5.0.0-rc.1

This is the first release candidate for the 5.0 major version. No further breaking changes are expected until the next major version.

Refer to the Upgrade Guide for tips on how to upgrade from 4.x.

New Features

• Implement SecretType::into_secret (#272)

Bug Fixes

• Accept null device code interval (#278)
• Ignore async token revocation response body (#282)

Other Changes

• Inline format args (#270)
• Update dev dependencies (#285)
• Remove defunct sponsorship from README
• Remove client secret from implicit flow example (#286)
• Use --locked on MSRV build in CI

Full Changelog: 5.0.0-alpha.4...5.0.0-beta.1

5.0.0-alpha.4

This is an API-unstable release intended for gathering feedback about breaking API changes in 5.0. It should be safe to use in applications, but further breaking API changes MAY occur before stabilizing the API for the 5.0.0 release.

Refer to the Upgrade Guide for tips on how to upgrade from 4.x.

Breaking Changes

• Replace TokenResponse generic with associated type (30ced32)

Bug Fixes

• Derive Clone and Debug for EndpointState types (#263)

Other Changes

• Allow base64 0.21 or 0.22 (#261)

Full Changelog: 5.0.0-alpha.3...5.0.0-alpha.4

5.0.0-alpha.3

This is an API-unstable release intended for gathering feedback about breaking API changes in 5.0. It should be safe to use in applications, but further breaking API changes MAY occur before stabilizing the API for the 5.0.0 release.

Refer to the Upgrade Guide for tips on how to upgrade from 4.x.

Breaking Changes

• Return impl Future instead of Pin<Box<dyn Future>> to fix Send/Sync bounds (6e583bd)
• Bump http to 1.0 and reqwest to 0.12 (408ecab)

Other Changes

• Bump base64 to 0.21 (db0ea44)
• Set minimum version of chrono to 0.4.31 (7b667fc)
• Mention openidconnect crate in README (7b667fc)

Full Changelog: 5.0.0-alpha.2...5.0.0-alpha.3

5.0.0-alpha.2

This is an API-unstable release intended for gathering feedback about breaking API changes in 5.0. It should be safe to use in applications, but further breaking API changes are expected before stabilizing the API for the 5.0.0 release (e.g., upgrading http to 1.0; see #237).

Refer to the Upgrade Guide for tips on how to upgrade from 4.x.

Breaking Changes

• Add conditional typestates (replacing Boolean typestates from 5.0.0-alpha.1) (85ea470)
• Consolidate HTTP client errors into oauth2::HttpClientError and flatten exports (e.g., oauth2::reqwest instead of oauth2::reqwest::reqwest) (4391eed)

Other Changes

• Add note about spawn_blocking to docs (1fc8188)
• Re-export curl as oauth2::curl and ureq as oauth2::ureq when the corresponding Cargo features are enabled (aff7471)

Full Changelog: 5.0.0-alpha.1...5.0.0-alpha.2

5.0.0-alpha.1

This is an API-unstable release intended for gathering feedback about breaking API changes in 5.0. It should be safe to use in applications, but further breaking API changes are expected before stabilizing the API for the 5.0.0 release (e.g., upgrading http to 1.0; see #237).

Refer to the Upgrade Guide for tips on how to upgrade from 4.x.

Breaking Changes

• reqwest: Migrate to shared Error type and use thiserror's From impl by @MarijnS95 (#238)
• Bump MSRV to 1.65 and institute a policy supporting Rust releases going back at least 6 months (same policy as openidconnect crate) (576f809)
• Improve Display output of RequestTokenError::ServerResponse (96c6f9b)
• Track Client endpoints statically via typestates (1d1f4d1)
• Refactor crate into smaller private modules and make devicecode and revocation modules private (9d8f11a)
• Add reqwest-blocking feature (da7d1c5)
• Rename URI/URL getters and setters (4d55c26)
• Add AsyncHttpClient and SyncHttpClient traits (23b952b)

New Features

• Add timing-resistant-secret-traits feature for PartialEq/Hash by @kate-shine (#232)
• Derive Eq for types that already derive PartialEq (b19ad89)
• Implement From instead of Into for newtypes (d9402c4)
• Implement Display trait for URL types (8bd0ff1)

Other Changes

• Replace map_err() conversions with a From call via the Try operator by @MarijnS95 (#239)
• Fix comments about csrf_state by @ikehz (#245)
• Add documentation about comparing secrets securely by @ikehz (#246)
• Remove unused imports in examples by @frewsxcv (#207)
• Make private prepare_request() methods infallible (8ef74ac)
• Address clippy lints and clean up examples (d675e81)
• Remove empty leading and trailing lines from doc comments (a8b5cf8)
• Reorder and clean up imports (92c491a)
• Add Upgrade Guide

Full Changelog: 4.4.2...5.0.0-alpha.1

4.4.2

Bug Fixes

• Enable chrono wasmbind feature to fix panic in WASM environments (#230)

Other Changes

• Fix token URL for Microsoft device code flow example (#220)
• Add Microsoft device code example with tenant ID (#222)

4.4.1

Bug Fixes

• Export device authorization flow types in top-level namespace along with VerificationUriComplete type

4.4.0

New Features

• Add DeviceAccessTokenRequest::set_max_backoff_interval() method (with default value of 10 seconds) to control max polling backoff in response to HTTP client errors (#216).

Bug Fixes

• Fix serde_path_to_error dependency min version (#197)

Other Changes

• Use SPDX license format (#205)

4.3.0

New Features

• Make new-type constructors const functions (#186)

Bug Fixes

• Have ureq::http_client use send_bytes() for POST requests to avoid sending Transfer-Encoding: chunked header that certain providers such as Microsoft do not support (#182/#183)
• Return RequestTokenError::ServerResponse with DeviceCodeErrorResponseType::ExpiredToken (instead of RequestTokenError::Other) when device access token request times out (#195)

Other Changes

• Add async device code example for Microsoft endpoints (#190)

4.2.3

Bug Fixes

• Fix stale documentation around async API, along with some RFC links

Other Changes

• Add sponsor to README