[dependabot]

Bumps openid-client from 5.7.1 to 6.8.8.

Release notes

Sourced from openid-client's releases.

v6.8.8

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

v6.8.4

Fixes

• apply optional non-repudiation on generic grant ID Tokens (6202888)
• filter jwe decryption keys by algorithm (34e2ffd)
• preserve poll abort signals on requests (96a2d17)
• retry dpop nonce errors for generic grants (498c4d9)

v6.8.3

Documentation

• note a workaround for redirect_uri with query string or bare origin (e9689de), closes #868

... (truncated)

Changelog

Sourced from openid-client's changelog.

6.8.8 (2026-09-05)

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

6.8.7 (2026-08-20)

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

6.8.4 (2026-04-27)

Fixes

• apply optional non-repudiation on generic grant ID Tokens (6202888)
• filter jwe decryption keys by algorithm (34e2ffd)
• preserve poll abort signals on requests (96a2d17)
• retry dpop nonce errors for generic grants (498c4d9)

... (truncated)

Commits

• 04c5982 chore(release): 6.8.8
• 5eccf2e chore: bump packages
• d730f80 fix(passport): handle rejected async verification callbacks
• b931c40 refactor: share grant polling lifecycle and retry handling
• d687796 fix: isolate lazy client authentication handler caches
• e816bf0 fix: calculate token lifetimes using elapsed time
• 10ba026 fix: select a unique decryption key when kid is omitted
• b26170e fix: retain polling abort signals through response processing
• af32783 fix: apply the default HTTP request timeout
• 5433d68 fix: preserve clock settings across DCR nonce retries
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openid-client since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)