Skip to content

chore(deps-dev): bump @node-oauth/oauth2-server from 4.3.3 to 5.3.0#1518

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/node-oauth/oauth2-server-5.3.0
Open

chore(deps-dev): bump @node-oauth/oauth2-server from 4.3.3 to 5.3.0#1518
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/node-oauth/oauth2-server-5.3.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 8, 2026

Bumps @node-oauth/oauth2-server from 4.3.3 to 5.3.0.

Release notes

Sourced from @​node-oauth/oauth2-server's releases.

5.3.0

Attention! This release fixes a reported vulnerability in the PKCE workflow!

Read more here: GHSA-jhm7-29pj-4xvf

This affects all versions below 5.3.0.

What's Changed

PKCE fixes

  • proper enforcement of parameter ABNF
  • failed PKCE challenge revokes authorization code to prevent brute force
  • challenge comparison using timing safe comparison
  • plain challenges need explicit option enablePlainPKCE to be true when creating a new server instance

Other improvements

Dependencies

Full Changelog: node-oauth/node-oauth2-server@v5.2.1...v5.3.0

... (truncated)

Changelog

Sourced from @​node-oauth/oauth2-server's changelog.

Changelog

5.0.0

This release contains several breaking changes. Please carefully consult the documentation while updating.

  • removed bluebird and promisify-any
  • uses native Promises and async/await everywhere
  • drop support for Node 14 (EOL), setting Node 16 as engine in package.json
  • this is a breaking change, because it removes callback support for OAuthServer and your model implementation.
  • fixed missing await in calling generateAuthorizationCode in AuthorizeHandler
  • fix scope validation bug
  • revoke code before validating redirect URI
  • improved Bearer token validation
  • validate scope as an array of strings (breaking change)
  • model support for retrieving user based on client
  • more tests added; test coverage improved

4.2.0

Fixed

  • fix(core): Bearer regular expression matching in authenticate handler #105
  • fix(request): set WWW-Authenticate header for invalid requests #96 oauthjs#646
  • fix(handler): deny access when body.allowed is 'false' (#94)
  • fix(handlers): skip varcheck for state when allowEmptyState #89 #93

Added

  • supported custom validateRedirectUri
  • feature: Supported state in case of denialMerge #99
  • Bearer regular expression matching in authenticate handler
  • docs: Update extension-grants.rst with example #92
  • feature(core): extract is.js into standalone package @​node-oauth/formats #55
  • feature(authorize): allow custom implementations of validateRedirectUri via model #89 p.4
    • support custom validateRedirectUri()
    • allow to implement model.validateRedirectUri
    • updated AuthorizeHandler
    • default conforms with RFC 6819 Section-5.2.3.5

Tests

  • Integration test password grant (#100)
    • test example
    • created db & model factories
    • added refresh_token grant type test
    • removed failing test, not implemented feature
    • add reference to issue
    • client authentication test
    • random client credentials in test
    • replace math.random by crypto.randomBytes

... (truncated)

Commits
  • cc70455 fix(deps): update package-lock after bumping package version
  • ef467c9 Merge commit from fork
  • 8a35509 publish 5.3.0
  • fe22982 fix: always perform timing safe euqal check on PKCE challenge
  • e2fcac4 fix: cover thrown errors in PKCE tests
  • 2d0659f fix: multiple PKCE vulnerabilities addressed
  • 79b7cf5 Merge pull request #419 from node-oauth/dependabot/npm_and_yarn/handlebars-4.7.9
  • a9c6028 Merge pull request #420 from node-oauth/dependabot/github_actions/actions/con...
  • 8b54e5b build(deps): bump actions/configure-pages from 5 to 6
  • ba80c3b build(deps-dev): bump handlebars from 4.7.8 to 4.7.9
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [@node-oauth/oauth2-server](https://github.com/node-oauth/node-oauth2-server) from 4.3.3 to 5.3.0.
- [Release notes](https://github.com/node-oauth/node-oauth2-server/releases)
- [Changelog](https://github.com/node-oauth/node-oauth2-server/blob/master/CHANGELOG.md)
- [Commits](node-oauth/node-oauth2-server@v4.3.3...v5.3.0)

---
updated-dependencies:
- dependency-name: "@node-oauth/oauth2-server"
  dependency-version: 5.3.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 8, 2026
@dependabot dependabot Bot requested review from danielpeintner and relu91 as code owners May 8, 2026 20:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 8, 2026
@danielpeintner
Copy link
Copy Markdown
Member

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant