chore(deps): bump oidc-provider from 9.8.3 to 9.11.2 in /dev/oidc-provider

[dependabot]

Bumps oidc-provider from 9.8.3 to 9.11.2.

Release notes

Sourced from oidc-provider's releases.

v9.11.2

Fixes

• adapter: apply memory entry expiration correctly (ff6c0d9)
• adapter: isolate default memory storage per provider (b4d27aa)
• cimd: bound the metadata document cache (62e1f66)
• grants: isolate feature-specific grant parameters (5490fc9)

Refactor

• adapter: maintain memory adapter indexes (3196032)
• add cause to provider errors (b329354)
• dpop: centralize replay detection (1d764c8)
• ensure incoming Configuration is not mutated (e59fd60)
• grants: share source lifecycle checks (d12f969)
• resources: share access token validation (1770bcf)
• retain memory entries through clock tolerance (72ea716)

Performance

• cimd: coalesce concurrent document fetches (5248ff2)
• configuration: reuse defaults during draft validation (1b1306d)
• jwt: stop key iteration after successful crypto (d428277)
• models: cache payload allowlists (1b781c9)
• params: scan duplicate parameters once (b572798)

v9.11.1

Fixes

• correct typos and grammar in user-facing messages (1be723e)
• derive server challenges from the clock rather than a timer (ba9d960), closes #1438
• don't dereference a skipped refresh token lookup (fe6f90e)
• don't emit grant.revoked twice during logout (a41d043)
• only recognize dpop_jkt when DPoP is enabled (8c38630)
• use the effective scope when resolving ID Token claims (ab1f41b)

Documentation

• correct stale configuration documentation (6096bef)
• document the missing emitted events (c295623)

Refactor

• remove unused OIDCContext resolvedClaims (5fe6807)

v9.11.0

Features

... (truncated)

Changelog

Sourced from oidc-provider's changelog.

9.11.2 (2026-08-03)

Fixes

• adapter: apply memory entry expiration correctly (ff6c0d9)
• adapter: isolate default memory storage per provider (b4d27aa)
• cimd: bound the metadata document cache (62e1f66)
• grants: isolate feature-specific grant parameters (5490fc9)

Refactor

• adapter: maintain memory adapter indexes (3196032)
• add cause to provider errors (b329354)
• dpop: centralize replay detection (1d764c8)
• ensure incoming Configuration is not mutated (e59fd60)
• grants: share source lifecycle checks (d12f969)
• resources: share access token validation (1770bcf)
• retain memory entries through clock tolerance (72ea716)

Performance

• cimd: coalesce concurrent document fetches (5248ff2)
• configuration: reuse defaults during draft validation (1b1306d)
• jwt: stop key iteration after successful crypto (d428277)
• models: cache payload allowlists (1b781c9)
• params: scan duplicate parameters once (b572798)

9.11.1 (2026-07-27)

Fixes

• correct typos and grammar in user-facing messages (1be723e)
• derive server challenges from the clock rather than a timer (ba9d960), closes #1438
• don't dereference a skipped refresh token lookup (fe6f90e)
• don't emit grant.revoked twice during logout (a41d043)
• only recognize dpop_jkt when DPoP is enabled (8c38630)
• use the effective scope when resolving ID Token claims (ab1f41b)

Documentation

• correct stale configuration documentation (6096bef)
• document the missing emitted events (c295623)

Refactor

• remove unused OIDCContext resolvedClaims (5fe6807)

... (truncated)

Commits

• deca441 chore(release): 9.11.2
• d75b45d ci: wire clockTolerance to the fapi tests
• 72ea716 refactor: retain memory entries through clock tolerance
• 0716194 ci: track staged npm release availability
• 421b440 chore: bump packages
• d12f969 refactor(grants): share source lifecycle checks
• 1770bcf refactor(resources): share access token validation
• 1d764c8 refactor(dpop): centralize replay detection
• 5248ff2 perf(cimd): coalesce concurrent document fetches
• 62e1f66 fix(cimd): bound the metadata document cache
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #301.