v9.8.4

Refactor

• detect non-node runtimes before checking for LTS (b3be0fd), closes #1424
• isolate SSRF dispatcher protection (1f64996)

v9.8.3

Fixes

• await registration token policy (6269602)
• pass ciba user code to verifier (a340869)
• reject malformed dpop htu with a clearer message (1b6146c)
• select signing keys for jwt access tokens (1d6df9c)
• validate ciba notification tokens (2807a8f)

v9.8.2

Fixes

• html-escape debug data sent to development-only interactions (924d25c), closes #1414

v9.8.1

Refactor

• relax native app custom URI scheme validation (75be6ce), closes #1411

v9.8.0

Features

• promote rpMetadataChoices to stable (cc8cfcc)

Refactor

• do not depend on undici being part of the bundle (2ffec73)

v9.7.1

Refactor

• CIMD: filter unrecognized array members before validating (969edba), closes #1398
• fetch_body_check.js now returns early when limit is Infinite (a794f51)
• fixup grant_types and response_types mismatch instead of rejecting (81538bf)
• process client schema after custom metadata processing (35fb736)
• pull csrf into a shared module (6239f17)

v9.7.0

Features

• add configuration for limiting external resource body limits (0c424cd)
• experimental support for Client ID Metadata Document (CIMD) (d5323f4)
• prevent fetching special-use IP address resources (1548834)

Documentation

• align section titles and auto-generate toc (287bfa8)
• description fixes and various editorial edits (a8f4f15)
• fix attestClientAuth link (9c6f095)
• solve generated nested lists (d1ebcd2)
• update README.md prose for experimental features (b029f47)
• update the generated content to reflect the jsdoc structure (aa9f83b)

Refactor

• extract setWWWAuthenticateHeader to a shared module (bb66e62)

v9.6.1

Refactor

• extract NON_REJECTABLE_CLAIMS into shared constant (2b7c025)
• extract shared grant handler helpers to reduce duplication (f5eee9e)
• extract shared token finder for introspection and revocation (666c2b0)

Fixes

• required PAR should not affect CIBA and DAG (8167bd0)

v9.6.0

Features

• add RAR support to CIBA flows (0fc5893), closes #1358

Documentation

• update spec links (019fa43)

v9.5.2

Refactor

• change new Debug() to debug() (#1363) (b86b47c)