oidc_core 2.0.0 changelog

2.0.0 #

FIX(oidc_core): protect the PKCE code_verifier at rest (#324 item 20) (#402). (32f4cbb3)
FIX(oidc_core): route deleteClientConfiguration through typed error parsing (#400). (bd250ff5)
FIX(oidc_core): honor expectedIssuer in validateUser (Entra multi-tenant) (#389). (4abc4e74)
FIX(oidc_core): send dpop_jkt on the direct authorization request (#324) (#391). (c5e7420a)
FEAT(oidc_core): mTLS RFC 8705 phase 1 core surface (#386) (#412). (f9b1446b)
FEAT(oidc_core): DCR integration helpers (#385) (#413). (c07e881a)
FEAT(oidc_core): react to a UserInfo 401 during session resume (#302) (#403). (933e0ed7)
FEAT(oidc_darwin): add macOS loopback system-browser navigation mode (#124) (#398). (a8d758f7)
FEAT(oidc_core): emit OidcTokenRefreshFailedEvent on refresh failures; clamp the expiring-refire loop (#392). (0b581dff)
BREAKING FEAT(oidc_core): cache-first init as the new default, discovery TTL cache, loaded-token validity controls (#399). (de3e2287)

1.0.0 #

FIX(oidc_core): also ungate AUTO refresh-on-expiry from grant_types_supported (#324). (7e543b98)
FIX: update packages/oidc_core/lib/src/managers/user_manager_base.dart. (d62828c0)
FIX(oidc_core): kid-miss refetch on the cacheStore-less verification path. (8eecbe28)
FIX(oidc_core): refetch JWKS on unknown kid with per-issuer cooldown. (badeba7b)
FIX(oidc_core): single-location client auth on token exchange and introspection (RFC 6749 §2.3). (36f67e39)
FIX(oidc_core): validate RFC 9207 iss on authorization error responses. (5916b65e)
FIX(oidc_core): always send id_token_hint on RP-initiated logout. (434af9ab)
FIX(oidc_core): reject UserInfo responses missing sub (OIDC Core §5.3.2). (f133c5b2)
FIX(oidc_core): send client auth in exactly one location on refresh (RFC 6749 §2.3). (f6bf79a8)
FIX(oidc_core): percent-encode client_secret_basic credentials (RFC 6749 §2.3.1). (94964778)
FIX(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. (482f0186)
FIX: handle whitespace-only payloads. (2751b841)
FIX(oidc_core): strip terminating slash when building well-known URL (#324). (975d446f)
FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
FIX(oidc_core): close 7 P0 spec-audit findings (#324). (60907e96)
FIX: handle refresh responses without id_token. (4af363be)
FIX(oidc_core): restore web/WASM compatibility for offline error handling. (0c2e894a)
FIX(core): harden DPoP thumbprint + JARM verification (adversarial-review fixes). (69ac51aa)
FIX(core): DPoP — pad short EC coordinates (RFC 7638 jkt correctness). (bd5568e7)
FIX(core): update device-code flow test for the fail-closed JWT default. (fa333f89)
FIX: handle empty response. (03179667)
FIX(oidc_core): harden ID-token/UserInfo validation (P0 spec-compliance). (1e7cfee9)
FIX: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. (3b8ef447)
FEAT(oidc_core): deferred audit best-practice hardening (alg-pin, signed-userinfo, issuer, back-channel logout). (7259290d)
FEAT(android): apply typed Custom Tabs options natively (Phase 1). (10e903eb)
FEAT(oidc_core): enforce RFC 9207 iss require-when-advertised + error-path (#324). (3f324712)
FEAT(core): JAR signed request objects + JARM signed responses (RFC 9101 / JARM). (19480489)
FEAT(core): validate the Hybrid-flow front-channel id_token (OIDC Core §3.3.2). (8dbc582b)
FEAT(core): Pushed Authorization Requests (PAR, RFC 9126) — endpoint + model. (6eb09f8a)
FEAT(core): Token Introspection (RFC 7662) + step-up challenge parsing (RFC 9470). (ab0cdff0)
FEAT(core): Resource Indicators (RFC 8707) + Token Exchange (RFC 8693). (43d8d664)
FEAT(core): DPoP resource-endpoint nonce retry (RFC 9449 §9). (1d733790)
FEAT(core): validate c_hash + auth_time/max_age (OIDC Core §3.3.2.11 / §3.1.2.1). (93c81845)
FEAT(core): DPoP phase 3 — dpop_jkt auth-code binding + UserInfo DPoP scheme. (d28b736f)
FEAT(core): DPoP phase 2 — use_dpop_nonce retry (centralized in the token endpoint). (bc059b27)
FEAT(core): mint private_key_jwt / client_secret_jwt client assertions. (c7043fcc)
FEAT(storage): harden token storage at rest (RFC 9700 §4.9.3). (76111b4a)
FEAT(core): DPoP phase 1b — attach proofs to token-endpoint requests. (c0207476)
FEAT(oidc): batch-2 audit hardening (loopback timeout, auth_time/max_age, resilient discovery parse, unverified-userinfo guard). (d7f5965a)
FEAT(core): DPoP (RFC 9449) crypto core — proof builder + key/thumbprint + manager. (43f566d5)
FEAT(oidc_core): batch-3 audit hardening (signed_metadata verify, JWKS cache TTL, implicit/hybrid nonce assert). (27a7f34d)
FEAT(oidc_core): typed logout capability flags on provider metadata. (74a6613a)
FEAT(core): Dynamic Client Registration + management (RFC 7591 / RFC 7592). (55226655)
FEAT(observability): native browser events via the existing OidcEvent stream (Phase 3). (91d1f5bd)
BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)
BREAKING FIX(core): always send PKCE (default S256), never downgrade (OAuth 2.1 / RFC 9700). (99d1284a)
BREAKING FIX(core): fail-closed id_token verification + stricter validation (security). (b4d92eaf)
BREAKING FEAT(core): wire PAR (RFC 9126) into the authorization-code login flow. (d2b44c32)
BREAKING FEAT(core): id_token aud-strictness + at_hash validation (security). (747d8a72)
BREAKING FEAT(options): redesign native options API (v1 clean break, no AppAuth framing). (a78954fe)
BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
BREAKING FEAT(core): revoke tokens on logout by default (RFC 7009). (90a8cebd)
BREAKING FEAT(oidc_android): add flowTimeoutSeconds to fix headless CI hang. (01c844f5)
BREAKING FEAT(oidc_core): remove the strictJwtVerification fail-open opt-out. (ee2146f9)
BREAKING CHORE: v1 dependency upgrade + drop the pigeon global-tool wrapper. (45b62a3e)

0.16.1+1 #

DOCS: remove logo branding from screenshots. (2acf65d3)

0.16.1 #

FEAT(oidc_core): add extraTokenHeaders parameter to loginPassword. (e00c753b)

0.16.0 #

REFACTOR: remove unnecessary @protected annotations from offline mode tracking variables. (56da9bab)
FEAT: update copy_with_extension and copy_with_extension_gen dependencies to support version range. (3569919e)
FEAT: update dependencies and adjust test configurations for improved compatibility. (18fef073)
FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
BREAKING FEAT: Add offline mode events and error handling. (7479fd15)

0.15.0 #

FIX: refactor oidcExecuteHook to handle request and response modifications. (806c6411)
BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
BREAKING FEAT: Support WASM (#253). (8b2931ef)

0.14.2+1 #

DOCS: Add openid certification mark (#240). (89313199)

0.14.2 #

REFACTOR: remove unnecessary library declaration and test annotation from device_authorization_test.dart. (a8886cfe)
FEAT: add token revocation methods to OidcUserManager. (4850788f)
FEAT: add token revocation support with request and response models. (a6b635f0)

0.14.1 #

FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)

0.14.0 #

BREAKING FEAT: Added launchUrl parameter to OidcPlatformSpecificOptions_Native, to simplify modifying the url launching logic without overriding the manager.
BREAKING FEAT: Added support for multiple managers by adding the id property to OidcUserManagerBase.
- Added the managerId parameter to:
  - Multiple methods in OidcStore.
  - OidcState
- See #206 for motivation.
FIX: Added some missing fields in json serialization.

0.13.0 #

BREAKING FEAT: support hooks (#228). (f2d9d9c6)

0.12.0 #

REFACTOR: minor lints and refactors. (5ab9af70)
BREAKING CHORE(deps): upgrade flutter_appauth to v9.0.0 (#199). (f027af34)

0.11.0 #

FIX: set idTokenHint null if no postLogoutRedirectUri set (#192). (bcf47cbd)
BREAKING CHORE: regenerate files with new json serializer. (35523a61)

0.10.0 #

BREAKING FEAT: minimal implement nonce hashing (#172). (d4daf387)

0.9.1 #

FEAT: Added OidcTokenExpiredEvent and OidcTokenExpiringEvent (#91). (85ba41ce)

0.9.0 #

FIX: expand successful status range to include 300-399 status code to allow for 304 , see. (717d5330)
FIX: improve OidcEndpoints error handling. (5f15c774)
FIX: update oidc_web_core version. (2717b23c)
FEAT: support offline auth. (cced6013)
FEAT: add keepUnverifiedTokens and keepExpiredTokens to user manager settings. (117931bd)
FEAT: add getIdToken to OidcUserManagerSettings. (dceabc89)
FEAT: updated oidc_core example. (676657b1)
DOCS: update changelogs. (b0ffeb43)
BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

0.7.0 #

BREAKING DEPS: update min dart version to 3.4.0
FEAT: added OidcUserManagerBase.
FIX: improve OidcEndpoints error handling.
DOCS: updated the docs website with new entries to the added features.

0.6.3 #

DEPS: Use jose_plus: ^0.4.4 which uses package:clock JWT validation to simplify testing.
FEAT: Added OidcDateTime extension which contains secondsSinceEpoch and fromSecondsSinceEpoch helper methods

0.6.2 #

FIX: Serialize query parameters.
FIX: Removed false positive warnings that came from url_launcher

0.6.1 #

FEAT: Support overriding the discovery document.

0.6.0+1 #

DOCS: fixed docs link.

0.6.0 #

FEAT: added claimNames and claimSources to OidcUserInfoResponse.
BREAKING CHANGE: changed nonce to get stored in secureTokens namespace.

0.5.1 #

FEAT: added device authorization endpoint.

0.5.0+1 #

FIX: added userInfo to fromIdToken.
DOCS: added oidc_core docs and updated example.

0.5.0 #

0.4.1 #

FEAT: add response form userInfo endpoint to the user object.
FEAT: use package:clock for better testing.

0.4.0+1 #

FIX: token date calculations.

0.4.0 #

BREAKING CHANGE: all packages.

0.3.2 #

FEAT: support logout.

0.3.1 #

FEAT: initial version.

0.3.0 #

Working authorization code flow, without refresh_token support.

0.2.0 #

FEAT: added more helpers.

0.1.0+1 #

Added topics.

0.1.0 #

Initial version.

oidc_core 2.0.0 oidc_core: ^2.0.0 copied to clipboard

Metadata