v0.16.1

0.16.1 (2026-10-15)

Bug Fixes

• deps: bump FAPIgo to v0.57.0 (#127) (d076f3d)

Fake server image

Run the fake Singpass and Corppass servers for testing, from any language:

docker run --rm -p 5156:5156 -p 5157:5157 ghcr.io/osanderson/singpass-fake-server:0.16.1

See docs/docker.md.

v0.16.0

0.16.0 (2026-10-14)

⚠ BREAKING CHANGES

• deps: the default HTTP client is fapihttp.NewClient's: it ignores HTTPS_PROXY/HTTP_PROXY and refuses private addresses when it dials. Under AssuranceProduction, a Dependencies.HTTPClient must come from fapihttp.NewClient with its transport unchanged. See UPGRADING.md (v0.16.0).

Bug Fixes

• deps: bump FAPIgo to v0.56.0, with a hardened default HTTP client (707aa0f)

Fake server image

Run the fake Singpass and Corppass servers for testing, from any language:

docker run --rm -p 5156:5156 -p 5157:5157 ghcr.io/osanderson/singpass-fake-server:0.16.0

See docs/docker.md.

v0.15.5

0.15.5 (2026-10-14)

Documentation

• point non-Go users to the fake server image from the README's top (#122) (d546cf6)

Fake server image

Run the fake Singpass and Corppass servers for testing, from any language:

docker run --rm -p 5156:5156 -p 5157:5157 ghcr.io/osanderson/singpass-fake-server:0.15.5

See docs/docker.md.

v0.15.4

0.15.4 (2026-10-13)

Bug Fixes

• singpasstest: hint at a client_assertion sub that isn't the client_id (#120) (22bfa7c)

v0.15.3

0.15.3 (2026-10-13)

Bug Fixes

• deps: bump FAPIgo to v0.55.0, keeping public subjects (#118) (98508cd)

v0.15.2

0.15.2 (2026-10-10)

Bug Fixes

• deps: bump FAPIgo to v0.53.0 (f62617d)
• singpasstest: answer the sign-in page's form with 303, as RFC 9700 recommends; automatic approvals keep 302 (f62617d)
• singpasstest: check persona subjects at startup (at most 255 printable ASCII characters), instead of failing their login with a 500 (f62617d)

v0.15.1

0.15.1 (2026-10-10)

Bug Fixes

• deps: bump FAPIgo to v0.52.1, and Go to 1.26.9 for GO-2026-6617 (#114) (145aa3d)

v0.15.0

0.15.0 (2026-10-05)

⚠ BREAKING CHANGES

• deps: Options.TolerateUserInfoSubjectClientID and MyinfoBusinessOptions.TolerateUserInfoSubjectClientID are removed, because FAPIgo v0.50.0 no longer tolerates a /userinfo sub equal to the client_id: delete the field. A kid naming two different keys (shared by the signing and encryption keys, or reused by a rotation key) is now refused by New, PublicJWKS and OfflineClientJWKS instead of one key being silently left out of the JWKS: give each key its own kid. See UPGRADING.md.

Bug Fixes

• deps: bump FAPIgo to v0.50.0 (0ac4342)

v0.14.2

0.14.2 (2026-10-04)

Bug Fixes

• deps: bump modernc.org/sqlite from 1.59.0 to 1.60.1 (#102) (c912242)

v0.14.1

0.14.1 (2026-10-04)

Bug Fixes

• deps: bump FAPIgo to v0.48.1 (#108) (2fa10fe)