Skip to content

v0.38.0

Choose a tag to compare

View all tags
@osanderson osanderson released this 27 Sep 15:26
Immutable release. Only release title and notes can be modified.
v0.38.0
2d02c18
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.38.0 (2026-09-27)

⚠ BREAKING CHANGES

  • under AssuranceProduction, server.New and client.New now reject any Dependencies.Random other than crypto/rand.Reader, including a wrapper around it. Pass crypto/rand.Reader directly.

Features

  • client: expose the server's OAuth error response on client.Error (c006df8)
  • require crypto/rand.Reader as Dependencies.Random under production assurance (5c2c82e)

Bug Fixes

  • reject case-variant JSON member names in JOSE and metadata parsing (707772e)
  • server: return invalid_scope for a scope the client isn't allowed (02cf7e0)
Assets 3
Loading