[dependabot]

Bumps oidc-provider from 9.8.2 to 9.12.2.

Release notes

Sourced from oidc-provider's releases.

v9.12.2

Refactor

• consolidate authorization middleware (fe435d6)
• expose built-in sender constraint checks (2a93e49)
• flatten model composition (8bb6022)
• read live provider configuration (a54b482)
• remove provider-bound middleware factories (2bc5022)
• share CORS middleware across providers (ec3619f)
• share request body parsers (7769cb1)
• share single-use grant issuance (67a0f5b)
• use a single request parameter class (ba997e2)

v9.12.1

Fixes

• restore PAR parameter trust metadata (da4bf42)

v9.12.0

Features

• add grant helpers for custom grant implementers (ef311dc)
• graduate Rich Authorization Requests (40d691b), references #1429

Fixes

• ignore missing interaction policy removals (08a825f)

Documentation

• generate extensibility contracts (da48c9e)
• generate typed configuration defaults (feb9500)

Refactor

• enforce configuration hook contracts (5c4d05b)

v9.11.5

Fixes

• compare strings using UTF-8 byte lengths (7d964ca)
• release: generalize changelog separation (44bb1b2)

v9.11.4

Fixes

• cimd: reject empty URL components (2bcc7b9)
• claims: validate individual claim request shapes (55f64e7)
• client-auth: reject loosely decoded Basic credentials (f1bb868)
• client-auth: validate attestation PoP jti (e5f7bea)

... (truncated)

Changelog

Sourced from oidc-provider's changelog.

9.12.2 (2026-09-05)

Refactor

• consolidate authorization middleware (fe435d6)
• expose built-in sender constraint checks (2a93e49)
• flatten model composition (8bb6022)
• read live provider configuration (a54b482)
• remove provider-bound middleware factories (2bc5022)
• share CORS middleware across providers (ec3619f)
• share request body parsers (7769cb1)
• share single-use grant issuance (67a0f5b)
• use a single request parameter class (ba997e2)

9.12.1 (2026-09-04)

Fixes

• restore PAR parameter trust metadata (da4bf42)

9.12.0 (2026-08-28)

Features

• add grant helpers for custom grant implementers (ef311dc)
• graduate Rich Authorization Requests (40d691b), references #1429

Fixes

• ignore missing interaction policy removals (08a825f)

Documentation

• generate extensibility contracts (da48c9e)
• generate typed configuration defaults (feb9500)

Refactor

• enforce configuration hook contracts (5c4d05b)

9.11.5 (2026-08-24)

Fixes

• compare strings using UTF-8 byte lengths (7d964ca)
• release: generalize changelog separation (44bb1b2)

9.11.4 (2026-08-21)

Fixes

... (truncated)

Commits

• 8a59170 chore(release): 9.12.2
• 2a93e49 refactor: expose built-in sender constraint checks
• 7769cb1 refactor: share request body parsers
• ec3619f refactor: share CORS middleware across providers
• 2bc5022 refactor: remove provider-bound middleware factories
• ba997e2 refactor: use a single request parameter class
• a54b482 refactor: read live provider configuration
• 67a0f5b refactor: share single-use grant issuance
• fe435d6 refactor: consolidate authorization middleware
• 8bb6022 refactor: flatten model composition
• Additional commits viewable in compare view

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.