHandle to calculate dpop_jkt (e99a9d9)
Documentation
  • add DPoP example (2fb51e1)
  • reword buildAuthorizationUrl methods for more clarity (7e987d9)
  • update CIBA docs (35ff0f5)
  • update example diffs (2e152d9)
  • update JWT Introspection Response references to RFC 9701 (d742709)
  • update README.md (8dbb921)
  • update README.md (546b651)

v6.2.0

Compare Source

Features
  • add Client-Initiated Backchannel Authentication (fe6d996)
Documentation
  • explain more discovery() behaviours (271ac5b)
  • re-run docs (17b531a)
  • update buildAuthorizationUrl parameters description (23fb405)
  • update buildAuthorizationUrl parameters description (db9fd94)
Fixes
  • types: fix typo in DeviceAuthorizationGrantPollOptions (d3629c9)

v6.1.7

Compare Source

Refactor
  • types: move customFetch options into its own interface (57d8355)

v6.1.6

Compare Source

Fixes
  • handle scope, prompt, and passReqToCallback from generic passport types (cc92a36), closes #​735

v6.1.5

Compare Source

Fixes
  • passport: fix currentUrl when using express.Router (3b2d570), closes #​733

v6.1.4

Compare Source

Documentation
  • resolve discovery customFetch jsdoc mentioning timeout (5f4cd1b)

v6.1.3

Compare Source

Documentation
  • remove note from issuer transformation algorithm (5fda2cb)
Fixes
  • deal with discovery issues from b2clogin.com (b9a4f2f), closes #​718

v6.1.2

Compare Source

Refactor
  • rename the parameters positional argument in authorizationCodeGrant() (c79ccc5), closes #​712
Documentation
  • document behaviour of customFetch on discovery (072da62)
  • update Strategy.prototype.currentUrl JSDoc (46ea086), closes #​714

v6.1.1

Compare Source

Documentation
  • update link to passport example (110575b)
Fixes

v6.1.0

Compare Source

Features
  • add a server metadata helper for checking PKCE support (ca34a91)
  • add JWKS Cache management for use in non-persistent runtimes (cda4b53)

v6.0.0

Compare Source

⚠ BREAKING CHANGES
  • openid-client v6.x is a complete rewrite of the openid-client module, this is the first time since 0.1.0 (8 years ago) that the API has drastically changed. The new module structure and API focuses on three core principles:
  • runtime compatibility (adding support for Deno, Cloudflare Workers, Bun, and other Web API interoperable runtimes)
  • tree-shakeability (bundles should not contain features that don't end up being used)
  • less options (removing support for processing deprecated response types, cutting down on the number of combinations that need to handled)

To that end openid-client@​6 no longer supports the full cartesian matrix of response types and response modes, it no longer supports issuing encrypted assertions, decrypting assertions is limited to only a few algorithms, it no longer supports Dynamic Client Registration or Management, and Self-Issued OpenID Provider responses are also not supported.

The new API makes basic setups simple while allowing some degree of complexity where needed.

openid-client@​6 is an ESM module using ES2022 syntax and it depends on WebCryptoAPI and Fetch API globals being available in the JS runtime.

openid-client@​6 is written in TypeScript and its exported types come with comment annotations.

(Node.js) Versions 20.x and newer have all the necessary globals.

(Node.js) CJS style let client = require('openid-client') is possible in versions where process.features.require_module is true. This is a new Node.js feature slated to be released without a CLI flag in 23.x and 22.x

Documentation
Refactor

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Updates to dependencies label Aug 30, 2026
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch 3 times, most recently from 367c194 to 89b42ec Compare September 5, 2026 13:47
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch 3 times, most recently from 6671470 to 40411d4 Compare September 9, 2026 21:49
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch from 40411d4 to ebd0853 Compare September 25, 2026 02:31
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch 2 times, most recently from 2aea94f to 22743ff Compare October 22, 2026 15:47
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch from 22743ff to 05c440c Compare November 3, 2026 16:39
@renovate
fix(deps): update dependency openid-client to v6
77ac1d8 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/develop-openid-client-6.x branch from 05c440c to 77ac1d8 Compare November 5, 2026 22:53

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Updates to dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants

0