chore(deps): bump @cloudflare/workers-oauth-provider from 0.2.3 to 0.2.4

[dependabot]

Bumps @cloudflare/workers-oauth-provider from 0.2.3 to 0.2.4.

Release notes

Sourced from @​cloudflare/workers-oauth-provider's releases.

v0.2.4

Patch Changes

• #136 a8c5936 Thanks @​mattzcarey! - Add /.well-known/oauth-protected-resource endpoint (RFC 9728) for OAuth 2.0 Protected Resource Metadata discovery, as required by the MCP authorization specification. The endpoint is always served with sensible defaults (request origin as resource and authorization server), and can be customized via the new resourceMetadata option.

• #151 dbb150e Thanks @​mattzcarey! - Add allowPlainPKCE option to enforce S256-only PKCE as recommended by OAuth 2.1. When set to false, the plain PKCE method is rejected and only S256 is accepted. Defaults to true for backward compatibility.

• #140 65d5cfa Thanks @​mattzcarey! - Fix apiHandler route matching when set to '/' to use exact match instead of prefix match, preventing it from matching all routes and breaking OAuth endpoints

• #150 734738c Thanks @​mattzcarey! - Fix TypeScript types by making OAuthProviderOptions generic over Env, eliminating the need for @​ts-expect-error workarounds when using typed environments

• #145 6ce5c10 Thanks @​mattzcarey! - Add RFC 8252 Section 7.3 compliance: allow any port for loopback redirect URIs (127.x.x.x, ::1) to support native apps that use ephemeral ports

• #143 8909060 Thanks @​mattzcarey! - Include resource_metadata URL in WWW-Authenticate headers on 401 responses per RFC 9728 §5.1, enabling clients to discover the protected resource metadata endpoint directly from authentication challenges.

Changelog

Sourced from @​cloudflare/workers-oauth-provider's changelog.

0.2.4

Patch Changes

• #136 a8c5936 Thanks @​mattzcarey! - Add /.well-known/oauth-protected-resource endpoint (RFC 9728) for OAuth 2.0 Protected Resource Metadata discovery, as required by the MCP authorization specification. The endpoint is always served with sensible defaults (request origin as resource and authorization server), and can be customized via the new resourceMetadata option.

• #151 dbb150e Thanks @​mattzcarey! - Add allowPlainPKCE option to enforce S256-only PKCE as recommended by OAuth 2.1. When set to false, the plain PKCE method is rejected and only S256 is accepted. Defaults to true for backward compatibility.

• #140 65d5cfa Thanks @​mattzcarey! - Fix apiHandler route matching when set to '/' to use exact match instead of prefix match, preventing it from matching all routes and breaking OAuth endpoints

• #150 734738c Thanks @​mattzcarey! - Fix TypeScript types by making OAuthProviderOptions generic over Env, eliminating the need for @​ts-expect-error workarounds when using typed environments

• #145 6ce5c10 Thanks @​mattzcarey! - Add RFC 8252 Section 7.3 compliance: allow any port for loopback redirect URIs (127.x.x.x, ::1) to support native apps that use ephemeral ports

• #143 8909060 Thanks @​mattzcarey! - Include resource_metadata URL in WWW-Authenticate headers on 401 responses per RFC 9728 §5.1, enabling clients to discover the protected resource metadata endpoint directly from authentication challenges.

Commits

• 6bf4689 Version Packages (#142)
• 1a9f442 docs: add AGENTS.md for AI coding assistants (#152)
• dbb150e Add allowPlainPKCE option to enforce S256 PKCE (OAuth 2.1) (#151)
• 6ce5c10 feat: add RFC 8252 loopback port flexibility for native apps (#145)
• 734738c fix: make OAuthProviderOptions generic over Env type (#150)
• 65d5cfa fix: use exact match for root apiHandler route (#140)
• 8909060 feat: include resource_metadata in WWW-Authenticate headers (RFC 9728 §5.1) (...
• a8c5936 feat: add /.well-known/oauth-protected-resource endpoint (RFC 9728) (#136)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	memory-graph-mcp	1c970ce	Mar 04 2026, 09:58 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	memory-graph-mcp	1c970ce	Mar 04 2026, 09:58 AM

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@cloudflare/workers-oauth-provider	0.2.4	Unknown	Unknown

Scanned Files

• package-lock.json

[github-actions]

This PR has been inactive for 30 days. It will be closed in 14 days if there is no further activity.

[github-actions]

This PR has been marked as stale because it has had no activity for 45 days. It will be closed in 15 days if no further activity occurs.

[github-actions]

This PR has been marked as stale because it has had no activity for 45 days. It will be closed in 15 days if no further activity occurs.

[github-actions]

This PR has been inactive for 30 days. It will be closed in 14 days if there is no further activity.