Skip to content

Bump openid-client from 5.6.5 to 6.8.7 in /Framework - #3589

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/Framework/openid-client-6.8.7
Open

Bump openid-client from 5.6.5 to 6.8.7 in /Framework#3589
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/Framework/openid-client-6.8.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 25, 2026

Copy link
Copy Markdown
Contributor

Bumps openid-client from 5.6.5 to 6.8.7.

Release notes

Sourced from openid-client's releases.

v6.8.7

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

v6.8.4

Fixes

  • apply optional non-repudiation on generic grant ID Tokens (6202888)
  • filter jwe decryption keys by algorithm (34e2ffd)
  • preserve poll abort signals on requests (96a2d17)
  • retry dpop nonce errors for generic grants (498c4d9)

v6.8.3

Documentation

  • note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868

Fixes

  • passport: delete one-time state on callback (1e7dd2e)

v6.8.2

Fixes

  • use duplex: half for fetchProtectedResource with ReadableStream body input (f6f84e2)

v6.8.1

Refactor

  • workaround dpop nonce caching caveats with customFetch (a9eb50f)

v6.8.0

... (truncated)

Changelog

Sourced from openid-client's changelog.

6.8.7 (2026-08-20)

Fixes

  • allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

  • avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

  • types: expose custom fetch duplex option (a125bc8)
  • types: use portable oauth4webapi declarations (2cab98f)

Documentation

  • improve API index tables (c6e4ae3)
  • update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

6.8.4 (2026-04-27)

Fixes

  • apply optional non-repudiation on generic grant ID Tokens (6202888)
  • filter jwe decryption keys by algorithm (34e2ffd)
  • preserve poll abort signals on requests (96a2d17)
  • retry dpop nonce errors for generic grants (498c4d9)

6.8.3 (2026-04-13)

Documentation

  • note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868

Fixes

  • passport: delete one-time state on callback (1e7dd2e)

6.8.2 (2026-02-07)

Fixes

... (truncated)

Commits
  • daa81c1 chore(release): 6.8.7
  • 38bd8c0 fix: allow destructuring the claims helper
  • 2f12d9a chore: cleanup after release
  • 4b2a7ab chore(release): 6.8.6
  • 492c3c3 fix: avoid undefined user-agent in fetchProtectedResource
  • 0e0539b ci: update conformance runs outputs
  • b7ac789 chore: cleanup after release
  • efb53e5 chore(release): 6.8.5
  • 4a66935 test: deflake Retry-After date assertions
  • 6b7afa3 chore: bump packages
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openid-client since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [openid-client](https://github.com/panva/openid-client) from 5.6.5 to 6.8.7.
- [Release notes](https://github.com/panva/openid-client/releases)
- [Changelog](https://github.com/panva/openid-client/blob/main/CHANGELOG.md)
- [Commits](panva/openid-client@v5.6.5...v6.8.7)

---
updated-dependencies:
- dependency-name: openid-client
  dependency-version: 6.8.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file Framework labels Aug 25, 2026
@dependabot
dependabot Bot requested a review from graduta as a code owner August 25, 2026 05:02
@dependabot dependabot Bot added Framework dependencies Pull requests that update a dependency file labels Aug 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file Framework

Development

Successfully merging this pull request may close these issues.

0 participants