All pull requests

Pull requests

• Revoke what a compromised secret could still be exchanged for

  #1987·55728 opened Oct 31, 2026Member·7/7·

  ·
  3

  

• Add secret_rotation_grace_period and after_old_secret_used

  #1986·55728 opened Oct 31, 2026Member·6/7·

  ·
  

• Put the instance back after a rotation that did not complete

  #1985·55728 opened Oct 31, 2026Member·5/7·

  ·
  2

  

• Add Application#clear_old_secret!

  #1984·55728 opened Oct 31, 2026Member·4/7·

  ·
  2

  

• Add Application#rotate_secret!

  #1983·55728 opened Oct 31, 2026Member·3/7·

  ·
  

• Withhold the rotation columns from serialization and #inspect

  #1982·55728 opened Oct 31, 2026Member·2/7·

  ·
  1

  

• Accept a retained client secret when enable_secret_rotation is on

  #1981·55728 opened Oct 31, 2026Member·1/7·

  ·
  

• Add forbid_oob_redirect_uris to refuse out-of-band redirect URIs

  #1979·eglitobias opened Oct 30, 2026Contributor·

  ·
  4

• Enforce a wall-clock timeout and a byte budget on HttpFetcher

  #1975·55728 opened Oct 14, 2026Member·

  ·
  1

  

• Issue stateless JWT tokens from the client credentials grant

  Skip-Changelog
  #1972·55728 opened Oct 12, 2026Member·

  ·
  20

  

• Report the granted resources as aud when introspecting a refresh token

  #1967·55728 opened Oct 4, 2026Member·2/3·

  ·
  2

  

• Keep refresh tokens bound to every resource of the original grant (RFC 8707 §2.2)

  #1966·55728 opened Oct 4, 2026Member·1/3·

  ·
  1

  14

  

• Track refresh token families to revoke a whole refresh chain at once

  #1947·55728 opened Sep 19, 2026Member·

  ·
  1

  9

  

• add dpop (rfc 9449) support

  #1794·gkemmey opened Feb 26, 2026Contributor·

  ·
  1

  164