Bump oidc-provider from 8.8.1 to 9.0.1

[dependabot]

Bumps oidc-provider from 8.8.1 to 9.0.1.

Release notes

Sourced from oidc-provider's releases.

v9.0.1

Documentation

• mark experimental features more distinctly (986adc5)
• update references and styling of spec links (a4787b8)

Fixes

• DCR endpoints only include www-authenticate for non-registration related errors (9a864d6)

Refactor

• client schema defaults and static props (843943d)
• handle frame-ancestors in wmrm without a regexp (4f85585)
• push multiple elements to the recognized array in client_schema (d478a8b)
• simpler DCR validate registration access token (5f01eda)

v9.0.0

⚠ BREAKING CHANGES

• authorization and logout endpoints no longer support the HTTP POST method by default, this can be re-enabled using the enableHttpPostMethods boolean configuration, this also requires that cookies.long.sameSite is set to none
• cookie session sameSite attribute default is now "lax" instead of "none"
• userinfo requests with bearer tokens will now fail if they also include DPoP
• userinfo now includes both dpop and bearer challenges when dpop is enabled
• accessing protected resources without an access token will now yield a 401 HTTP Status Code instead of a 400
• default PKCE configuration no longer requires PKCE to be used unless RFC9700 or a given profile says so
• removed the provider.Account getter
• all Provider routes will now end the HTTP request when finished, koa middlewares that are "downstream" will no longer be executed after a route is matched in oidc-provider, "upstream" control flows are unaffected
• the Provider no longer includes a catch-all 404 Not Found error handler
• FAPI profile behaviours no longer force PKCE, these should be forced by configuring the pkce.required configuration helper the default of which already does so.
• the server's JWK Key IDs (JWK kid parameter) now must be unique, no two keys must use the same kid.
• the revokeGrantPolicy configuration helper is now also invoked during opaque Access Token revocation, its default return remains false for this case though
• CIBA ping and poll delivery mode ID Tokens no longer include at_hash, urn:openid:params:jwt:claim:rt_hash, and urn:openid:params:jwt:claim:auth_req_id
• authorization code grant type issued ID Tokens no longer include at_hash
• device authorization grant type issued ID Tokens no longer include at_hash
• refresh token grant type issued ID Tokens no longer include at_hash
• implicit grant type issued ID Tokens no longer include s_hash unless the request is a FAPI 1.0 Final request
• global fetch() API is now used to make outgoing HTTP requests instead of the "got" module.
• the httpOptions configuration option was removed and a new option to accomodate the use of fetch() interface was added. This options is aptly called "fetch" and its call signature and expected returns mirror the fetch() API.
• Enabling JAR (Request Objects by Value) is now enabled via features.requestObjects.enabled boolean instead of features.requestObjects.request boolean
• removed support for Passing a Request Object by Reference (JAR request_uri)
• removed legacy sameSite cookie fallback
• removed support for Node.js 18.x
• removed support for Node.js 20.x
• removed the pkce.methods configuration
• removed the features.requestObjects.mode configuration
• removed support for Ed448
• removed support for X448

... (truncated)

Changelog

Sourced from oidc-provider's changelog.

9.0.1 (2025-04-17)

Documentation

• mark experimental features more distinctly (986adc5)
• update references and styling of spec links (a4787b8)

Fixes

• DCR endpoints only include www-authenticate for non-registration related errors (9a864d6)

Refactor

• client schema defaults and static props (843943d)
• handle frame-ancestors in wmrm without a regexp (4f85585)
• push multiple elements to the recognized array in client_schema (d478a8b)
• simpler DCR validate registration access token (5f01eda)

9.0.0 (2025-04-15)

⚠ BREAKING CHANGES

• authorization and logout endpoints no longer support the HTTP POST method by default, this can be re-enabled using the enableHttpPostMethods boolean configuration, this also requires that cookies.long.sameSite is set to none
• cookie session sameSite attribute default is now "lax" instead of "none"
• userinfo requests with bearer tokens will now fail if they also include DPoP
• userinfo now includes both dpop and bearer challenges when dpop is enabled
• accessing protected resources without an access token will now yield a 401 HTTP Status Code instead of a 400
• default PKCE configuration no longer requires PKCE to be used unless RFC9700 or a given profile says so
• removed the provider.Account getter
• all Provider routes will now end the HTTP request when finished, koa middlewares that are "downstream" will no longer be executed after a route is matched in oidc-provider, "upstream" control flows are unaffected
• the Provider no longer includes a catch-all 404 Not Found error handler
• FAPI profile behaviours no longer force PKCE, these should be forced by configuring the pkce.required configuration helper the default of which already does so.
• the server's JWK Key IDs (JWK kid parameter) now must be unique, no two keys must use the same kid.
• the revokeGrantPolicy configuration helper is now also invoked during opaque Access Token revocation, its default return remains false for this case though
• CIBA ping and poll delivery mode ID Tokens no longer include at_hash, urn:openid:params:jwt:claim:rt_hash, and urn:openid:params:jwt:claim:auth_req_id
• authorization code grant type issued ID Tokens no longer include at_hash
• device authorization grant type issued ID Tokens no longer include at_hash
• refresh token grant type issued ID Tokens no longer include at_hash
• implicit grant type issued ID Tokens no longer include s_hash unless the request is a FAPI 1.0 Final request
• global fetch() API is now used to make outgoing HTTP requests instead of the "got" module.
• the httpOptions configuration option was removed and a new option to accomodate the use of fetch() interface was added. This options is aptly called "fetch" and its call signature and expected returns mirror the fetch() API.
• Enabling JAR (Request Objects by Value) is now enabled via features.requestObjects.enabled boolean instead of features.requestObjects.request boolean
• removed support for Passing a Request Object by Reference (JAR request_uri)
• removed legacy sameSite cookie fallback
• removed support for Node.js 18.x
• removed support for Node.js 20.x

... (truncated)

Commits

• f3e302d chore(release): 9.0.1
• 5f01eda refactor: simpler DCR validate registration access token
• 9a864d6 fix: DCR endpoints only include www-authenticate for non-registration related...
• 986adc5 docs: mark experimental features more distinctly
• 4f85585 refactor: handle frame-ancestors in wmrm without a regexp
• a4787b8 docs: update references and styling of spec links
• 843943d refactor: client schema defaults and static props
• d478a8b refactor: push multiple elements to the recognized array in client_schema
• c286ffc chore(release): 9.0.0
• 6fc1b4d chore: bump packages
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #6971.