v2.8.0

Changelog

Bug fixes

• : fix: grant discussions write to the release-discussion reusable job (#227) (@thegdsks)
• : fix: harden authorization server (DPoP-bound refresh, hashed codes, revoke ownership, redirect allowlist, CIMD caps) (@thegdsks)
• : fix: name the cosign signature and certificate outputs so releases upload a .cert (#218) (@thegdsks)
• : fix: webhook timestamped signatures, mcpresource typ and JWKS stale bound, argon2 rehash, secure cookie default, threat model and changelog (@thegdsks)

Performance

• : perf: bound argon2id concurrency, one-query session lookup, keycloak migration (#239) (@thegdsks)

Other changes

• : ci: sync releases to shared monthly discussion, add welcome and stale bots (#223) (@thegdsks)

Verify this release

# Download the SBOM and its Sigstore signature from the release assets, then:
cosign verify-blob \
  --certificate-identity "https://github.com/glincker/theauth-go/.github/workflows/release.yml@refs/tags/v2.8.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --signature theauth-go-v2.8.0.tar.gz.sbom.json.sig \
  --certificate theauth-go-v2.8.0.tar.gz.sbom.json.cert \
  theauth-go-v2.8.0.tar.gz.sbom.json

Use this library: go get github.com/glincker/theauth-go/v2@v2.8.0

Discussion: https://github.com/glincker/theauth/discussions/172