v3.8.8

Fixes

• accept space runs in Bearer and DPoP credentials (3414db5)
• decode HTTP authentication quoted pairs correctly (bd7fcb0)
• forward arguments to AVA test runners (b898ba5)
• honor explicit auth-time skips in authorization responses (656d762)
• recognize DPoP nonce errors among multiple challenges (70bd8a1)
• release: separate changelog sections (a827c39)
• validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

• consolidate ID Token validation policy (53900cc)

Performance

• cache imported issuer verification keys by algorithm (fbe6c02)
• coalesce compatible in-flight JWKS requests (e64849e)

v3.8.7

Fixes

• types: expose custom fetch duplex option (0dcd746)
• types: make CryptoKey declarations portable (1c85396)
• types: make JWK declarations interoperable (ff804a8)

Documentation

• improve API index tables (2c4b025)

v3.8.6

Fixes

• missing header.jwk in DPoP Proof JWT is now an OPE instead of TypeError (b9967cd)
• types: fix two ResourceServer metadata typings (9dd836d)

v3.8.5

Refactor

• account for an upcoming Web Cryptography change (ac13290)

v3.8.4

Fixes

• use duplex: half for resourceRequest with ReadableStream body input (34f01d4)

v3.8.3

Refactor

• relax www-authenticate auth-param presence requirement (35d4622)

v3.8.2

Documentation

• remove mention of Edge Runtime from the readme (313c263)

Refactor

• workaround dpop nonce caching caveats with customFetch (e201d3a)

v3.8.1

Fixes

• DPoP: add header JWK alg and pub when using ML-DSA keys (90a702e)

v3.8.0

Features

• support ML-DSA JWS Algorithm Identifiers (5e9e629)

v3.7.0

Features

• optional recognition of proprietary or unrecognized token types (c875d5a)