[dependabot]

Bumps openid-client from 5.6.5 to 6.8.9.

Release notes

Sourced from openid-client's releases.

v6.8.9

Fixes

• types: support exactOptionalPropertyTypes (91f3005), closes #903

v6.8.8

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

v6.8.4

Fixes

• apply optional non-repudiation on generic grant ID Tokens (6202888)
• filter jwe decryption keys by algorithm (34e2ffd)
• preserve poll abort signals on requests (96a2d17)
• retry dpop nonce errors for generic grants (498c4d9)

... (truncated)

Changelog

Sourced from openid-client's changelog.

6.8.9 (2026-11-02)

Fixes

• types: support exactOptionalPropertyTypes (91f3005), closes #903

6.8.8 (2026-09-05)

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

6.8.7 (2026-08-20)

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

6.8.4 (2026-04-27)

... (truncated)

Commits

• 0f4fcb6 chore(release): 6.8.9
• 501102a chore: bump packages
• 91f3005 fix(types): support exactOptionalPropertyTypes
• 63b2fac ci: add trigger-ci pushes
• bf05393 build(deps-dev): bump workerd in /tap/workerd
• 81d30e2 build(deps-dev): bump electron from 44.9.1 to 45.1.0 in /tap/electron
• bd81b1b build(deps): bump the actions group with 4 updates
• 43d3022 build(deps-dev): bump @​playwright/test from 1.63.0 to 1.64.1
• ca1ceb7 build(deps-dev): bump electron
• f396c7f test: address conformance suite v5.3.2 failures
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openid-client since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)