chore(deps): Bump express-openid-connect from 2.20.2 to 3.2.0 in /apps/lfx-changelog

[dependabot]

Bumps express-openid-connect from 2.20.2 to 3.2.0.

Release notes

Sourced from express-openid-connect's releases.

v3.2.0

Added

• feat(customTokenExchange): promote actor_token, organization, requested_token_type to first-class options #834 (cschetan77)

v3.1.0

Added

• IPSIE SL1 session expiry enforcement #828 (cschetan77)

  When an upstream enterprise IdP (e.g. Okta via an Auth0 OIDC connection) emits a session_expiry claim in the ID token, the SDK now enforces it as a hard ceiling on the local session lifetime:

  • At login — the ceiling is extracted and persisted as session.sessionExpiresAt. A born-expired token (ceiling already in the past at issuance) is rejected with HTTP 400.
  • On every request — the session is cleared if sessionExpiresAt has been reached (with a 30s leeway for clock skew), triggering re-authentication via the normal auth middleware flow.
  • On token refresh — accessToken.refresh() throws the new SessionExpiredError (401, ERR_SESSION_EXPIRED) before calling the token endpoint, rather than surfacing a confusing invalid_grant.
  • Cookie maxAge — capped at sessionExpiresAt so the browser cookie never outlives the IdP session.

  The change is non-breaking — all enforcement is gated on the claim being present. Connections without session_expiry in the ID token are completely unaffected. See EXAMPLES.md for usage and the SessionExpiredError API docs for error handling.

v3.0.0

This release upgrades openid-client and jose to their latest major versions v6, bringing improved security, performance, and standards compliance. See the V3 Migration Guide for full upgrade instructions.

⚠️ BREAKING CHANGES

• migration: openid-client and jose migration #785 (aks96)

• Node.js version requirement - requires ^20.19.0 || ^22.12.0 || >= 23.0.0. Node.js 14–19 are no longer supported.

• httpAgent config removed - The httpAgent option is no longer supported. Affects apps using httpAgent for proxy configuration.

• clientAssertionSigningAlg now required - The implicit RS256 default has been removed. Affects apps using clientAssertionSigningKey with a PEM, Buffer, KeyObject, or a JWK without an alg property.

• ES256K and EdDSA removed from clientAssertionSigningAlg - openid-client v6 no longer supports these algorithm values.

• afterCallback now receives the incoming user's tokens, not the previous session - req.oidc inside afterCallback now reflects the new tokens from the current authentication. Affects apps that read req.oidc inside afterCallback to inspect the prior session.

• Session cookie silently dropped when headers are sent before res.end() - v2 used on-headers, which hooked res.writeHead and could inject Set-Cookie regardless of how the response was written. v3 uses a res.end wrapper instead, so the cookie is written only at res.end(). Any response that flushes headers earlier via res.write(), res.flushHeaders(), res.writeHead(), res.sendFile(), or res.download() will have res.headersSent set to true by the time the cookie write runs, and the session cookie is silently dropped with no workaround. Standard OIDC flows are unaffected.

• clientAssertionSigningKey TypeScript type updated - KeyInput and JSONWebKey (jose v2) are replaced by string/Buffer and JWK respectively. CryptoKey is newly supported. Runtime behavior is unchanged.

Changelog

Sourced from express-openid-connect's changelog.

v3.2.0 (2026-07-03)

Full Changelog

Added

• feat(customTokenExchange): promote actor_token, organization, requested_token_type to first-class options #834 (cschetan77)

v3.1.0 (2026-06-30)

Full Changelog

Added

• feat: IPSIE SL1 session expiry enforcement #828 (cschetan77)

  When an upstream enterprise IdP (e.g. Okta via an Auth0 OIDC connection) emits a session_expiry claim in the ID token, the SDK now enforces it as a hard ceiling on the local session lifetime:

  • At login — the ceiling is extracted and persisted as session.sessionExpiresAt. A born-expired token (ceiling already in the past at issuance) is rejected with HTTP 400.
  • On every request — the session is cleared if sessionExpiresAt has been reached (with a 30s leeway for clock skew), triggering re-authentication via the normal auth middleware flow.
  • On token refresh — accessToken.refresh() throws the new SessionExpiredError (401, ERR_SESSION_EXPIRED) before calling the token endpoint, rather than surfacing a confusing invalid_grant.
  • Cookie maxAge — capped at sessionExpiresAt so the browser cookie never outlives the IdP session.

  The change is non-breaking — all enforcement is gated on the claim being present. Connections without session_expiry in the ID token are completely unaffected.

v3.0.0 (2026-05-13)

Full Changelog

This release upgrades openid-client and jose to their latest major versions v6, bringing improved security, performance, and standards compliance. See the V3 Migration Guide for full upgrade instructions. #785 (aks96)

⚠️ BREAKING CHANGES

• Node.js version requirement - requires ^20.19.0 || ^22.12.0 || >= 23.0.0. Node.js 14–19 are no longer supported.

• httpAgent config removed - The httpAgent option is no longer supported. Affects apps using httpAgent for proxy configuration.

• clientAssertionSigningAlg now required - The implicit RS256 default has been removed. Affects apps using clientAssertionSigningKey with a PEM, Buffer, KeyObject, or a JWK without an alg property.

• ES256K and EdDSA removed from clientAssertionSigningAlg - openid-client v6 no longer supports these algorithm values.

• afterCallback now receives the incoming user's tokens, not the previous session - req.oidc inside afterCallback now reflects the new tokens from the current authentication. Affects apps that read req.oidc inside afterCallback to inspect the prior session.

• Session cookie silently dropped when headers are sent before res.end() - v2 used on-headers, which hooked res.writeHead and could inject Set-Cookie regardless of how the response was written. v3 uses a res.end wrapper instead, so the cookie is written only at res.end(). Any response that flushes headers earlier via res.write(), res.flushHeaders(), res.writeHead(), res.sendFile(), or res.download() will have res.headersSent set to true by the time the cookie write runs, and the session cookie is silently dropped with no workaround. Standard OIDC flows are unaffected.

• clientAssertionSigningKey TypeScript type updated - KeyInput and JSONWebKey (jose v2) are replaced by string/Buffer and JWK respectively. CryptoKey is newly supported. Runtime behavior is unchanged.

Commits

• e2f15d0 Release v3.2.0 (#848)
• f3f1f58 docs(examples): update Custom Token Exchange section with delegation, organiz...
• f48ca0e feat(customTokenExchange): promote actor_token, organization, requested_token...
• 9d98b9e Release v3.1.0 (#843)
• 95ee991 docs: sync documentation with current API (automated) (#842)
• 5cd916c feat: Respect IdP provided session expiry and cap the SDK session (#828)
• 5475a6d build(deps): bump actions/cache from 5.0.5 to 6.0.0 (#836)
• 844c157 build(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#833)
• ac5ff7a build(deps): bump actions/setup-node from 4.4.0 to 6.4.0 (#832)
• 5a8ed47 build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0 (#826)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)