Update dependency oauth4webapi to v2.17.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
oauth4webapi	2.4.0 -> 2.17.0

---

Release Notes

panva/oauth4webapi (oauth4webapi)

v2.17.0

Compare Source

Features

• support client use_mtls_endpoint_aliases metadata (60c9df4)

Documentation

• fix calculatePKCECodeChallenge description (ac014f2)

Refactor

• deprecate the useMtlsAlias symbol and options (d2b7cb0)
• use as Type for type assertions instead of (a0ccf56)

v2.16.0

Compare Source

Features

• add a hook for decrypting JWE assertions (62795a6)
• allow to modify issued JWT headers and payloads before signing (30931ba)

Documentation

• update docs on useMtlsAlias (006db55)

v2.15.0

Compare Source

Features

• support generic token endpoint grant requests (2f454b5)

v2.14.0

Compare Source

Features

• add non-repudiation signature validation methods (0916de2)

Documentation

• update JSDoc to use more link syntax (d78f090)
• update various comments and documentation (9c3f1ed)

v2.13.0

Compare Source

Features

• build: add jsr.io distribution (dc6157f)

v2.12.2

Compare Source

Refactor

• error msg when ID Token aud is an array and azp is missing (68e0338)
• remove redundant checks (763b3d0)

Documentation

• remove non-described parameter JSDoc tags (b1507b9)
• update README.md (9d1377b)

v2.12.1

Compare Source

Fixes

• use correct "htm" in DPoP Proof via protectedResourceRequest (3ce3be2), closes #​132

v2.12.0

Compare Source

Features

• graduate jwksCache to stable API (0e0e1d2)

Documentation

• move clockSkew and clockTolerance docs to the symbol (3b5d2ea)
• update clockSkew and clockTolerance docs (c97313a)

v2.11.1

Compare Source

Fixes

• allow ID Token auth_time to be present even if client.require_auth_time is false (caa9ab3)

v2.11.0

Compare Source

Features

• add experimental support for edge compute runtimes JWKS caching (15b7aff)

Refactor

• update maxAge option type check error message (7fe3454)

Documentation

• clarify documentation is more an API Reference (c96c8e0)
• update example import (651e8ea)
• updates for readability and consistency (b1b8b7d)

v2.10.4

Compare Source

Refactor

• types: add explicit type to all exported functions (76e8d19)
• types: add explicit type to all exported symbols (c66c595)
• types: protectedResourceRequest method argument is just a string (a15d76c)

Documentation

• mention RFC 6750 in validateJwtAccessToken (f61b68e), closes #​115

v2.10.3

Compare Source

Refactor

• make protectedResourceRequest headers argument optional (bcbc872)

Documentation

• update all examples (cdcbbde)

v2.10.2

Compare Source

Fixes

• normalize authorization_details and max_age in issueRequestObject (f8d267e)

v2.10.1

Compare Source

v2.10.0

Compare Source

Features

• types: add interfaces for RFC 9396 (Rich Authorization Requests) (1c606ea)

Refactor

• some biome identified smells and less non-null assertions (bc508f6)

Documentation

• update customFetch and useMtlsAlias a bit (627e716)

Fixes

• types: add missing and optional scope to interfaces (5dc6d17)

v2.9.0

Compare Source

Features

• graduate recently added experimental features to stable API (94da0c9)

v2.8.1

Compare Source

Fixes

• check that DPoP Proof iat is recent enough (a6159e3)

v2.8.0

Compare Source

Features

• add experimental support for validating JWT Access Tokens (f65deae)

v2.7.0

Compare Source

Features

• allow fragment response as URL in validateDetachedSignatureResponse (bcbe2f5)

v2.6.0

Compare Source

Features

• add experimental support for FAPI 1.0 (6b6b496)

Refactor

• reorganize experimental features (c8479b4)

Documentation

• update examples (779cf60)

v2.5.0

Compare Source

Features

• add experimental customize fetch option (e98c1aa), closes #​94
• add experimental support for mtls_endpoint_aliases (f1cb365)
• allow all of HeadersInit for HttpRequestOptions.headers (a5fe73c)

Refactor

• fetch url resolution and validation (b2e62a6)

Documentation

• fix ToC anchors to symbol properties (ed01dcf)
• return hierarchy to markdown docs (7d3b414)

v2.4.5

Compare Source

Fixes

• DPoP: clockSkew in ProtectedResourceRequestOptions is a unique Symbol (1708f21)

Documentation

• expose clock skew and tolerance documentation (2d90c49)

v2.4.4

Compare Source

Fixes

• handle Response objects with empty string url in processDpopNonce (f2c9415)

v2.4.3

Compare Source

v2.4.2

Compare Source

Documentation

• add distribution links to README.md (29bb947)

Fixes

• encode client_secret_basic - _ . ! ~ * ' ( ) characters (f926175)

v2.4.1

Compare Source

Refactor

• create Request instances before passing them to fetch (02ab110)
• types: mark always lowercased values and keys as Lowercase (89e7a77)

Documentation

• categorize APIs in docs/README.md (c28efda)
• expose Indexed Access Types (54c4393)
• update EdDSA description (9765e7a)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.