v7.5.0

Features

• use 303 See Other HTTP response status code for built in redirects (c243bf6)

v7.4.1

Bug Fixes

• handle backchannel requests in grant revocation (8fe9aec)

v7.4.0

⚠ BREAKING CHANGES

• fapi: Draft feature fapiRW was replaced by a stable fapi feature.
• fapi: The default profile for the new fapi feature is Financial-grade API Security Profile 1.0 - Part 2: Advanced (Final) rather than Financial-grade API - Part 2: Read and Write API Security Profile (ID2). ID2 albeit being an Implementer's Draft remains a possible features.fapi.profile option

Features

• fapi: FAPI (Final and ID2) is now a stable feature (4f52a4c)
• resourceIndicators: allow omitting resource parameter at the token endpoint (0309ec0), closes #989
• Client Initiated Backchannel Authentication (CIBA) and FAPI-CIBA-ID1 (a217484)

Bug Fixes

• deviceFlow: ensure pairwise device flow clients prove ownership of their jwks_uri (ec99201)
• remove default got user-agent (d65187c)
• skip validating client redirect_uris presence when not required (90965bb)

Note: Updates to draft specification versions are released as MINOR library versions, if you utilize these specification implementations consider using the tilde ~ operator in your package.json since breaking changes may be introduced as part of these version updates. Alternatively, acknowledge the version and be notified of breaking changes as part of your CI.

v7.3.2

Bug Fixes

• account claims scope argument type during refresh token exchange (bd1bee1), closes #1000

v7.3.1

Bug Fixes

• store original PAR signed request object after decryption (fa26e55)

v7.3.0

⚠ BREAKING CHANGES

• DPoP implementation updated to draft-ietf-oauth-dpop-03

Features

• update DPoP implementation to ietf draft 03 (d08126f)

Note: Updates to draft specification versions are released as MINOR library versions, if you utilize these specification implementations consider using the tilde ~ operator in your package.json since breaking changes may be introduced as part of these version updates. Alternatively, acknowledge the version and be notified of breaking changes as part of your CI.

v7.2.0

Features

• enable customizing client auth jwt assertion expected audience (e6286a6)

v7.1.3

Bug Fixes

• interaction uid is now an alias to its jti, it is not stored anymore either (2d85768)
• keyselection for ecdh when both OKP and EC are present (a0f8f7d)

v7.1.2

Bug Fixes

• v1.paseto token alg keystore value to be PS384 instead of RS384 (ae1f879)

v7.1.1

Bug Fixes

• save the grantId reference field with an interaction session (6cab64e)
• typo in consent detail missingOIDClaims -> missingOIDCClaims (1427383)