...
https://shibboleth.atlassian.net/browse/JOIDC-21
While working on the server-side metadata policy, realized that Phil’s work on metadata resolution can be exploited
https://shibboleth.atlassian.net/browse/JOIDC-57
Nimbus fixed it for version 9.1.6 (see changelog) - we’ll take it (or the latest) into use in oidc-common 1.2.0
Verified that it’s working on a test deployment with IPv6
...