Bump @inrupt/solid-client-authn-node from 2.3.0 to 2.4.1

[dependabot]

Bumps @inrupt/solid-client-authn-node from 2.3.0 to 2.4.1.

Release notes

Sourced from @​inrupt/solid-client-authn-node's releases.

v2.4.1

Bugfix

node

• refreshTokens had a bug causing an unexpected refresh token rotation if the ID token expired, resulting in the stored token being stale.

Full Changelog: inrupt/solid-client-authn-js@v2.4.0...v2.4.1

v2.4.0

New Features

node

• Added a EVENTS.NEW_TOKENS (newTokens) event to be emitted by the Session when it receives new tokens when a session is initially logged in or refreshed. This event is more useful than EVENTS.NEW_REFRESH_TOKEN which is being deprecated.
• Added a static Session.fromTokens(tokens, sessionId) method that creates a new authenticated session directly from a token set, without requiring a full login flow.
• Added a new function refreshTokens to refresh tokens obtained via the newTokens event after the Access Token expired.

Bugfix

browser and node

• Fix the Session error listener typing by adding Error to the errorDescription type so that it reflects the actual behavior. Thanks to @​NoelDeMartin for fixing this issue.
• Previously, an application could end up in a bad state when using a dynamically registered client identity beyond its expiration date. A user would be redirected to the OpenID Provider, and end up on an error page unrelated to the application they were trying to log into. Now, expired dynamic clients go through registration again: the user will need to authorize the client after expiration, but will not experience further inconveniences.

What's Changed

Full Changelog: inrupt/solid-client-authn-js@v2.3.0...v2.4.0

Changelog

Sourced from @​inrupt/solid-client-authn-node's changelog.

2.4.1 - 2025-04-18

Bugfix

node

• refreshTokens had a bug causing an unexpected refresh token rotation if the ID token expired, resulting in the stored token being stale.

2.4.0 - 2025-04-15

Bugfix

browser and node

• Fix the Session error listener typing by adding Error to the errorDescription type so that it reflects the actual behavior. Thanks to @​NoelDeMartin for fixing this issue.
• Previously, an application could end up in a bad state when using a dynamically registered client identity beyond its expiration date. A user would be redirected to the OpenID Provider, and end up on an error page unrelated to the application they were trying to log into. Now, expired dynamic clients go through registration again: the user will need to authorize the client after expiration, but will not experience further inconveniences.

Feature

node

• Added a EVENTS.NEW_TOKENS (newTokens) event to be emitted by the Session when it receives new tokens when a session is initially logged in or refreshed. This event is more useful than EVENTS.NEW_REFRESH_TOKEN which is being deprecated.
• Added a static Session.fromTokens(tokens, sessionId) method that creates a new authenticated session directly from a token set, without requiring a full login flow.
• Added a new function refreshTokens to refresh tokens obtained via the newTokens event after the Access Token expired.

Commits

• b01fdba Release 2.4.1 (#3926)
• 626b895 Token refreshing tests (#3922)
• 359beb8 Prevent automatic refresh of the session (#3925)
• 8b21b24 Remove debug code from server example (#3924)
• d41907d Cleanup node examples (#3923)
• 1bfff9d Release 2.4.0 (#3921)
• 83ae8bc Refresh tokens in NodeJS (#3920)
• f83ac7c SDK-3406: Add support for creating a session by injecting tokens (#3909)
• 58bb05e Bump the external-types group across 1 directory with 2 updates (#3919)
• 132258e Bump lerna from 8.2.1 to 8.2.2 (#3917)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​inrupt/​solid-client-authn-node@​2.3.0 ⏵ 2.4.1	+1		+1

View full report

[NSeydoux]

@dependabot merge