fix(deps): update oidc-provider digest to 5570006 - #9543
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
requested review from
gao-sun,
simeng-li and
wangsijie
as code owners
September 2, 2026 06:40
COMPARE TO
|
| Name | Diff |
|---|---|
| packages/core/package.json | 0 Bytes |
| pnpm-lock.yaml | 📈 +2.11 KB |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The lockfile shows oidc-provider resolving to 8.6.1 (a major downgrade from the previously used v9 line), which is likely to change OIDC runtime behavior and needs confirmation/adjustment before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the pinned oidc-provider dependency in @logto/core to a new GitHub digest and refreshes the pnpm lockfile to reflect the new resolved tarball and transitive dependency graph.
Changes:
- Bump
oidc-providerGitHub digest inpackages/core/package.json - Regenerate
pnpm-lock.yamlwith the newoidc-providertarball resolution and updated transitive packages
File summaries
| File | Description |
|---|---|
| pnpm-lock.yaml | Updates the resolved oidc-provider tarball/digest and associated transitive dependency snapshot entries |
| packages/core/package.json | Pins oidc-provider to the new GitHub digest for @logto/core |
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 1/2 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| "nanoid": "^5.0.9", | ||
| "node-forge": "^1.3.1", | ||
| "oidc-provider": "github:logto-io/node-oidc-provider#513c523c0e68ee6112da8c871cce86204a136163", | ||
| "oidc-provider": "github:logto-io/node-oidc-provider#5570006785b44e0f125ee4cb6bf540338721b1f3", |
Comment on lines
+13419
to
+13422
| oidc-provider@https://codeload.github.com/logto-io/node-oidc-provider/tar.gz/5570006785b44e0f125ee4cb6bf540338721b1f3: | ||
| resolution: {gitHosted: true, integrity: sha512-2hC26cxZs26hsNPcia+nm91MLgK9e++vVp7bSmd2uLe2y+G0fbMyLRKSX8b1Ayqm1fiuwTRJ+jpkiFZSJf4Edg==, tarball: https://codeload.github.com/logto-io/node-oidc-provider/tar.gz/5570006785b44e0f125ee4cb6bf540338721b1f3} | ||
| version: 8.6.1 | ||
|
|
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 2, 2026 07:26
8e99647 to
684ab16
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It updates a core auth dependency via a GitHub digest and the lockfile shows substantial version/transitive-runtime shifts that should be validated by a maintainer before merging.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (1)
pnpm-lock.yaml:13412
- The updated oidc-provider tarball now resolves to package version 8.6.1 in the lockfile (previously 9.11.3 per this PR diff). If this PR is intended to be a simple digest bump on the same release line, please double-check the target commit/digest to avoid unintentionally downgrading oidc-provider.
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+26459
to
+26463
| eta: 3.5.0 | ||
| got: 13.0.0 | ||
| jose: 5.9.6 | ||
| jsesc: 3.1.0 | ||
| koa: 2.16.4 |
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 2, 2026 21:16
684ab16 to
847fe96
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The lockfile indicates the new digest resolves to an apparent major downgrade of oidc-provider (and introduces deprecated transitive deps), which needs correction/confirmation before merging.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (2)
pnpm-lock.yaml:13412
- The updated oidc-provider git digest resolves to an
oidc-providerpackage version of8.6.1(previously9.11.3), and the snapshot shows notable dependency downgrades (e.g.jose6.x -> 5.9.6,koa-> 2.16.4). This looks like a major behavioral change/downgrade rather than a routine digest bump, and it may not match the repo’s existing v9 assumptions (e.g.@types/oidc-provider@9.5.0remains in the lockfile and integration tests reference v9 semantics). Please verify the target commit is correct for the intended oidc-provider major/version line; if not, update the dependency to a commit that matches the expected major and keep the types in sync.
pnpm-lock.yaml:6542 - This update introduces
@koa/router@13.1.1, which is marked deprecated in the lockfile and recommends upgrading to v15+ (also requiring Node >=18). If this dependency is coming from the new oidc-provider commit, consider updating the fork (or selecting a different digest) so it depends on a non-deprecated@koa/routermajor to avoid carrying deprecated code and potential security/maintenance risk.
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 3, 2026 09:57
847fe96 to
724116c
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new digest resolves to an apparent oidc-provider downgrade and introduces potentially incompatible transitive changes (notably Koa major version shift and deprecated @koa/router).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (2)
packages/core/package.json:86
- Updating oidc-provider to commit 5570006785b44e0f125ee4cb6bf540338721b1f3 resolves to oidc-provider package version 8.6.1 (see pnpm-lock.yaml:13410-13412), which appears to be a downgrade from the previously locked 9.11.3 and may invalidate assumptions in core (e.g., code comments referencing v9 behavior). Please confirm this commit is the intended upgrade target, or bump to the commit/tag that matches the expected major version.
"oidc-provider": "github:logto-io/node-oidc-provider#5570006785b44e0f125ee4cb6bf540338721b1f3",
pnpm-lock.yaml:26463
- The updated oidc-provider snapshot now pulls in koa@2.16.4 and jose@5.9.6, while packages/core has direct dependencies on koa@^3.2.1 and jose@^6.2.3. Running two major Koa versions in the same process is likely to break integration points like provider.callback() being mounted on the app. Consider moving oidc-provider to a commit that stays compatible with Koa 3, or plan a coordinated downgrade/upgrade of core + any middleware glue code.
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
Comment on lines
+6539
to
+6543
| '@koa/router@13.1.1': | ||
| resolution: {integrity: sha512-JQEuMANYRVHs7lm7KY9PCIjkgJk73h4m4J+g2mkw2Vo1ugPZ17UJVqEH8F+HeAdjKz5do1OaLe7ArDz+z308gw==} | ||
| engines: {node: '>= 18'} | ||
| deprecated: Please upgrade to v15 or higher. All reported bugs in this version are fixed in newer releases, dependencies have been updated, and security has been improved. | ||
|
|
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 8, 2026 00:04
724116c to
5338e27
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The updated digest resolves oidc-provider as a major downgrade (8.6.1 vs 9.11.3 in the diff) and introduces deprecated transitive deps, so the selected commit/compatibility needs confirmation before merging.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (3)
packages/core/package.json:86
- Updating the
oidc-providergit digest appears to downgrade the resolvedoidc-providerpackage (pnpm-lock.yaml shows 8.6.1) and it now depends onkoa@2/jose@5, while this package.json still declareskoa@^3andjose@^6; please confirm the digest points to the intended v9-based fork/branch to avoid breaking runtime and type expectations.
"oidc-provider": "github:logto-io/node-oidc-provider#5570006785b44e0f125ee4cb6bf540338721b1f3",
pnpm-lock.yaml:13413
- The lockfile indicates
oidc-provideris now resolved as version 8.6.1 (previously 9.11.3 in this PR’s diff), with notable dependency shifts (e.g.,koa3→2 andjose6→5). This is a major behavioral change for a "digest update" and should be verified against Logto’s oidc integration and tests before merging.
pnpm-lock.yaml:6542 @koa/router@13.1.1is introduced and explicitly marked as deprecated in the lockfile; if this comes from the updated oidc-provider fork, consider updating the fork (or adding a workspace override) to use a maintained major (v15+) to benefit from bugfixes and security updates.
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 9, 2026 22:21
5338e27 to
15a3ccd
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Pin a v9-compatible provider digest or migrate Core’s integration to v8.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
| "nanoid": "^5.0.9", | ||
| "node-forge": "^1.3.1", | ||
| "oidc-provider": "github:logto-io/node-oidc-provider#513c523c0e68ee6112da8c871cce86204a136163", | ||
| "oidc-provider": "github:logto-io/node-oidc-provider#5570006785b44e0f125ee4cb6bf540338721b1f3", |
renovate
Bot
force-pushed
the
renovate/oidc-provider-digest
branch
from
September 10, 2026 18:18
15a3ccd to
76e2637
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The updated digest appears to pull a substantially different oidc-provider dependency set (including apparent downgrades and a deprecated transitive router), which should be validated and/or corrected before merging.
Review details
Files not reviewed (1)
- pnpm-lock.yaml: Generated file
Suppressed comments (3)
packages/core/package.json:86
- This digest update pulls an oidc-provider tarball whose declared package version is now 8.6.1 (per pnpm-lock.yaml), which looks like a downgrade from the previously-locked 9.x series and may introduce breaking runtime/API changes. Please confirm the target commit is correct for Logto, or adjust the commit hash to the intended oidc-provider version.
"oidc-provider": "github:logto-io/node-oidc-provider#5570006785b44e0f125ee4cb6bf540338721b1f3",
pnpm-lock.yaml:6542
- pnpm-lock now includes @koa/router@13.1.1 with a deprecation notice recommending upgrade to v15+ for bugfixes/security improvements. Since this is a transitive dependency of oidc-provider, consider updating the fork (or applying an override if compatible) to avoid pulling a deprecated router into production.
pnpm-lock.yaml:26464 - oidc-provider's dependency set changes substantially here (e.g., jose 6.x → 5.9.6 and koa 3.x → 2.16.4), which can affect token handling and middleware behavior. Please validate that Logto’s OIDC flows still behave correctly with these downgrades (ideally via targeted integration tests).
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
513c523→5570006🔡 If you wish to disable git hash updates, add
":disableDigestUpdates"to the extends array in your config.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.