OIDC discovery and token-exchange code paths now check URL.canParse() on the well-known/token endpoint URL before constructing a URL object. An invalid issuer now surfaces a clear "issuer is not a valid URL" error instead of an uncaught exception from URL construction.
OIDC/OAuth endpoint URLs are now validated with URL.canParse before use
An invalid OIDC issuer now gives a clear not-a-valid-URL error instead of an uncaught exception.
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
AuthArea: what it touches
Bug FixesKind: in v2.1.257,
Bug FixesSection of the release