Skip to content

v0.0.8

Choose a tag to compare

View all tags
@arapov arapov released this 04 Jun 12:11
· 6 commits to master since this release
v0.0.8
This tag was signed with the committer’s verified signature.
arapov Anton Arapov
GPG key ID: EDDD4C5DAA149BBE
Verified
Learn about vigilant mode.
4db78d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Follow-up hardening on the v0.0.7 stateless OAuth client store. No tool/API changes.

  • Public clients honoured. A client registering with token_endpoint_auth_method: "none" (PKCE-only) is no longer issued a client_secret — 0.0.7 derived one for every client, leaving public clients in a contradictory state. Confidential (client_secret_post) clients, including Claude.ai's, are unchanged → no re-auth at this upgrade.
  • Oversized client_id guard. getClient rejects a client_id over 16 KB before any HMAC/JSON work (legit ids are ~400 bytes).

See CHANGELOG.md.

Assets 2
Loading