v2.0.0

What's Changed

• Drop providerUrl (breaking - v2 candidate, not for merge yet) by @henderjon in #101
• Rename redirectUrl to redirectUri (breaking - v2 candidate, not for merge yet) by @henderjon in #103
• Fix the RP-conformance harness, broken by the v2 config changes by @henderjon in #105
• Clean up naming/prose left stale by the providerUrl removal by @henderjon in #106
• Add a test that catches a silent positional-argument swap by @henderjon in #107
• Close two residual gaps in the wither field-isolation test by @henderjon in #108
• Fixes Truncate to cut UTF-8 safely instead of by raw byte offset by @henderjon in #109
• Replace LogLevelFilterLogger's bool $allow with LogLevelFilterMode (breaking - v2 candidate, not for merge yet) by @henderjon in #110
• Extend CI coverage, fix what it finds, add CHANGELOG.md by @henderjon in #111
• Fix #113 and #114: validate callback state and reject array params by @henderjon in #116
• Document two severity asymmetries a logging audit surfaced by @henderjon in #117
• Fix #115: compare issuer byte-for-byte, normalize it once instead by @henderjon in #118
• Fix EdDSA at_hash and unrecognized-kid handling in IdTokenVerifier by @henderjon in #119
• Validate the azp claim against the client's own client_id by @henderjon in #120
• Harden the compliance harness against CSRF and header spoofing by @henderjon in #121
• Makes the host allowlist match the port as well as the host by @henderjon in #123
• Adds max_age request support and auth_time validation by @henderjon in #124
• Adds client_secret_jwt client authentication by @henderjon in #125
• Supports psr/log 1.x and tests every psr/log major in CI by @henderjon in #126
• Adds an upgrading-from-1.x checklist to the changelog by @henderjon in #127

Full Changelog: v1.6.0...v2.0.0