Skip to content

v0.10.0

Choose a tag to compare

View all tags
@osanderson osanderson released this 25 Aug 12:23
Immutable release. Only release title and notes can be modified.
v0.10.0
2c55ead
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.10.0 (2026-08-25)

Features

  • accept the registered JWK Set media type alongside application/json (#136) (9213afc)
  • add opt-in tolerance for a UserInfo sub-equals-client_id defect (#139) (1cdcdc3)
  • allow multi-valued access-token aud, trusted ID-token audiences, and azp checks (e6612a5)
  • implement crit-based ignore-unknown for JWS/JWE header parsing (f7bd537)
  • tolerate unrecognized members in AS-originated JSON documents (ce16852)

Bug Fixes

  • accept a nested JWT payload with a missing (not just correct) cty (#137) (f506385)
  • exclude internal/jose|jwe header.go from copy-paste detection (a8d41b2)
  • extract the shared crit-check loop into internal/critical (1a9fdfa)
  • use a live clock in client test setup, not one frozen before token issuance (299f81b)
Assets 3
Loading