v5.3.1

Summary

This release contains a few fixes from production code perspective.
Beyond that it is mostly targeting dependencies, docs, and development setup.
Biggest development-related change is that eslint/prettier are replaced by biome as linter and formatter all in one.

We also dropped development as a target branch and continue to work only by merging into master

Fixes

• fix(refresh-token): validate scope before revoking token #390 by @runeb in #389
• fix!: normalise InvalidArgumentError to server_error on the wire by @dhensby in #451
• feat: add requirePKCE option to enforce PKCE on the authorization code grant by @dhensby in #449
• Merge development into master to recover lost #390 fix by @dhensby in #441

Types

• fix(types): OAuthError.inner, saveToken input, and getClient clientSecret by @dhensby in #444
• fix(types): accept Express/Koa request types in Request constructor by @dhensby in #446

Docs

• docs: point security policy at GitHub private vulnerability reporting by @dhensby in #442
• docs: clarify the consumer must send the response / redirect by @dhensby in #445
• docs: fix incorrect model typedefs (AuthorizationCodeData / ClientData) by @dhensby in #443
• docs: add a compliance / integration-layer responsibilities guide by @dhensby in #450
• docs: clarify PKCE vs client authentication and refresh tokens by @dhensby in #448

Deps

• build(deps): bump type-is from 2.0.1 to 2.1.0 by @dependabot[bot] in #432

Dev-Deps

• build(deps): bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #427
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #417
• build(deps-dev): bump vitepress from 2.0.0-alpha.16 to 2.0.0-alpha.17 by @dependabot[bot] in #414
• build(deps-dev): bump markdown-it from 14.1.0 to 14.2.0 by @dependabot[bot] in #447
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #452
• Replace eslint with biome by @jankapunkt in #439
• build(deps-dev): bump @biomejs/biome from 2.5.0 to 2.5.4 by @dependabot[bot] in #461
• build(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in #460
• build(deps-dev): bump vitepress from 2.0.0-alpha.17 to 2.0.0-alpha.18 by @dependabot[bot] in #458
• build(deps-dev): bump @biomejs/biome from 2.5.4 to 2.5.9 by @dependabot[bot] in #477
• build(deps-dev): bump vitepress from 2.0.0-alpha.18 to 2.0.0-alpha.19 by @dependabot[bot] in #471
• build(deps): bump github/codeql-action from 4 to 4.37.4 by @dependabot[bot] in #470
• build(deps-dev): bump linkify-it from 5.0.1 to 5.0.2 by @dependabot[bot] in #466
• build(deps-dev): bump sinon from 22.0.0 to 22.1.0 by @dependabot[bot] in #464
• build(deps-dev): bump mocha from 11.7.6 to 11.8.0 by @dependabot[bot] in #472
• build(deps): bump brace-expansion by @dependabot[bot] in #476
• build(deps): bump github/codeql-action from 4.37.4 to 4.38.2 by @dependabot[bot] in #495
• build(deps-dev): bump @biomejs/biome from 2.5.9 to 2.5.14 by @dependabot[bot] in #492
• build(deps-dev): bump mocha from 11.8.0 to 12.0.2 by @dependabot[bot] in #491
• build(deps-dev): bump markdown-it from 14.2.0 to 14.3.2 by @dependabot[bot] in #497
• build(deps-dev): bump serialize-javascript from 7.1.1 to 7.1.2 by @dependabot[bot] in #498
• build(deps-dev): bump baseline-browser-mapping from 2.10.37 to 2.11.27 by @dependabot[bot] in #486
• build(deps-dev): bump vitepress from 2.0.0-alpha.19 to 2.0.0-alpha.20 by @dependabot[bot] in #484
• build(deps-dev): bump browserslist from 4.28.2 to 4.29.3 by @dependabot[bot] in #483
• build(deps): bump js-yaml from 3.14.2 to 3.15.2 by @dependabot[bot] in #499
• build(deps-dev): bump mocha from 12.0.2 to 12.0.3 by @dependabot[bot] in #501
• fix(deps-dev): align biome version in schema with config by @jankapunkt in #500
• build(deps): bump @vue/server-renderer and vue by @dependabot[bot] in #505
• build(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 by @dependabot[bot] in #504
• build(deps-dev): bump chai from 6.2.2 to 6.3.0 by @dependabot[bot] in #503
• build(deps-dev): bump @biomejs/biome from 2.5.14 to 2.5.15 by @dependabot[bot] in #502
• build(deps-dev): bump handlebars from 4.7.9 to 4.7.10 by @dependabot[bot] in #506

New Contributors

• @runeb made their first contribution in #389

Full Changelog: v5.3.0...v5.3.1