Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

7.2.0 — 2024-11-25

Added

Include scope in token for authorization_code and refresh_token grants (by PetrasJaug)
Add PKCE support (by tanettrimas)

Changed

Update dependencies

7.1.2 — 2024-05-21

Changed

Add support for Node.js 22 (by sheinbergon)

7.1.1 — 2023-10-24

Fixed

Be a better citizen in an ECMAScript modules world

7.1.0 — 2023-10-23

Added

Add support for "aud" claim in "client_credentials" grants (by kadams54)

Changed

Update dependencies

7.0.0 — 2023-10-04

Changed

Breaking: No longer support Node.js 16

6.0.1 — 2023-10-03

Security

Update dependencies to fix:

6.0.0 — 2023-06-19

Changed

Breaking: No longer support Node.js 14
Fix authorize endpoint compliance (remove scope requirement, make state optional) (by jirutka)
Add support for Node.js 20
Update dependencies

5.0.2 — 2023-02-20

Security

Update dependencies to fix:

5.0.1 — 2022-10-04

Security

Update dependencies to fix:
- CVE-2022-36083

5.0.0 — 2022-06-27

Changed

Breaking: No longer support Node.js 12
Add support for Node.js 18

4.3.2 — 2022-06-27

Changed

Update dependencies

4.3.1 — 2022-03-29

Security

Update dependencies to fix:
- CVE-2021-44906

4.3.0 — 2022-02-01

Added

Support the token introspection endpoint (by cfman)

4.2.0 — 2022-01-28

Added

Add support for custom endpoint pathnames (by roskh)
Teach /token endpoint to support JSON content type (by roskh)

4.1.1 — 2021-11-18

Fixed

Fix regression: Prevent unhandled rejected promises when incorrectly invoking the /token endpoint

4.1.0 — 2021-11-15

Added

HTTPS support (by lbestftr)

4.0.0 — 2021-10-25

Added

Add /endsession endpoint (by AndTem)
Support EdDSA algorithm

Removed

Breaking: Drop support for Node.js 10
No longer accepts PEM encoded keys
No longer supports generating unsigned JWTs

Changed

Breaking: Reworked exposed API. Please refer to the migration guide for more information.
Add support for Node.js 16

3.2.0 — 2021-08-03

Added

Add subject_types_supported OpenID Provider Metadata field (by jjbooth74)

3.1.0 — 2020-11-30

Added

Add authorize redirect event (by markwallsgrove)

3.0.3 — 2020-11-12

Fixed

Fix regression: When adding a key to the KeyStore, do not normalize key "use" value to "sig" when already defined

3.0.2 — 2020-10-29

Added

Support Nodejs 14.15 LTS

3.0.1 — 2020-10-23

Fixed

Include missing files on pack/publish

3.0.0 — 2020-10-22

Added

TypeScript type definitions (#48)

Changed

Straightened definitions of optional parameters: null is no longer considered as a non valued parameter value; undefined bears that meaning.

2.0.0 — 2020-10-01

Added

Honor OpenID Connect nonce (#34 by @HASHIMOTO-Takafumi)

Removed

No longer support Node 8

1.5.1 — 2020-04-06

Security

Update npm dependencies to fix:
- CVE-2020-7598

1.5.0 — 2020-01-23

Added

Add HTTP request object to OAuth2Service's events
Add beforeTokenSigning event to OAuth2Service

1.4.0 — 2020-01-15

Security

Update npm dependencies to fix:

Fixed

Add missing aud claim under Authorization Code Flow

Added

Add CORS support

1.3.3 — 2019-09-25

Security

Update npm dependencies to fix:

Changed

Update license's legal entity.

1.3.2 — 2019-08-09

Security

Update npm dependencies to fix:
- CVE-2019-10744

1.3.1 — 2019-06-07

Security

Update npm dependencies to fix:

1.3.0 — 2019-06-03

Added

Add revocation endpoint

1.2.0 — 2019-03-19

Added

Add Authorization code grant
Add Refresh token grant
Add Userinfo endpoint

Security

Update npm dependencies to fix CVE-2018-16469

1.1.0 — 2018-08-02

Added

Add Resource Owner Password Credentials grant

Fixed

Add missing cache control headers on /token responses

1.0.0 — 2018-08-01

Initial release.