# What changed in oidc-provider

> 59 changes in oidc-provider 9 from its official release notes, upgrade guides and advisories: 11 breaking, 12 security, 7 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/npm/oidc-provider/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## oidc-provider 9

### Breaking changes

- Unknown authorization detail types are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Loosely decoded Basic credentials are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Empty URL components are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Sparse metadata arrays are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Non-string htu claims are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Request bodies are required to be JSON objects. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Ambiguous JWT proof keys are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- OAuth request syntax is enforced. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Opaque origins are rejected by default. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Non-string sector document entries are rejected. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Unrecognized array members are filtered before validation, changing how CIMD array values are handled. (9.7.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.7.1)

### Security

- The attestation proof-of-possession jti is validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Audience claim members are validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- JWT proof identity claims are validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Key attestation contents are validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Model payloads are filtered safely. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Nested option validation is hardened. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Default memory storage is isolated per provider, preventing providers from sharing the same default storage. (9.11.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.2)
- dpop_jkt is recognized only when DPoP is enabled. (9.11.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.1)
- Default HTML helper output is escaped in shouldChange functions. (9.8.5) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.5)
- CIBA notification tokens are validated. (9.8.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.3)
- Malformed DPoP htu values are rejected with a clearer message. (9.8.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.3)
- Debug data sent to development-only interactions is now HTML-escaped. (9.8.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.2)

### New APIs and options

- Built-in sender constraint checks are exposed for use by developers. (9.12.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.12.2)
- Grant helpers were added for custom grant implementers. (9.12.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.12.0)
- Allows customizing the expected audience of the OpenID4VCI Credential Endpoint. (9.11.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.0)
- Adds experimental support for OpenID for Verifiable Credential Issuance. (9.10.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.10.0)
- Adds experimental support for Client ID Metadata Document (CIMD). (9.7.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.7.0)
- Adds configuration for limiting external resource body limits. (9.7.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.7.0)
- CIBA flows now support RAR. (9.6.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.6.0)

### Behavior and default changes

- Rich Authorization Requests graduated. (9.12.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.12.0)
- Updates Attestation-Based Client Authentication to -10. (9.10.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.10.0)
- Updates CIMD support to draft -02, which may affect client metadata behavior. (9.9.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.9.0)
- Validation for native app custom URI schemes is relaxed, allowing schemes that were previously rejected. (9.8.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.1)
- rpMetadataChoices is now stable, so developers can rely on it as a stable configuration option. (9.8.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.0)
- Prevents fetching special-use IP address resources. (9.7.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.7.0)

### Fixes and other changes

- Restores trust metadata for PAR parameters. (9.12.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.12.1)
- Missing interaction policy removals are now ignored. (9.12.0) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.12.0)
- String comparisons now use UTF-8 byte lengths. (9.11.5) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.5)
- Strict compact JWT decoders are used. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Credential configuration references are validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Individual claim request shapes are validated. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Registered redirect URIs are compared exactly. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Empty Request Object parameters are omitted. (9.11.4) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.4)
- Undefined response parameters are omitted. (9.11.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.3)
- Grant parameters are isolated by feature, avoiding parameters for one feature affecting another. (9.11.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.2)
- Memory adapter entries now expire correctly, so developers can rely on configured entry expiration. (9.11.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.2)
- The CIMD metadata document cache is now bounded. (9.11.2) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.2)
- The grant.revoked event is no longer emitted twice during logout. (9.11.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.1)
- ID Token claims are resolved using the effective scope. (9.11.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.1)
- A skipped refresh token lookup is no longer dereferenced. (9.11.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.1)
- Server challenges are derived from the clock rather than a timer. (9.11.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.11.1)
- Stale clients are ignored during logout confirmation. (9.9.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.9.1)
- No longer calls revokeByGrantId when grantId is missing. (9.8.6) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.6)
- The CIBA user code is passed to the verifier. (9.8.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.3)
- Signing keys are selected for JWT access tokens. (9.8.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.3)
- Registration token policy is awaited, so its result is handled before processing continues. (9.8.3) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.8.3)
- A mismatch between grant_types and response_types is fixed up instead of being rejected. (9.7.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.7.1)
- Requiring PAR no longer affects CIBA and device authorization grant flows. (9.6.1) — [release notes](https://github.com/panva/node-oidc-provider/releases/tag/v9.6.1)