npm / oidc-provider
oidc-provider
What changed in oidc-provider 9, from its official release notes, upgrade guides and advisories. Also covers @types/oidc-provider. Sources checked 2026-10-21.
11 breaking12 security6 new APIs and options6 behavior and defaults22 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initoidc-provider 957 changes
Breaking changes 11
Unknown authorization detail types are rejected.
Loosely decoded Basic credentials are rejected.
Empty URL components are rejected.
Sparse metadata arrays are rejected.
Non-string htu claims are rejected.
Request bodies are required to be JSON objects.
Ambiguous JWT proof keys are rejected.
OAuth request syntax is enforced.
Opaque origins are rejected by default.
Non-string sector document entries are rejected.
Unrecognized array members are filtered before validation, changing how CIMD array values are handled.
Security 12
The attestation proof-of-possession jti is validated.
Audience claim members are validated.
JWT proof identity claims are validated.
Key attestation contents are validated.
Model payloads are filtered safely.
Nested option validation is hardened.
Default memory storage is isolated per provider, preventing providers from sharing the same default storage.
dpop_jkt is recognized only when DPoP is enabled.
Default HTML helper output is escaped in shouldChange functions.
CIBA notification tokens are validated.
Malformed DPoP htu values are rejected with a clearer message.
Debug data sent to development-only interactions is now HTML-escaped.
New APIs and options 6
Built-in sender constraint checks are exposed for use by developers.
Grant helpers were added for custom grant implementers.
Allows customizing the expected audience of the OpenID4VCI Credential Endpoint.
Adds experimental support for OpenID for Verifiable Credential Issuance.
Adds experimental support for Client ID Metadata Document (CIMD).
Adds configuration for limiting external resource body limits.
Behavior and default changes 6
Rich Authorization Requests graduated.
Updates Attestation-Based Client Authentication to -10.
Updates CIMD support to draft -02, which may affect client metadata behavior.
Validation for native app custom URI schemes is relaxed, allowing schemes that were previously rejected.
rpMetadataChoices is now stable, so developers can rely on it as a stable configuration option.
Prevents fetching special-use IP address resources.
Fixes and other changes 22
Restores trust metadata for PAR parameters.
Missing interaction policy removals are now ignored.
String comparisons now use UTF-8 byte lengths.
Strict compact JWT decoders are used.
Credential configuration references are validated.
Individual claim request shapes are validated.
Registered redirect URIs are compared exactly.
Empty Request Object parameters are omitted.
Undefined response parameters are omitted.
Grant parameters are isolated by feature, avoiding parameters for one feature affecting another.
Memory adapter entries now expire correctly, so developers can rely on configured entry expiration.
The CIMD metadata document cache is now bounded.
The grant.revoked event is no longer emitted twice during logout.
ID Token claims are resolved using the effective scope.
A skipped refresh token lookup is no longer dereferenced.
Server challenges are derived from the clock rather than a timer.
Stale clients are ignored during logout confirmation.
No longer calls revokeByGrantId when grantId is missing.
The CIBA user code is passed to the verifier.
Signing keys are selected for JWT access tokens.
Registration token policy is awaited, so its result is handled before processing continues.
A mismatch between grant_types and response_types is fixed up instead of being rejected.