v5.0.2

Security fixes

Thanks to Christoph Braun, Karlsruhe Institute of Technology (KIT), Institute AIFB, Web Science (@uvdsl) for reporting the issue.

browser

• The DPoP key is no longer extractable in the browser context, which prevents its exploitation via XSS
  or other browser-based clients vulnerabilities. This restricts an attacker session's length (in the case
  of a successful token extraction) to the lifespan of the Access Token, very short by design.

node

• The browser DPoP key fix mentioned above creates a potentially breaking change for the NodeJS client:
  make sure the node library is updated at the same time as the core library to prevent regressions.

Patch changes

• Miscellaneous dependency updates.

What's Changed

Full Changelog: v5.0.1...v5.0.2