Version 1.6.3

What's Changed

• Add diff-cover check in GHA by @azmeuk in #803
• Run GHA unit tests with uv by @azmeuk in #805
• Move from pre-commit to prek by @azmeuk in #804
• Sign OIDC id_token according to id_token_signed_response_alg client metadata by @azmeuk in #802

Full Changelog: v1.6.2...v1.6.3

Version 1.6.2

What's Changed

• Allow insecure transport for 127.0.0.1 for debugging by @geigerzaehler in #788
• Raise a MissingCodeError when code parameter is missing by @lepture in #786
• Temporarily restore OAuth2Request body parameter by @azmeuk in #791
• Raise MissingCodeException when code parameter is missing by @lepture in #794
• Fix id_token generation with EdDSA alg by @azmeuk in #800

Full Changelog: v1.6.1...v1.6.2

Version 1.6.1

• Filter key set with additional "alg" and "use" parameters.

Version 1.6.0

• Fix issue when RFC9207 is enabled and the authorization endpoint response is not a redirection. pull request #733
• Fix missing state parameter in authorization error responses. issue #525
• Support for acr and amr claims in id_token. issue #734
• Support for the none JWS algorithm.
• Fix response_types strict order during dynamic client registration. issue #760
• Implement RFC9101 The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). issue #723
• OIDC UserInfo endpoint support. issue #459

Version 1.5.2

Released on Apr 1, 2025

• Forbid fragments in redirect_uris. #714
• Fix invalid characters in error_description. #720
• Add claims_cls parameter for client's parse_id_token method. #725

Version 1.5.1

Released on Feb 28, 2025

• Fix RFC9207 iss parameter. #715

Version 1.5.0

• Fix token introspection auth method for clients. #662
• Optional typ claim in JWT tokens. #696
• JWT validation leeway. #689
• Implement server-side RFC9207. #700 #701
• generate_id_token can take a kid parameter. #702
• More detailed InvalidClientError. #706
• OpenID Connect Dynamic Client Registration implementation. #707

Version 1.4.1

• Improve garbage collection on OAuth clients. #698
• Fix client parameters for httpx. #694

Version 1.4.0

Bugfixes

• Fix id_token decoding when kid is null. #659
• Support for Python 3.13. #682
• Force login if the prompt parameter value is login. #637
• Support for httpx 0.28. #695

Breaking changes

• Stop support for Python 3.8. #682

Version 1.3.2

• Prevent ever-growing session size for OAuth clients.
• Revert quote client id and secret.
• unquote basic auth header for authorization server.