v0.8.5

Changed

• OIDC audience validation is now mandatory. When OIDC_ISSUER is set, OIDC_AUDIENCE must also be set or the server refuses to start (it previously warned and accepted any audience). Without an audience check the verifier accepts any token signed by the issuer — including one minted for a different app on a shared issuer (e.g. another Entra application in the same tenant), a token-confusion / confused-deputy risk (RFC 9700). The prior permissive behavior is still reachable, but only via the new explicit OIDC_ALLOW_ANY_AUDIENCE=true opt-out (logged loudly at every start). Action: OIDC deployments without OIDC_AUDIENCE must add it (or the opt-out) before upgrading.

Security

• Bump form-data 4.0.5 → 4.0.6 to patch a HIGH-severity CRLF injection advisory (GHSA-hmw2-7cc7-3qxx), pulled in transitively via arc-1 → @sap-cloud-sdk/connectivity → axios. npm audit now reports 0 vulnerabilities.