What's Changed

• oidc: modernize with new Go APIs by @ericchiang in #487
• oidc: improve documentation for APIs by @ericchiang in #488
• SECURITY.md: add a security policy and point to project-level reporting by @ericchiang in #489
• oidc: ignore JWKs with unknown signing algorithms rather than failing by @ericchiang in #491
• readme: update README and docs by @ericchiang in #492
• oidc: add API for determining when issuer URLs mismatch by @ericchiang in #493
• oidc: add constants for "email" and "profile" scopes by @ericchiang in #494

Full Changelog: v3.19.0...v3.20.0

What's Changed

• fix: Key refresh should set no-cache to get most up to date keys by @Yanni8 in #485
• oidc: add support for validating back-channel logout tokens by @ericchiang in #486

New Contributors

• @Yanni8 made their first contribution in #485

Full Changelog: v3.18.0...v3.19.0

What's Changed

• .github: configure dependabot by @ericchiang in #477
• .github: update go versions in CI by @ericchiang in #480
• build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0 by @dependabot[bot] in #478
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #479

Full Changelog: v3.17.0...v3.18.0

What's Changed

• *: format all files using newer Go versions by @ericchiang in #472
• *: add sanity check to avoid JWT over-allocation by @ericchiang in #473

Full Changelog: v2.4.0...v2.5.0

What's Changed

• oidc: improve error message for mismatched issuer URLs by @ericchiang in #469

Full Changelog: v3.16.0...v3.17.0

What's Changed

• refactor: Remove unused time injection from RemoteKeySet by @ponimas in #466
• bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove x/net dependency by @wardviaene in #467

New Contributors

• @wardviaene made their first contribution in #467

Full Changelog: v3.15.0...v3.16.0

What's Changed

• oidc: verify signature before parsing token by @ericchiang in #465

Full Changelog: v2.3.0...v2.4.0

What's Changed

• oidc: verify the ID Token's signature before processing claims by @ericchiang in #464

Full Changelog: v3.14.1...v3.15.0

What's Changed

• oidctest: fix import by @ericchiang in #457

Full Changelog: v3.14.0...v3.14.1

What's Changed

• oidc/oidctest: add new package by @ericchiang in #400

Full Changelog: v3.13.0...v3.14.0