Repository navigation

Releases

v2.10.6 Latest

Latest

sigbit-release-bot released this 13 Nov 13:37

e3da661

2.10.6 (2026-11-13)

Bug Fixes

auth: return 400 and hide internal errors on auth callback failures (#211) (8740631)
idp: stamp current signing key's kid on refreshed tokens (#209) (c83dfba)

Assets 8

v2.10.5

sigbit-release-bot released this 13 Nov 12:52

5717242

2.10.5 (2026-11-13)

Bug Fixes

keep each OAuth flow's state in its own cookie (#208) (03818a0)
oauth: detect refresh token reuse after the rotation grace period (#197) (7cb8b47)

Assets 8

v2.10.4

sigbit-release-bot released this 13 Nov 12:12

ce1f490

2.10.4 (2026-11-13)

Bug Fixes

idp: apply RFC 7591 §2 defaults to DCR registration response (#206) (557d2f7)
idp: replay authorize redirect for duplicate submissions (#204) (2913c8e)
preserve upstream tool schemas verbatim through the stdio→HTTP relay (#179) (47f26ac)
proxy: serve path-specific protected-resource metadata (#190) (2a89ef3)

Assets 8

v2.10.3

sigbit-release-bot released this 13 Nov 11:28

b1a9c06

2.10.3 (2026-11-13)

Bug Fixes

auth: abort handler chain after login redirect in RequireAuth (#199) (1ce4a75), closes #196
docker: ship Node 24 instead of EOL Node 18 from Debian bookworm (#201) (20a898f)
idp: require PKCE for all clients, validate DCR redirect URIs, show client on consent page (#200) (1d9705a), closes #191
redact credentials in panic request dumps (#187) (085c374)

Assets 8

v2.10.2

sigbit-release-bot released this 08 May 14:52

c8868ad

2.10.2 (2026-05-08)

Bug Fixes

harden OAuth security checks (#160) (594ae54)

Assets 8

v2.10.1

sigbit-release-bot released this 02 May 03:07

5ec9725

2.10.1 (2026-05-02)

Miscellaneous Chores

release 2.10.1 (#156) (d347751)

Assets 8

v2.10.0

sigbit-release-bot released this 02 May 02:49

62f532d

2.10.0 (2026-04-30)

Features

Support custom GitHub URLs (#151) (6e49998)

Assets 8

v2.9.1

sigbit-release-bot released this 25 Apr 09:33

c8abee3

2.9.1 (2026-04-25)

Bug Fixes

persist JWT session in storage so user identity survives token exchange (#146) (4004e4d)
proxy: strip client-supplied header-mapping target headers (#148) (3d6e35c)

Assets 8

v2.9.0

sigbit-release-bot released this 16 Apr 13:45

6f6d916

2.9.0 (2026-04-16)

Features

add HEADER_MAPPING_BASE flag to control JWT claims source for HEADER_MAPPING (#144) (a43f4f4), closes #143

Assets 8

v2.8.1

sigbit-release-bot released this 13 Apr 12:33

cdef9cf

2.8.1 (2026-04-13)

Bug Fixes

trim userinfo to mapped fields before storing in session cookie (#141) (683d79a)
use /v2 module path (#139) (fb2d63e)

Assets 8