CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

7.1.2 — 2024-05-21

Changed

• Add support for Node.js 22

7.1.1 — 2023-10-24

Fixed

• Be a better citizen in an ECMAScript modules world

7.1.0 — 2023-10-23

Added

• Add support for "aud" claim in "client_credentials" grants (by kadams54)

Changed

• Update dependencies

7.0.0 — 2023-10-04

Changed

• Breaking: No longer support Node.js 16

6.0.1 — 2023-10-03

Security

• Update dependencies to fix:
  • CVE-2022-25883
  • CVE-2023-26115
  • CVE-2023-43646

6.0.0 — 2023-06-19

Changed

• Breaking: No longer support Node.js 14
• Fix authorize endpoint compliance (remove scope requirement, make state optional) (by jirutka)
• Add support for Node.js 20
• Update dependencies

5.0.2 — 2023-02-20

Security

• Update dependencies to fix:
  • CVE-2022-46175
  • CVE-2022-24999
  • CVE-2022-25901

5.0.1 — 2022-10-04

Security

• Update dependencies to fix:
  • CVE-2022-36083

5.0.0 — 2022-06-27

Changed

• Breaking: No longer support Node.js 12
• Add support for Node.js 18

4.3.2 — 2022-06-27

Changed

• Update dependencies

4.3.1 — 2022-03-29

Security

• Update dependencies to fix:
  • CVE-2021-44906

4.3.0 — 2022-02-01

Added

• Support the token introspection endpoint (by cfman)

4.2.0 — 2022-01-28

Added

• Add support for custom endpoint pathnames (by roskh)
• Teach /token endpoint to support JSON content type (by roskh)

4.1.1 — 2021-11-18

Fixed

• Fix regression: Prevent unhandled rejected promises when incorrectly invoking the /token endpoint

4.1.0 — 2021-11-15

Added

• HTTPS support (by lbestftr)

4.0.0 — 2021-10-25

Added

• Add /endsession endpoint (by AndTem)
• Support EdDSA algorithm

Removed

• Breaking: Drop support for Node.js 10
• No longer accepts PEM encoded keys
• No longer supports generating unsigned JWTs

Changed

• Breaking: Reworked exposed API. Please refer to the migration guide for more information.
• Add support for Node.js 16

3.2.0 — 2021-08-03

Added

• Add subject_types_supported OpenID Provider Metadata field (by jjbooth74)

3.1.0 — 2020-11-30

Added

• Add authorize redirect event (by markwallsgrove)

3.0.3 — 2020-11-12

Fixed

• Fix regression: When adding a key to the KeyStore, do not normalize key "use" value to "sig" when already defined

3.0.2 — 2020-10-29

Added

• Support Nodejs 14.15 LTS

3.0.1 — 2020-10-23

Fixed

• Include missing files on pack/publish

3.0.0 — 2020-10-22

Added

• TypeScript type definitions (#48)

Changed

• Straightened definitions of optional parameters: null is no longer considered as a non valued parameter value; undefined bears that meaning.

2.0.0 — 2020-10-01

Added

• Honor OpenID Connect nonce (#34 by @HASHIMOTO-Takafumi)

Removed

• No longer support Node 8

1.5.1 — 2020-04-06

Security

• Update npm dependencies to fix:
  • CVE-2020-7598

1.5.0 — 2020-01-23

Added

• Add HTTP request object to OAuth2Service's events
• Add beforeTokenSigning event to OAuth2Service

1.4.0 — 2020-01-15

Security

• Update npm dependencies to fix:
  • NPM Security Advisory 1164
  • NPM Security Advisory 1300
  • NPM Security Advisory 1316
  • NPM Security Advisory 1324
  • NPM Security Advisory 1325

Fixed

• Add missing aud claim under Authorization Code Flow

Added

• Add CORS support

1.3.3 — 2019-09-25

Security

• Update npm dependencies to fix:
  • CVE-2019-15657
  • CVE-2019-10746
  • CVE-2019-10747

Changed

• Update license's legal entity.

1.3.2 — 2019-08-09

Security

• Update npm dependencies to fix:
  • CVE-2019-10744

1.3.1 — 2019-06-07

Security

• Update npm dependencies to fix:
  • WS-2019-0032
  • WS-2019-0063
  • WS-2019-0064

1.3.0 — 2019-06-03

Added

• Add revocation endpoint

1.2.0 — 2019-03-19

Added

• Add Authorization code grant
• Add Refresh token grant
• Add Userinfo endpoint

Security

• Update npm dependencies to fix CVE-2018-16469

1.1.0 — 2018-08-02

Added

• Add Resource Owner Password Credentials grant

Fixed

• Add missing cache control headers on /token responses

1.0.0 — 2018-08-01

Initial release.