Skip to content

v2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@pboling pboling released this 25 Oct 23:42
· 3 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.1.0
This tag was signed with the committer鈥檚 verified signature.
pboling |7eter l-|. l3oling
GPG key ID: B06271D4D2C187B5
Verified
Learn about vigilant mode.
33d0896
This commit was signed with the committer鈥檚 verified signature.
pboling |7eter l-|. l3oling
GPG key ID: B06271D4D2C187B5
Verified
Learn about vigilant mode.

2.1.0 - 2026-10-25

  • TAG: v2.1.0
  • COVERAGE: 98.48% -- 649/659 lines in 16 files
  • BRANCH COVERAGE: 93.53% -- 217/232 branches in 16 files
  • 90.83% documented

Changed

  • BREAKING: allow_cross_origin_redirects now defaults to false. Cross-origin redirects are blocked before credentials are replayed. Set allow_cross_origin_redirects: true explicitly to retain the previous behavior (deprecated).

Security

  • GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

  • gh!769 - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require auth-sanitizer >= 0.2.5 by @makssein

  • gh!775 - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @Huge

  • gh!776 - Redact configured sensitive response options from tokenless access-token initialization errors by @Huge

Contributors

Huge and makssein
Assets 3
Loading