deps: bump @cloudflare/workers-oauth-provider from 0.3.0 to 0.7.2

[dependabot]

Bumps @cloudflare/workers-oauth-provider from 0.3.0 to 0.7.2.

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.7.2

Patch Changes

• #222 45397d8 Thanks @​mattzcarey! - Add an opt-in allowPublicClients flag to enterpriseManagedAuthorization.

  By default the enterprise-managed authorization (ID-JAG) grant requires client authentication, so public clients (token_endpoint_auth_method: 'none') are rejected. Setting allowPublicClients: true also accepts public clients on this grant — for example clients registered via a Client ID Metadata Document (CIMD), which are always public and cannot present a client secret. The default remains false, preserving existing behavior.

v0.7.1

Patch Changes

• #221 8e3f08c Thanks @​mattzcarey! - Preserve RFC 7591 §2.2 internationalized client metadata variants.

  Localized variants of the human-readable client metadata fields — expressed with a #<BCP 47 language tag> suffix on the member name (e.g. client_name#ja, tos_uri#fr) — were previously dropped during client registration. They are now captured for client_name, client_uri, logo_uri, tos_uri, and policy_uri, stored on the client record under a new optional i18n map (keyed by the raw field#tag name), and echoed back in the registration response alongside their canonical fields. The same handling applies to Client ID Metadata Document ingestion.

  Localized values are validated with the same rules as their canonical field: URI variants must be absolute http: or https: URLs, and all variants must be strings. Fields that are not part of RFC 7591 §2.2 (such as jwks_uri and redirect_uris) are not collected.

• #218 1f8737d Thanks @​mattzcarey! - Validate the URI scheme of client metadata fields during client registration.

  The client_uri, logo_uri, policy_uri, tos_uri, and jwks_uri fields were previously only checked to be strings. They are now required to be absolute http: or https: URLs, consistent with how redirect_uris are already validated. Registration (and Client ID Metadata Document ingestion) now rejects values using other schemes with an invalid_client_metadata error.

  These fields are commonly surfaced in consent UIs (for example as link or image targets), so restricting them to standard web URLs avoids non-http(s) schemes flowing through to consumers.

v0.7.0

Minor Changes

• #208 c59c37b Thanks @​mattzcarey! - Experimentally support MCP Enterprise-Managed Authorization ID-JAG assertions through the JWT bearer grant.

• #206 13ff269 Thanks @​itsandy-canva! - Expose grantId to tokenExchangeCallback via TokenExchangeCallbackOptions.

  Implementations of tokenExchangeCallback already received userId and clientId, but had no way to identify which specific grant the library was operating on. This made it impossible to surgically revoke a single grant from the callback (e.g. on a terminal upstream refresh failure) — implementations had

... (truncated)

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.7.2

Patch Changes

• #222 45397d8 Thanks @​mattzcarey! - Add an opt-in allowPublicClients flag to enterpriseManagedAuthorization.

  By default the enterprise-managed authorization (ID-JAG) grant requires client authentication, so public clients (token_endpoint_auth_method: 'none') are rejected. Setting allowPublicClients: true also accepts public clients on this grant — for example clients registered via a Client ID Metadata Document (CIMD), which are always public and cannot present a client secret. The default remains false, preserving existing behavior.

0.7.1

Patch Changes

• #221 8e3f08c Thanks @​mattzcarey! - Preserve RFC 7591 §2.2 internationalized client metadata variants.

  Localized variants of the human-readable client metadata fields — expressed with a #<BCP 47 language tag> suffix on the member name (e.g. client_name#ja, tos_uri#fr) — were previously dropped during client registration. They are now captured for client_name, client_uri, logo_uri, tos_uri, and policy_uri, stored on the client record under a new optional i18n map (keyed by the raw field#tag name), and echoed back in the registration response alongside their canonical fields. The same handling applies to Client ID Metadata Document ingestion.

  Localized values are validated with the same rules as their canonical field: URI variants must be absolute http: or https: URLs, and all variants must be strings. Fields that are not part of RFC 7591 §2.2 (such as jwks_uri and redirect_uris) are not collected.

• #218 1f8737d Thanks @​mattzcarey! - Validate the URI scheme of client metadata fields during client registration.

  The client_uri, logo_uri, policy_uri, tos_uri, and jwks_uri fields were previously only checked to be strings. They are now required to be absolute http: or https: URLs, consistent with how redirect_uris are already validated. Registration (and Client ID Metadata Document ingestion) now rejects values using other schemes with an invalid_client_metadata error.

  These fields are commonly surfaced in consent UIs (for example as link or image targets), so restricting them to standard web URLs avoids non-http(s) schemes flowing through to consumers.

0.7.0

Minor Changes

• #208 c59c37b Thanks @​mattzcarey! - Experimentally support MCP Enterprise-Managed Authorization ID-JAG assertions through the JWT bearer grant.

• #206 13ff269 Thanks @​itsandy-canva! - Expose grantId to tokenExchangeCallback via TokenExchangeCallbackOptions.

  Implementations of tokenExchangeCallback already received userId and

... (truncated)

Commits

• e25cc8b Version Packages (#223)
• 45397d8 feat(ema): add opt-in allowPublicClients for enterprise-managed authorization...
• 73afff8 Version Packages (#220)
• 8e3f08c Preserve RFC 7591 §2.2 internationalized client metadata variants (#221)
• 1f8737d Validate client metadata URI schemes during registration (#218)
• b2f0d94 Version Packages (#212)
• c59c37b feat(ema): restructure enterprise-managed auth into Result-typed modules (#208)
• 13ff269 feat: Expose grantId in TokenExchangeCallbackOptions (#206)
• 0062d12 Version Packages (#204)
• 2d651d3 build(deps-dev): bump vite from 7.3.0 to 7.3.3 (#202)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #45.