All pull requests

Pull requests

• test(server): isolate JSON backend settings in token tests

  bugverification
  #282·cariandrum22 opened Oct 27, 2026Contributor·

  ·
  2

• chore(tooling): migrate Node runtime and SDK tooling to 26

  cidependencies
  #233·cariandrum22 opened Oct 23, 2026Contributor·

  ·

• fix(sdk): preserve provider provenance and audit CI obligations

  bugciverification
  #227·cariandrum22 opened Oct 18, 2026Contributor·

  ·

• chore(deps): bump @types/node from 24.12.4 to 26.6.5

  dependencies
  #223·dependabot[bot] opened Oct 16, 2026Bot·

  ·
  1

• feat(claims): add structured local attributes and mapping engine

  documentationenhancementsecurity
  #217·cariandrum22 opened Oct 12, 2026Contributor·

  ·

• fix(server): support RS256 access token signing

  bugdocumentationsecurityspec
  #205·cariandrum22 opened Oct 5, 2026Contributor·

  ·
  1

• fix(server): bind authorization codes to DPoP keys

  bugdocumentationsecurityspec
  #168·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  4

• fix(server): preserve permanent subject ownership

  bugdocumentationsecurityspec
  #167·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  10

• fix(server): validate language metadata and localized fields

  bugdocumentationsecurityspec
  #166·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(server): enforce registered client DPoP requirements

  bugdocumentationsecurityspec
  #165·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(federation): validate public protocol key metadata

  bugdocumentationsecurityspec
  #164·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(oidc): validate provider URLs and endpoint aliases

  bugdocumentationsecurityspec
  #162·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  3

• fix(server): preserve token client authentication snapshots

  bugdocumentationsecurity
  #161·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(server): reject stale client registration updates

  bugdocumentationsecurityspec
  #160·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(federation): validate provider capability metadata

  bugdocumentationsecurityspec
  #159·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  2

• fix(server): validate owner registration update credentials

  bugdocumentationsecurityspec
  #158·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  3

• fix(oidc): validate software statement issuer and audience

  bugdocumentationsecurityspec
  #157·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(federation): validate registration declarations

  bugdocumentationsecurityspec
  #156·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(oidc): require RS256 in OP signing capabilities

  bugdocumentationsecurityspec
  #155·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(federation): bind metadata issuer to statement subject

  bugdocumentationsecurityspec
  #152·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  2

• fix(server): negotiate introspection response representations

  bugdocumentationsecurityspec
  #150·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  3

• fix(server): preserve introspection subjects without username claims

  bugdocumentationsecurityspec
  #134·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(server): restrict signed introspection to resource recipients

  bugdocumentationsecurityspec
  #133·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(server): reject incomplete Basic client authentication

  bugdocumentationsecurityspec
  #132·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  1

• fix(server): verify stored access JWTs after issuance mode changes

  bugdocumentationsecurityspec
  #129·cariandrum22 opened Oct 2, 2026Contributor·

  ·
  3