v5.0.0

Version 5.0 is a major release with security fixes. It binds the authorization code flow to the browser which started it, uses PKCE, stores an authorization only when its flow finishes, and requires PHP 8.3 or later with Flow 8.3 (8.3.13 or later), Flow 8.4 or Flow 9.

Several changes are breaking. Before upgrading, read the migration guide. Among other things, it explains the new database migration, the browser binding and authorization handle, the new abstract method getClientSecret(), and why the scope is now sent with client credentials.

Security

This release fixes the following vulnerabilities:

• GHSA-7wcp-2c5m-34pp: Client secret of one service can be sent to the token endpoint of another service
• GHSA-v5hx-px8w-vqhh: Authorization code flow is not bound to the browser which started it

What's Changed

• Require Flow 9 and PHP 8.3, upgrade to PHPUnit 12 by @robertlemke in #40
• Allow additional parameters for the authorization request by @robertlemke in #41
• Cover authorization flows and encryption with tests by @robertlemke in #42
• Clean up the package for 5.0 by @robertlemke in #43
• Rework expiry and garbage collection of authorizations by @robertlemke in #44
• Handle refused and unknown authorizations in the callback by @robertlemke in #45
• Store an authorization only when its flow finishes by @robertlemke in #46
• Support Flow 8.3 and 8.4 by @robertlemke in #47
• Send the scope with client credentials and keep tokens until replaced by @robertlemke in #48

Full Changelog: v4.1.2...v5.0.0