Skip to content

Bump openid-client from 5.7.1 to 6.8.7 - #299

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/openid-client-6.8.7
Open

Bump openid-client from 5.7.1 to 6.8.7#299
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/openid-client-6.8.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps openid-client from 5.7.1 to 6.8.7.

Release notes

Sourced from openid-client's releases.

v6.8.7

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

v6.8.4

Fixes

  • apply optional non-repudiation on generic grant ID Tokens (6202888)
  • filter jwe decryption keys by algorithm (34e2ffd)
  • preserve poll abort signals on requests (96a2d17)
  • retry dpop nonce errors for generic grants (498c4d9)

v6.8.3

Documentation

  • note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868

Fixes

  • passport: delete one-time state on callback (1e7dd2e)

v6.8.2

Fixes

  • use duplex: half for fetchProtectedResource with ReadableStream body input (f6f84e2)

v6.8.1

Refactor

  • workaround dpop nonce caching caveats with customFetch (a9eb50f)

v6.8.0

... (truncated)

Changelog

Sourced from openid-client's changelog.

6.8.7 (2026-08-20)

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

6.8.4 (2026-04-27)

Fixes

  • apply optional non-repudiation on generic grant ID Tokens (6202888)
  • filter jwe decryption keys by algorithm (34e2ffd)
  • preserve poll abort signals on requests (96a2d17)
  • retry dpop nonce errors for generic grants (498c4d9)

6.8.3 (2026-04-13)

Documentation

  • note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868

Fixes

  • passport: delete one-time state on callback (1e7dd2e)

6.8.2 (2026-02-07)

Fixes

... (truncated)

Commits
  • daa81c1 chore(release): 6.8.7
  • 38bd8c0 fix: allow destructuring the claims helper
  • 2f12d9a chore: cleanup after release
  • 4b2a7ab chore(release): 6.8.6
  • 492c3c3 fix: avoid undefined user-agent in fetchProtectedResource
  • 0e0539b ci: update conformance runs outputs
  • b7ac789 chore: cleanup after release
  • efb53e5 chore(release): 6.8.5
  • 4a66935 test: deflake Retry-After date assertions
  • 6b7afa3 chore: bump packages
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openid-client since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [openid-client](https://github.com/panva/openid-client) from 5.7.1 to 6.8.7.
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v5.7.1...v6.8.7)

---
updated-dependencies:
- dependency-name: openid-client
  dependency-version: 6.8.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants