[dependabot]

Bumps @inrupt/solid-client-authn-browser from 5.0.1 to 5.0.3.

Release notes

Sourced from @​inrupt/solid-client-authn-browser's releases.

v5.0.3

This release just aims at validating our publication pipeline, it contains no code change compared to 5.0.2.

v5.0.2

Security fixes

Thanks to Christoph Braun, Karlsruhe Institute of Technology (KIT), Institute AIFB, Web Science (@​uvdsl) for reporting the issue.

browser

• The DPoP key is no longer extractable in the browser context, which prevents its exploitation via XSS or other browser-based clients vulnerabilities. This restricts an attacker session's length (in the case of a successful token extraction) to the lifespan of the Access Token, very short by design.

node

• The browser DPoP key fix mentioned above creates a potentially breaking change for the NodeJS client: make sure the node library is updated at the same time as the core library to prevent regressions.

Patch changes

• Miscellaneous dependency updates.

What's Changed

Full Changelog: inrupt/solid-client-authn-js@v5.0.1...v5.0.2

Changelog

Sourced from @​inrupt/solid-client-authn-browser's changelog.

5.0.3 - 2026-10-29

• This release validates the publication pipeline, it includes no code changes.

5.0.2 - 2026-10-26

Security fixes

browser

• The DPoP key is no longer extractable in the browser context, which prevents its exploitation via XSS or other browser-based clients vulnerabilities. This restricts an attacker session's length (in the case of a successful token extraction) to the lifespan of the Access Token, very short by design.

node

• The browser DPoP key fix mentioned above creates a potentially breaking change for the NodeJS client: make sure the node library is updated at the same time as the core library to prevent regressions.

Commits

• 0d47d58 Release v5.0.3 (#4464)
• 637ee21 Remove unnecessary manual release action (#4463)
• 6255bba Setup manual release workflow (#4462)
• 0f8b0d1 Text changes related to issue #4458 (#4461)
• 80d7c22 Release 5.0.2 (#4460)
• 4505b7a Prevent DPoP key from being extractable in browser (#4459)
• 9b5558a Bump prettier from 3.9.9 to 3.9.10 (#4449)
• f2da8bd Bump eslint-config-next from 16.4.1 to 16.4.2 (#4451)
• a760019 Bump serialize-javascript from 7.0.5 to 7.1.4 (#4456)
• e25c43a Bump undici from 8.11.2 to 8.12.3 (#4455)
• Additional commits viewable in compare view

[NSeydoux]

@dependabot rebase

[acoburn]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud