Amruth Pillai 3fc0896a34 fix(auth): honor client-requested token_endpoint_auth_method during DCR ...

Dynamic client registration unconditionally rewrote token_endpoint_auth_method
to "none" for every unauthenticated request, downgrading clients that asked for
client_secret_basic or client_secret_post to public clients. Those clients were
issued no client_secret but still authenticated at the token endpoint with the
method they registered, so the exchange failed with 401 invalid_client.
Connecting Composio to the MCP server hit this on every attempt.

Default to "none" only when the client omits the field, which keeps PKCE-only
MCP clients working while confidential clients receive a usable secret.

2026-09-10 12:47:52 +02:00

..

src

fix(auth): honor client-requested token_endpoint_auth_method during DCR

2026-09-10 12:47:52 +02:00

package.json

chore: update dependencies

2026-09-09 23:57:37 +02:00

tsconfig.json

Squashed commit of the following:

2026-05-19 13:14:21 +02:00

tsdown.config.ts

refactor(stylesheet): move Semantic CSS to the browser (#3329)

2026-08-16 16:50:27 +02:00

turbo.json

fix: restore MCP OAuth registration and authorization (#3421)

2026-09-05 09:33:15 -07:00

vitest.config.ts

Release v5.2.8 (#3375)

2026-08-24 21:44:16 +02:00