Skip to content

chore(deps): bump koa and oidc-provider#2178

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-ad3a479d68
Open

chore(deps): bump koa and oidc-provider#2178
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-ad3a479d68

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps koa to 3.2.1 and updates ancestor dependency oidc-provider. These dependencies need to be updated together.

Updates koa from 2.16.1 to 3.2.1

Release notes

Sourced from koa's releases.

v3.2.1

What's Changed

New Contributors

Full Changelog: koajs/koa@v3.2.0...v3.2.1

v3.2.0

What's Changed

New Contributors

Full Changelog: koajs/koa@v3.1.2...v3.2.0

v3.1.2

What's Changed

New Contributors

Full Changelog: koajs/koa@v3.1.1...v3.1.2

v3.1.1

What's Changed

Full Changelog: koajs/koa@v3.1.0...v3.1.1

v3.1.0

What's Changed

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.


3.0.0-alpha.3 / 2025-02-11

fixes

  • Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

  • Update http-errors to v2.0.0 #1486
  • Remove res.redirect('back'), add back() method to ctx #1115
  • Replace node querystring with URLSearchParams #1828
  • Remove obsolete createAsyncCtxStorageMiddleware #1817

features

  • Add support for web WHATWG #1830

updates

  • Update cookies to ~0.9.1 #1846
  • Update statuses to ^2.0.1
  • Update supertest to ^7.0.0 #1841

fixes

  • Fix exports.defaults in package.json #1630
  • Fix leaky handles in tests #1838
  • Fix body null checks #1814
  • Fix reformatting redirect URLs #1805 #1804
  • Fix passing ctx in error handler #1758

migrations

  • Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for koa since your current version.


Updates oidc-provider from 8.4.3 to 9.8.5

Release notes

Sourced from oidc-provider's releases.

v9.8.5

Fixes

  • escape default html helper output in shouldChange functions (f688321)

Documentation

  • note helpers requiring deployment customization (567e551)

v9.8.4

Refactor

  • detect non-node runtimes before checking for LTS (b3be0fd), closes #1424
  • isolate SSRF dispatcher protection (1f64996)

v9.8.3

Fixes

  • await registration token policy (6269602)
  • pass ciba user code to verifier (a340869)
  • reject malformed dpop htu with a clearer message (1b6146c)
  • select signing keys for jwt access tokens (1d6df9c)
  • validate ciba notification tokens (2807a8f)

v9.8.2

Fixes

  • html-escape debug data sent to development-only interactions (924d25c), closes #1414

v9.8.1

Refactor

  • relax native app custom URI scheme validation (75be6ce), closes #1411

v9.8.0

Features

  • promote rpMetadataChoices to stable (cc8cfcc)

Refactor

  • do not depend on undici being part of the bundle (2ffec73)

v9.7.1

Refactor

  • CIMD: filter unrecognized array members before validating (969edba), closes #1398
  • fetch_body_check.js now returns early when limit is Infinite (a794f51)

... (truncated)

Changelog

Sourced from oidc-provider's changelog.

9.8.5 (2026-06-15)

Fixes

  • escape default html helper output in shouldChange functions (f688321)

Documentation

  • note helpers requiring deployment customization (567e551)

9.8.4 (2026-05-29)

Refactor

  • detect non-node runtimes before checking for LTS (b3be0fd), closes #1424
  • isolate SSRF dispatcher protection (1f64996)

9.8.3 (2026-04-27)

Fixes

  • await registration token policy (6269602)
  • pass ciba user code to verifier (a340869)
  • reject malformed dpop htu with a clearer message (1b6146c)
  • select signing keys for jwt access tokens (1d6df9c)
  • validate ciba notification tokens (2807a8f)

9.8.2 (2026-04-17)

Fixes

  • html-escape debug data sent to development-only interactions (924d25c), closes #1414

9.8.1 (2026-04-15)

Refactor

  • relax native app custom URI scheme validation (75be6ce), closes #1411

9.8.0 (2026-04-07)

Features

... (truncated)

Commits
  • 40ad405 chore(release): 9.8.5
  • 082c9d4 chore: update docs/README.md cautions
  • 567e551 docs: note helpers requiring deployment customization
  • f688321 fix: escape default html helper output in shouldChange functions
  • cb81029 chore: use the new RFC Editor links
  • 6dc484a chore(deps): bump the actions group with 2 updates
  • 570bc8b chore(release): 9.8.4
  • b3be0fd refactor: detect non-node runtimes before checking for LTS
  • 6e075e4 chore: bump packages
  • 7982ddc chore: bump packages
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for oidc-provider since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [koa](https://github.com/koajs/koa) to 3.2.1 and updates ancestor dependency [oidc-provider](https://github.com/panva/node-oidc-provider). These dependencies need to be updated together.


Updates `koa` from 2.16.1 to 3.2.1
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v2.16.1...v3.2.1)

Updates `oidc-provider` from 8.4.3 to 9.8.5
- [Release notes](https://github.com/panva/node-oidc-provider/releases)
- [Changelog](https://github.com/panva/node-oidc-provider/blob/main/CHANGELOG.md)
- [Commits](panva/node-oidc-provider@v8.4.3...v9.8.5)

---
updated-dependencies:
- dependency-name: koa
  dependency-version: 3.2.1
  dependency-type: indirect
- dependency-name: oidc-provider
  dependency-version: 9.8.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants