Release SimpleSAMLphp 1.16.3.

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "simplesamlphp/simplesamlphp",
     "description": "A PHP implementation of a SAML 2.0 service provider and identity provider, also compatible with Shibboleth 1.3 and 2.0.",
-    "version": "1.16.2",
+    "version": "1.16.3",
     "type": "project",
     "keywords": [ "saml2", "shibboleth","oauth","ws-federation","sp","idp" ],
     "homepage": "http://simplesamlphp.org",

docs/simplesamlphp-changelog.md

@@ -6,6 +6,20 @@ SimpleSAMLphp changelog
 This document lists the changes between versions of SimpleSAMLphp.
 See the upgrade notes for specific information about upgrading.
 
+## Version 1.16.3
+
+Released 2018-12-20
+
+  * Resolved a security issue that could expose the user's credentials locally.  See
+    [SSPSA 201812-01](https://simplesamlphp.org/security/201812-01).
+  * Downgraded the level of log messages regarding the `userid.attribute` configuration option
+    from _warning_ to _debug_.
+  * Make the `attr` configuration option of the _negotiate_ allow both a string and an array.
+  * Look for the _keytab_ file used by the _negotiate_ module in the `cert` directory, accepting
+    both absolute and relative paths.
+  * Fixed some broken links.
+  * Other minor bugfixes.
+
 ## Version 1.16.2
 
 Released 2018-09-28

extra/simplesamlphp.spec

@@ -1,6 +1,6 @@
 %define name      simplesamlphp
 %define summary   SAML IDP/SP written in PHP
-%define version   1.16.2
+%define version   1.16.3
 %define release   1
 %define license   LGPL 2.1
 %define group     Networking/WWW

lib/SimpleSAML/Configuration.php

@@ -414,7 +414,7 @@ public function copyFromBase($instancename, $filename)
      */
     public function getVersion()
     {
-        return '1.16.2';
+        return '1.16.3';
     }