npm / openid-client
openid-client
What changed in openid-client 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 security1 new APIs and options14 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initopenid-client 616 changes
Security 1
One-time state is deleted on callback, preventing it from persisting after use.
New APIs and options 1
The custom fetch types now expose the duplex option.
Fixes and other changes 14
Clock settings are preserved across DCR nonce retries.
The default HTTP request timeout is now applied.
When kid is omitted, decryption selects a unique key.
Caches for lazy client authentication handlers are isolated.
Rejected async verification callbacks are now handled.
Abort signals are retained through response processing during polling.
Token lifetimes are calculated using elapsed time.
The claims helper can now be destructured.
Avoids an undefined user-agent in fetchProtectedResource.
Generic grants retry DPoP nonce errors.
JWE decryption keys are filtered by algorithm.
Optional non-repudiation is applied on generic grant ID Tokens.
Abort signals from polls are preserved on requests.
Uses duplex: half when fetchProtectedResource receives a ReadableStream body.