v1.10.6

Release 1.10.6

Security

• Strictly require valid expiry (exp) and signature (s) on OAuth callback structured state; reject stripped {n, o} and bare nonces.
• Remove duplicate nonce cookie set on Path=/ in OAuth start routes.

Fixed

• Reset lastIndex = 0 before and after evaluating RegExp in allowedReturnPaths.
• Treat empty allowedReturnPaths: [] as unset and fall through precedence.

Documentation

• Documented all 4 configuration locations for allowedReturnPaths, their exact precedence, and query parameters matching behavior for string entries.