# What changed in openid-client

> 16 changes in openid-client 6 from its official release notes, upgrade guides and advisories: 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/openid-client/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## openid-client 6

### Security

- One-time state is deleted on callback, preventing it from persisting after use. (6.8.3) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.3)

### New APIs and options

- The custom fetch types now expose the duplex option. (6.8.5) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.5)

### Fixes and other changes

- Clock settings are preserved across DCR nonce retries. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- The default HTTP request timeout is now applied. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- When kid is omitted, decryption selects a unique key. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- Caches for lazy client authentication handlers are isolated. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- Rejected async verification callbacks are now handled. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- Abort signals are retained through response processing during polling. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- Token lifetimes are calculated using elapsed time. (6.8.8) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.8)
- The claims helper can now be destructured. (6.8.7) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.7)
- Avoids an undefined user-agent in fetchProtectedResource. (6.8.6) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.6)
- Generic grants retry DPoP nonce errors. (6.8.4) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.4)
- JWE decryption keys are filtered by algorithm. (6.8.4) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.4)
- Optional non-repudiation is applied on generic grant ID Tokens. (6.8.4) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.4)
- Abort signals from polls are preserved on requests. (6.8.4) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.4)
- Uses duplex: half when fetchProtectedResource receives a ReadableStream body. (6.8.2) — [release notes](https://github.com/panva/openid-client/releases/tag/v6.8.2)