chore(deps): bump oidc-provider from 9.8.3 to 9.11.3 in /dev/oidc-provider

[dependabot]

Bumps oidc-provider from 9.8.3 to 9.11.3.

Release notes

Sourced from oidc-provider's releases.

v9.11.3

Fixes

• omit undefined response parameters (0c65aa6)

Refactor

• drop the @​koa/cors runtime dependency (4eca0f2)
• drop the eta runtime dependency (f0da9d2)
• drop the jsesc runtime dependency (b2f6c0c)
• drop the nanoid runtime dependency (86a42da)
• drop the quick-lru runtime dependency (e818a6d)
• drop the raw-body runtime dependency (9312ca7)
• replace @​koa/router with an internal router (3b33e5f)

v9.11.2

Fixes

• adapter: apply memory entry expiration correctly (ff6c0d9)
• adapter: isolate default memory storage per provider (b4d27aa)
• cimd: bound the metadata document cache (62e1f66)
• grants: isolate feature-specific grant parameters (5490fc9)

Refactor

• adapter: maintain memory adapter indexes (3196032)
• add cause to provider errors (b329354)
• dpop: centralize replay detection (1d764c8)
• ensure incoming Configuration is not mutated (e59fd60)
• grants: share source lifecycle checks (d12f969)
• resources: share access token validation (1770bcf)
• retain memory entries through clock tolerance (72ea716)

Performance

• cimd: coalesce concurrent document fetches (5248ff2)
• configuration: reuse defaults during draft validation (1b1306d)
• jwt: stop key iteration after successful crypto (d428277)
• models: cache payload allowlists (1b781c9)
• params: scan duplicate parameters once (b572798)

v9.11.1

Fixes

• correct typos and grammar in user-facing messages (1be723e)
• derive server challenges from the clock rather than a timer (ba9d960), closes #1438
• don't dereference a skipped refresh token lookup (fe6f90e)
• don't emit grant.revoked twice during logout (a41d043)
• only recognize dpop_jkt when DPoP is enabled (8c38630)
• use the effective scope when resolving ID Token claims (ab1f41b)

... (truncated)

Changelog

Sourced from oidc-provider's changelog.

9.11.3 (2026-08-08)

Fixes

• omit undefined response parameters (0c65aa6)

Refactor

• drop the @​koa/cors runtime dependency (4eca0f2)
• drop the eta runtime dependency (f0da9d2)
• drop the jsesc runtime dependency (b2f6c0c)
• drop the nanoid runtime dependency (86a42da)
• drop the quick-lru runtime dependency (e818a6d)
• drop the raw-body runtime dependency (9312ca7)
• replace @​koa/router with an internal router (3b33e5f)

9.11.2 (2026-08-03)

Fixes

• adapter: apply memory entry expiration correctly (ff6c0d9)
• adapter: isolate default memory storage per provider (b4d27aa)
• cimd: bound the metadata document cache (62e1f66)
• grants: isolate feature-specific grant parameters (5490fc9)

Refactor

• adapter: maintain memory adapter indexes (3196032)
• add cause to provider errors (b329354)
• dpop: centralize replay detection (1d764c8)
• ensure incoming Configuration is not mutated (e59fd60)
• grants: share source lifecycle checks (d12f969)
• resources: share access token validation (1770bcf)
• retain memory entries through clock tolerance (72ea716)

Performance

• cimd: coalesce concurrent document fetches (5248ff2)
• configuration: reuse defaults during draft validation (1b1306d)
• jwt: stop key iteration after successful crypto (d428277)
• models: cache payload allowlists (1b781c9)
• params: scan duplicate parameters once (b572798)

9.11.1 (2026-07-27)

Fixes

• correct typos and grammar in user-facing messages (1be723e)
• derive server challenges from the clock rather than a timer (ba9d960), closes #1438

... (truncated)

Commits

• 778a3c8 chore(release): 9.11.3
• 71ab08e build: compile the views from their .eta sources
• b6eac9d ci: derive the maintenance branch from the tag
• e1a653e ci: keep the published tarball as a workflow and release artifact
• b02abbd test: run the suite against the packed package
• 0c65aa6 fix: omit undefined response parameters
• e27ce42 chore: note replacing debug with node:util.debuglog in v10
• 3b33e5f refactor: replace @​koa/router with an internal router
• 4eca0f2 refactor: drop the @​koa/cors runtime dependency
• e818a6d refactor: drop the quick-lru runtime dependency
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Deploy build 14952 of media-service::grid::all to TEST

All deployment options

• Deploy build 14952 of media-service::grid::all to TEST
• Deploy parts of build 14952 to TEST by previewing it first
• What's on TEST right now?

---

From guardian/actions-riff-raff.