v1.0.0

First stable release. The Sign in with Apple lifecycle this package implements
has been unchanged since 0.1.1; everything since has hardened its tests and
release process.

• Declared the public API stable: every type under SafeApple\SignIn except those
  marked @internal follows Semantic Versioning, including parameter names, which
  named arguments make part of the contract.
• Marked AppleSignedTokenDecoder as @internal; it is a detail shared by the
  identity-token and notification verifiers.

v0.1.4

• Release tags must now carry a verified signature; the release workflow fails
  on unsigned or lightweight tags.
• Removed a stray .DS_Store file from the distributed archive.

v0.1.3

• Raised test coverage of src from 77% to over 99%, adding regression tests for
  forged and malformed token signatures, unmatched authorized parties, missing
  subjects, malformed callback and notification payloads, client-secret key
  handling, JWKS refresh-lock contention, and OAuth network and revocation failures.

v0.1.2

• Added a release workflow that publishes a checksummed source archive with a
  Sigstore build-provenance attestation for every v* tag.

v0.1.1

Security and resilience patch release.

• Rate-limit unsuccessful forced JWKS refreshes, including stale-only fallback paths.
• Mark browser-posted callback profile data as untrusted and add verifiedEmail() matching against a verified identity token.
• Replace assumed Apple notification redelivery with durable inbox and local retry guidance.
• Add regression coverage for failed refresh cooldowns and tampered callback email.

v0.1.0

Full Changelog: https://github.com/binuka200/apple-sign-in-php/commits/v0.1.0