Release 0.8.0

0.8.0 (2026-10-09)

Bug Fixes

• accept any port for loopback redirect URIs (eadae01)
• accept built-in scopes in authorization decisions (c5f3f51)
• account for response age when caching client metadata documents (f09b75a)
• adopt legacy credentials and lock grants during issuance (505b7eb)
• always show the consent page to metadata document clients (d881c4e)
• answer invalid_client when a client is deleted mid-authorization (7fefddf)
• block IPv4-compatible IPv6 addresses (33b1f0b)
• check grant state in introspection and userinfo (cd9124d)
• clarify OIDC scope errors (228c13a)
• compare client ids exactly on case-insensitive stores (79a9fd3)
• delete explicitly revoked refresh tokens so the grace period cannot revive them (7ed5722)
• enforce allowed hosts on every endpoint (052c8b9)
• hide fetch errors and cache anonymous metadata document resolutions (0181913)
• ignore grant ids that are not uuids (9f8d77e)
• ignore inherited properties when checking cimd auth methods (58b7f0c)
• keep custom metadata when refreshing metadata document clients (6e6b839)
• keep refresh tokens working on concurrent and cross-upgrade retries (d4eaee6)
• match guard audience like the resource parameter (2bae494)
• never purge client id metadata document clients (9883b7a)
• never purge clients that were authorized once (20fc967)
• never skip consent for public clients with loopback or custom scheme redirects (ebf72b4)
• no grace period for refresh tokens rotated before grants (5631797)
• normalize and revalidate granted scopes (907987f)
• publish lucid migration stubs with a destination (e18c576)
• reject unsafe characters in resource indicators (df5e95e)
• rewrite scope challenge on repeated guard calls (e02772b)
• use exact client id lookups in client management (7872b18)
• validate unused client purge age (5b535d6)

Features

• add 0.8 upgrade migration stubs for resource columns (fbdfaa2)
• add approveAuthorization and denyAuthorization (0ee9641)
• add first-class oauth grants (8737f0a)
• add pending authorization request lookup (6ac45e5)
• add sesame:upgrade command with 0.8 grant migrations (410267b)
• advertise required scopes in bearer challenges (b0a26da)
• advertise scopes_supported in authorization server metadata (49ed2bb)
• bind tokens to the requested resource (RFC 8707) (a6e9274)
• check token audience in guards declaring a resource (513a1de)
• export the client metadata document fetcher (f47fe6e)
• expose access token identity on the oauth guard (9b390c8)
• let scope middleware use a per-resource guard (54ebc77)
• purge unused dynamically registered clients (90fa059)
• support client id metadata documents (7de7a7e)
• support prompt=none and prompt=consent (c3b8677)