v5.6.3

Fixes

• encode client_secret_basic - _ . ! ~ * ' ( ) characters (5a2ea80)

v5.6.2

Refactor

• issuer discovery (#637) (c228877)

Fixes

• add explicit Accept-Encoding header to http requests (abcb564), closes #648

v5.6.1

Fixes

• consistent space encoding in authorizationUrl (#627) (ad68223), closes #626

v5.6.0

Features

• experimental Bun support (a9d3a87), closes #622 #623

v5.5.0

Features

• DPoP: remove experimental warning, DPoP is now RFC9449 (133a022)

v5.4.3

Fixes

• handle empty client_secret with basic and post client auth (#610) (402c711), closes #609

v5.4.2

Fixes

• bump oidc-token-hash (20607e9)

v5.4.1

This release contains only code refactoring, dependency, or documentation updates. The release process now also uses provenance statements.

v5.4.0

Features

• allow third party initiated login requests to trigger strategy (568709a), closes #510 #564

v5.3.4

Refactor

• remove use of Node.js v8 builtin (f1881bc), closes #442 #475 #555

Fixes

• regression introduced in v5.3.3 (4f6e847)