chore(deps): bump doorkeeper from 5.9.3 to 5.9.6

[dependabot]

Bumps doorkeeper from 5.9.3 to 5.9.6.

Release notes

Sourced from doorkeeper's releases.

v5.9.6

• Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.

v5.9.5

• #1901 Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an invalid_request error, instead of silently authenticating with the first method that matched and discarding the other credentials.
• #1853 Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.

Changelog

Sourced from doorkeeper's changelog.

5.9.6

• Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.

5.9.5

• #1901 Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an invalid_request error, instead of silently authenticating with the first method that matched and discarding the other credentials.
• #1853 Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.

Commits

• 75a84fe Release 5.9.6
• 41cae2f Merge commit from fork
• 2b93d10 Document that a callable client_credentials extractor opts out of the checks
• 2c88e05 Pin that a blank client_id in the params is treated as omitted
• 13b0087 Reject requests presenting more than one client identity (RFC 6749 §2.3)
• 4a87582 Release 5.9.5
• 896ca00 Merge commit from fork
• f9e8097 Reject requests using multiple client authentication methods (RFC 6749 §2.3)
• 932c966 Merge pull request #1856 from 55728/backport/v5.9-stable/custom-attributes-to...
• 696cdc0 Merge pull request #1853 from 55728/fix/custom-attributes-token-reuse
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)