v0.15.0

0.15.0 (2026-08-26)

Features

• add IDTokenClaims.AsMap and UserInfo.AsMap (cd9a000)
• discover and validate UserInfo signing/encryption algorithms (66202c4)

v0.14.0

0.14.0 (2026-08-26)

Features

• add client.Limits.MaxJOSECompactBytes for ID token/UserInfo size caps (26228b6)

v0.13.0

0.13.0 (2026-08-26)

Features

• add client.RecommendedLimits/RecommendedAlgorithms (839a95d)
• add DiscoveredMetadata.IssuerKeySource (43afb73)
• add DiscoveredMetadata.SupportsAlgorithms (abccccf)
• add keys.PublicJWKS, a shared core for client/server.PublicJWKS (7d04816)
• expose IssuedAt on client.IDTokenClaims (2058520)

v0.12.0

0.12.0 (2026-08-26)

Features

• publish this client's own JWKS (cecc67e)

v0.11.0

0.11.0 (2026-08-25)

⚠ BREAKING CHANGES

• keys.ECDHAgreer.AgreeSharedSecret and keys.KeyDecrypter.DecryptKey (added in #141, unreleased) each gain a keyID string parameter as their second argument. An existing implementation that doesn't need multi-key support can add the parameter and ignore it.

Features

• adapt any crypto.Signer into a keys.KeyManager (3c4f30c)
• add a capability-based, KMS/HSM-friendly keys.Decrypter (#141) (c2dc847)
• support graceful key rotation — multi-key JWKS publishing, kid-aware decryption (14d44e7)

v0.10.0

0.10.0 (2026-08-25)

Features

• accept the registered JWK Set media type alongside application/json (#136) (9213afc)
• add opt-in tolerance for a UserInfo sub-equals-client_id defect (#139) (1cdcdc3)
• allow multi-valued access-token aud, trusted ID-token audiences, and azp checks (e6612a5)
• implement crit-based ignore-unknown for JWS/JWE header parsing (f7bd537)
• tolerate unrecognized members in AS-originated JSON documents (ce16852)

Bug Fixes

• accept a nested JWT payload with a missing (not just correct) cty (#137) (f506385)
• exclude internal/jose|jwe header.go from copy-paste detection (a8d41b2)
• extract the shared crit-check loop into internal/critical (1a9fdfa)
• use a live clock in client test setup, not one frozen before token issuance (299f81b)

v0.9.2

0.9.2 (2026-08-24)

Bug Fixes

• resolve remaining SonarCloud findings (empty-function comments, param grouping, duplicate literals) (61a0ad3)
• resolve the new_coverage regression from the S1186/S107/S1192 fixes (85139c1)
• revert the go:S1186 marker-method changes entirely (b90c7c1)
• switch the go:S1186 marker-method fix to NOSONAR, resolving the coverage gate for good (92f7149)

v0.9.1

0.9.1 (2026-08-24)

Bug Fixes

• correct NOSONAR comment syntax for python:S4830/S5527 (14f8643)
• pin TLS 1.2 minimum, deduplicate the SSL-context helper, exclude conformance/ Python from coverage gate (229d8e5)
• populate Endpoints.UserInfo from Discover, remove the redundant field (589b1c1)
• resolve SonarCloud's 14 security-impact findings (c1b0518)
• suppress python:S5527 on the loopback-only unverified context (f8a38fe)

v0.9.0

0.9.0 (2026-08-24)

Features

• add FetchUserInfo for validated OIDC UserInfo claims (f2b0177)
• add ProtectedResource for DPoP-bound protected-resource calls (d0b5569)
• add VerifyIssuerJWS for issuer-signed artifacts beyond the ID token (#123) (fcd1ae1)

v0.8.0

0.8.0 (2026-08-23)

Features

• expose the full validated ID token, not just Subject (2ae6511)
• expose the full validated ID token, not just Subject (da163a1)

Bug Fixes

• extract populateIDToken helper and add missing ID token error-path coverage (dae4480)