Skip to content

v0.61.0

Choose a tag to compare

View all tags
@osanderson osanderson released this 26 Oct 06:02
Immutable release. Only release title and notes can be modified.
v0.61.0
e095183
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.61.0 (2026-10-26)

⚠ BREAKING CHANGES

  • resource: resource.NewVerifier under AssuranceProduction refuses a Limits.MaxClockSkew under 10 seconds or over 60 seconds. Development assurance is unchanged, and serverresource.NewVerifier inherits the server's already-bounded value.
  • client: RevokeToken takes a client.TokenSet instead of a fapi.Secret and refuses a set from another issuer or with no recorded issuer. TokenSetSealer.Seal refuses a set with no recorded issuer. ExchangeCode refuses a response another Client validated. Under AssuranceProduction, client.New refuses CallbackBindingDeviceLocalStore unless the redirect URI is loopback http to 127.0.0.1 or [::1] or a private-use URI scheme. See UPGRADING.md.
  • server: under AssuranceProduction, server.New now refuses a ClientCertificateTrust of NoClientCertificateChainTrust, by value or pointer. A deployment whose TLS termination verifies client certificate chains passes ClientCertificateChainVerifiedUpstream instead, which behaves the same; otherwise pass TrustedClientCAs, or NoPKIClientAuthentication when no client uses tls_client_auth. See UPGRADING.md.
  • resource.NewOpaqueAccessTokens takes the issuer as a second argument and NewVerifier refuses an OpaqueAccessTokens without an Issuer. Opaque access tokens issued before this release, and records written before v0.58.0 (in practice refresh tokens issued before 2026-10-20), are refused, so their users must authorize again. With an Audience set, an opaque token record without an audience is refused. server.OpaqueAccessTokens refuses to issue without an issuer. A custom resource.AccessTokenResolver must report the issuer of any token carrying a grant_id or code_grant_id claim, or Verify answers 500. Revocation store keys for grants now contain the issuer URL. See UPGRADING.md.
  • server: a client registered with AllowedResources no longer gets issuer-audience access tokens when resource indicators are enabled. With a single entry, a request naming no resource is for that resource; with several, it fails with invalid_target. Such a client that calls the UserInfo endpoint must list the issuer identifier in its AllowedResources (and the server must accept it as a resource), then name a resource in every request. See UPGRADING.md.
  • federation: a statically registered client is authenticated only with keys from Dependencies.ClientKeys, never with ones its federation metadata publishes, and a federation client only with its federation keys. Automatic registration no longer registers a client authentication method or assertion algorithm outside a superior's policy on token_endpoint_auth_method or token_endpoint_auth_signing_alg, refuses an empty token_endpoint_auth_methods_supported or token_endpoint_auth_signing_alg_values_supported, and refuses an empty string for any string parameter it reads. See UPGRADING.md.

Features

  • keys: bind a JWKSIssuerKeySource to its issuer (476bfd4)
  • resource: add AuthorizationContext.GrantID and CodeGrantID (d3c3eef)
  • server: show and narrow resources at consent; confine federation clients' resources (593801c)

Bug Fixes

  • bump Go toolchain to 1.26.10 for GO-2026-6809 (a685dc5)
  • client: bind CIBA sessions to the client that began them (b58eb5d)
  • client: bind code exchange, revocation and sealing to the issuer (d83df91)
  • client: bound cached DPoP nonces and forget one a request was refused for (58b99ea)
  • client: refuse a DPoP request whose path its htu would normalize (452fcab)
  • complete the per-issuer store backstop for access tokens, old records and grant revocation (dd9c3c1)
  • extension: refuse authorization_details with a second top-level value (eceefde)
  • federation: keep static client keys, RP choices and empty values within policy (15606f7)
  • refuse JOSE and metadata JSON with a second top-level value (8d41a12)
  • resource: describe a credential-binding failure as an invalid token (144564b)
  • resource: hold MaxClockSkew to 10-60 seconds under production (d63e6ec)
  • server: bind attested authorization codes to the client instance; re-check grant types (d6bcaad)
  • server: confine requests naming no resource to the client's AllowedResources (b289a81)
  • server: read client_id one way for an embedder's attested client (54c160c)
  • server: refuse NoClientCertificateChainTrust under production assurance (cb9e739)
  • tighten iat, JWE zip, private-member and UserInfo typ checks (d379bfa)
Assets 3
Loading