v2.0.0

What's Changed

• Drop providerUrl (breaking - v2 candidate, not for merge yet) by @henderjon in #101
• Rename redirectUrl to redirectUri (breaking - v2 candidate, not for merge yet) by @henderjon in #103
• Fix the RP-conformance harness, broken by the v2 config changes by @henderjon in #105
• Clean up naming/prose left stale by the providerUrl removal by @henderjon in #106
• Add a test that catches a silent positional-argument swap by @henderjon in #107
• Close two residual gaps in the wither field-isolation test by @henderjon in #108
• Fixes Truncate to cut UTF-8 safely instead of by raw byte offset by @henderjon in #109
• Replace LogLevelFilterLogger's bool $allow with LogLevelFilterMode (breaking - v2 candidate, not for merge yet) by @henderjon in #110
• Extend CI coverage, fix what it finds, add CHANGELOG.md by @henderjon in #111
• Fix #113 and #114: validate callback state and reject array params by @henderjon in #116
• Document two severity asymmetries a logging audit surfaced by @henderjon in #117
• Fix #115: compare issuer byte-for-byte, normalize it once instead by @henderjon in #118
• Fix EdDSA at_hash and unrecognized-kid handling in IdTokenVerifier by @henderjon in #119
• Validate the azp claim against the client's own client_id by @henderjon in #120
• Harden the compliance harness against CSRF and header spoofing by @henderjon in #121
• Makes the host allowlist match the port as well as the host by @henderjon in #123
• Adds max_age request support and auth_time validation by @henderjon in #124
• Adds client_secret_jwt client authentication by @henderjon in #125
• Supports psr/log 1.x and tests every psr/log major in CI by @henderjon in #126
• Adds an upgrading-from-1.x checklist to the changelog by @henderjon in #127

Full Changelog: v1.6.0...v2.0.0

v1.6.0

What's Changed

• Attach a provider's error/error_description/error_uri to exceptions by @henderjon in #104

Full Changelog: v1.5.0...v1.6.0

v1.5.0

What's Changed

• Adds LogLevelFilterLogger, a PSR-3 decorator that opts into specific levels by @henderjon in #99
• Gives RefreshTokenClient a logger for the two outcomes specific to a refresh by @henderjon in #98
• Adds debug-level logging across the OIDC client for external integrators by @henderjon in #97
• Stop dropping error_description across every error-response path by @henderjon in #102

Full Changelog: v1.4.0...v1.5.0

v1.4.0

What's Changed

• Adds JSON_THROW_ON_ERROR to every json_decode() call by @henderjon in #85
• Logs the generic curl_exec() failure before throwing by @henderjon in #86
• Logs the userinfo-fetch failures fetchUserInfo() is the first to see by @henderjon in #87
• Rewords the one exception message ending in a bare preposition by @henderjon in #91
• Explains why Basic auth encoding rawurlencodes before base64ing by @henderjon in #88
• Tests that withState() copies the discovery cache, not aliases it by @henderjon in #89
• Guards against a non-array JWKS "keys" before calling JWK::parseKeySet() by @henderjon in #90
• Includes the relevant URL in 8 exception messages that omitted it by @henderjon in #92
• Adds OpenIDConnectClientConfig::resolveIssuer(), fixes its one wrong order by @henderjon in #93
• Includes jwks_uri in the key-type-mismatch exception message by @henderjon in #94
• Includes the URL in the curl_init() failure message by @henderjon in #95
• limit phpstan memory by @henderjon in #96

Full Changelog: v1.3.0...v1.4.0

v1.3.0

What's Changed

• Surfaces the raw token/response on AuthenticationFailedException and UserInfoRequestException by @henderjon in #84

Full Changelog: v1.2.0...v1.3.0

v1.2.0

What's Changed

• http status is now validated first in similar cases @henderjon in #76
• Logs expected/actual at_hash on a mismatch by @henderjon in #77
• Adds getState() to every exception this library throws by @henderjon in #78
• Documents OIDC vs. OAuth flow scope, adds an actors glossary by @henderjon in #79
• Adds getState()'s signature to the Exceptions section by @henderjon in #82
• Adds hover permalinks to h2/h3 headings in the docs page by @henderjon in #83

Full Changelog: v1.1.1...v1.2.0

v1.1.1

What's Changed

• validation across HTTP-fetching classes all check HTTP status first
• Add @todo noting redirectUrl will be renamed redirectUri in v2 by @henderjon in #74
• Document the logger context array keys by @henderjon in #75
• Aligns logger context shapes and check order across the HTTP-fetching classes by @henderjon in #76

Full Changelog: v1.1.0...v1.1.1

v1.1.0

What's Changed

• Fixes conformance harness test flows, adds Implicit flow support by @henderjon in #73

Full Changelog: v1.0.1...v1.1.0

relax psr/log

What's Changed

• Widen the psr/log constraint to accept 1.x again by @henderjon in #71
• Fix an incorrect final claim on OpenIDConnectClientFactory in the docs by @henderjon in #72

Full Changelog: v1.0.0...v1.0.1

initial tag

Stable API; compliance tested; and documented

Let's see how she sails on the open water...