migration: openid-client and jose migration

.github/actions/build/action.yml

@@ -5,7 +5,7 @@ inputs:
   node:
     description: The Node version to use
     required: false
-    default: 18
+    default: 24
 
 runs:
   using: composite

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
   rl-scanner:
     uses: ./.github/workflows/rl-secure.yml
     with:
-      node-version: 18 ## depends if build requires node else we can remove this.
+      node-version: 24 ## depends if build requires node else we can remove this.
       artifact-name: 'express-openid-connect.tgz' ## Will change respective to Repository
     secrets:
       RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
@@ -32,7 +32,7 @@ jobs:
     uses: ./.github/workflows/npm-release.yml
     needs: rl-scanner ## this is important as this will not let release job to run until rl-scanner is done
     with:
-      node-version: 22
+      node-version: 24
       require-build: false
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -18,7 +18,7 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
 env:
-  NODE_VERSION: 18
+  NODE_VERSION: 22
   CACHE_KEY: '${{ github.ref }}-${{ github.run_id }}-${{ github.run_attempt }}'
 
 jobs:

EXAMPLES.md

@@ -12,6 +12,7 @@
 10. [Use a custom session store](#10-use-a-custom-session-store)
 11. [Back-Channel Logout](#11-back-channel-logout)
 12. [Custom Token Exchange](#12-custom-token-exchange)
+13. [Use a proxy for OIDC requests](#13-use-a-proxy-for-oidc-requests)
 
 ## 1. Basic setup
 
@@ -408,3 +409,26 @@ const { downstreamToken } = await req.oidc.customTokenExchange({
   },
 });
 ```
+
+## 13. Use a proxy for OIDC requests
+
+If you need to route all OIDC HTTP requests (discovery, token, userinfo, etc.) through a proxy, use the `customFetch` option with `undici`'s `ProxyAgent`:
+
+```js
+const express = require('express');
+const { auth } = require('express-openid-connect');
+const { ProxyAgent, fetch: undiciFetch } = require('undici');
+
+const app = express();
+
+const dispatcher = new ProxyAgent('http://proxy.example.com:8080');
+
+app.use(
+  auth({
+    customFetch: (url, options) => undiciFetch(url, { ...options, dispatcher }),
+    // ... other options
+  }),
+);
+```
+
+The SDK wraps your `customFetch` function to add required headers (User-Agent, Auth0-Client telemetry) before making requests.

README.md

@@ -22,7 +22,7 @@
 
 This library supports the following tooling versions:
 
-- Node.js `^10.19.0 || >=12.0.0`
+- Node.js `^20.19.0 || ^22.12.0 || >= 23.0.0`
 
 ## Install