v0.69.0

0.69.0 (2026-11-02)

⚠ BREAKING CHANGES

• fapi.ParseIssuerURL, ParseEndpointURL and ParseRedirectURL refuse a URL ending in a bare "#", and storage.NewRegisteredClient (and so sqlstore) refuses a registered redirect URI containing "#". Drop the "#" from configuration and from each client's registered redirect URIs.
• server,client: server.New and client.New refuse a Config.Issuer with a query, including an empty "?". Parse the issuer with fapi.ParseIssuerURL and move any tenant selector into the path.
• server: IssueAccessToken refuses with server_error a TokenBinding whose Thumbprint was changed after VerifyTokenRequestBinding returned it, and IssueAccessToken and IssueRefreshToken refuse an AttestedClient whose AttestationExpiresAt was changed after AuthenticateAttestedClient returned it.
• server: X5CAttesterChain refuses with invalid_client an attestation whose x5c carries an RSA key over 4096 bits or with an exponent other than 65537, on the signing certificate or an intermediate.
• server: a pushed authorization request whose core parameters exceed the new size bounds is refused with invalid_request, and a request_uri begins at most eight interactions before BeginAuthorization refuses it with invalid_request_uri. See UPGRADING.md for the bounds.

Features

• resource: add RecommendedLimits (be3823c)

Bug Fixes

• client: let a ping without a valid bearer token be answered 401 (216b5b7)
• client: refuse every request to a federated OP once its Trust Chain expires (b1a51f9)
• client: refuse plain-mode callback parameters that aren't valid UTF-8 (571f0c4)
• client: send CIBA requested_expiry rounded up to whole seconds (179bb20)
• fapihttp: accept Structured Field parameters on a forwarded Client-Cert (4555c67)
• federation: bound and cancel detached automatic-registration resolutions (063f147)
• federation: narrow automatic registration grants by resolved scope and grant_types (f5584fa)
• federation: refuse a null value combined with add in metadata policy (a188676)
• federation: refuse an empty fragment in Entity Identifiers and source_endpoint (f618d18)
• jose: compare a JWT typ case-insensitively in ASCII only (191824d)
• keys: let an unknown kid force a JWKS refetch with the default options (99aff1d)
• keys: match a kid-less client key by its RFC 7638 thumbprint (da49bdf)
• refuse an empty fragment in issuer, endpoint and redirect URIs (f3a006b)
• server,client: refuse a configured issuer with a query (de97ac3)
• server: accept an x5c intermediate that is also a configured anchor (f223e2b)
• server: bound pushed request parameters and interactions per request_uri (610dcd5)
• server: compare requested claim values' numbers exactly (f979047)
• server: limit the RSA keys of attestation x5c certificates (45189bc)
• server: refuse an edited TokenBinding thumbprint or attestation expiry (6adb4ed)
• server: refuse invisible and format-character CIBA binding messages (f518b8e)
• server: say an attestation can't be combined with another client auth method (5bf9195)
• server: treat an empty resource as omitted and ignore resource when unsupported (0faec6a)