v3.8.6

Fixes

• missing header.jwk in DPoP Proof JWT is now an OPE instead of TypeError (b9967cd)
• types: fix two ResourceServer metadata typings (9dd836d)

v3.8.5

Refactor

• account for an upcoming Web Cryptography change (ac13290)

v3.8.4

Fixes

• use duplex: half for resourceRequest with ReadableStream body input (34f01d4)

v3.8.3

Refactor

• relax www-authenticate auth-param presence requirement (35d4622)

v3.8.2

Documentation

• remove mention of Edge Runtime from the readme (313c263)

Refactor

• workaround dpop nonce caching caveats with customFetch (e201d3a)

v3.8.1

Fixes

• DPoP: add header JWK alg and pub when using ML-DSA keys (90a702e)

v3.8.0

Features

• support ML-DSA JWS Algorithm Identifiers (5e9e629)

v3.7.0

Features

• optional recognition of proprietary or unrecognized token types (c875d5a)

v3.6.2

Refactor

• skip checking www-authenticate if expected status is received (596ae33), closes #191

v3.6.1

Fixes

• allow 0 in auth_time (3b9db46)