• Added: PHP 8.5 test coverage,
• Added: Support for Symfony 8.0,
• Added: Handles absolute URL's in Amazon Cognito,
• Bugfix: Wrong HTTP status code in RegisterController,
• BC Break: Increased firebase/php-jwt support to 7.0,
• BC Break: Dropped support for Symfony < 6.4,
• BC Break: Dropped support for PHP < 8.3,

• Added: PHP 8.5 test coverage,
• Added: Support for Symfony 8.0,
• Added: Handles absolute URL's in Amazon Cognito,
• Bugfix: Wrong HTTP status code in RegisterController,
• BC Break: Increased firebase/php-jwt support to 7.0,
• BC Break: Dropped support for Symfony < 6.4,
• BC Break: Dropped support for PHP < 8.3,

• Added: PHP 8.4 test coverage,
• Added: LinkedIn OpenID resource owner,
• Added: show_dialog option to Spotify resource owner,
• Use CSPRNG for generating nonce,

• Added: PHP 8.4 test coverage,
• Added: LinkedIn OpenID resource owner,
• Added: show_dialog option to Spotify resource owner,
• Use CSPRNG for generating nonce,

• BC Break: Dropped support for Symfony: 6.3 and 7.0,
• Added: Amazon Cognito resource owner,
• Bugfix: Prevent overwriting failure_path in AuthenticationFailureHandler when connect functionality is not enabled,
• Bugfix: Prevent overwriting failure_handler in security configuration if set,
• Bugfix: Type hint AuthenticatorInterface instead of OAuthAuthenticator in RefreshAccessTokenListener,
• Bugfix: Add missing parameters to OdnoklassnikiResourceOwner,

• BC Break: Dropped support for Symfony: 6.3 and 7.0,
• Added: Amazon Cognito resource owner,
• Bugfix: Prevent overwriting failure_path in AuthenticationFailureHandler when connect functionality is not enabled,
• Bugfix: Prevent overwriting failure_handler in security configuration if set,
• Bugfix: Type hint AuthenticatorInterface instead of OAuthAuthenticator in RefreshAccessTokenListener,
• Bugfix: Add missing parameters to OdnoklassnikiResourceOwner,

What's Changed

• Add Telegram resource owner by @zorn-v in #1966
• Drop not supported PHP 7.4 & 8.0 by @stloyd in #1969
• Allow "use_authorization_to_get_token" to be configured to false for generic OAuth2 by @ldaspt in #1974
• Update API version for Facebook to the latest available by @stloyd in #1975
• Replace custom authenticator passport with custom badge usage by @stloyd in #1976
• Replace custom authenticator passport with custom badge usage by @stloyd in #1978
• Fix registration of failure handler by @stloyd in #1979
• Don't miss the refresh token by @kurian86 in #1963
• Fix security setup docs by @stloyd in #1980
• Add GH action to close stale stuff by @stloyd in #1981
• Allow null as $registrationForm in RegisterController by @stloyd in #1983
• Make Twig & Symfony Routing hard requirement by @stloyd in #1984
• Document how to configure entity provider by @stloyd in #1985
• Remove Twig usage from AuthenticationFailureHandler by @stloyd in #1986
• Add connect functionality docs by @stloyd in #1987
• Adjust changelog for release 2.2 by @stloyd in #1988

New Contributors

• @zorn-v made their first contribution in #1966
• @ldaspt made their first contribution in #1974
• @kurian86 made their first contribution in #1963

Full Changelog: 2.1.0...2.2.0

• BC Break: Dropped support for PHP 7.4 & 8.0,
• Added: Telegram resource owner,
• Bugfix: Allow use_authorization_to_get_token to be configured to false for generic OAuth2,
• Bugfix: Update API version for Facebook to latest available
• Bugfix: Replace custom authenticator passport with custom badge usage,
• Bugfix: Fix registration of failure handler,
• Bugfix: Don't miss refresh token in registration controller,
• Bugfix: Allow null as $registrationForm in RegisterController,
• Bugfix: Fix connect functionality with authentication managers,

What's Changed

• Add resource owner Passage by @malteschlueter in #1962
• Allow usage of Symfony 7 by @stloyd in #1968
• Fixed compatiblity with Symfony 6.4+

New Contributors

• @malteschlueter made their first contribution in #1962

For details go and read the CHANGELOG file.

• BC Break: Dropped support for Symfony: >6.0, <6.3,
• Added: New Passage resource owner,
• Bugfix: Remove deprecations reported by Symfony 6.4,
• Chore: Added support for Symfony 7,

Long awaited 2.0 release!

The main changes:

• completely reworked resource owners internals,
• official support for Symfony 6,
• official support for PHP 8,
• dropped support for Symfony <5.4,
• dropped support for PHP <7.4,
• removed support for FOSUserBundle,

For details go and read the CHANGELOG file.

What's Changed

• Remove direct deprecations reported on Symfony 6 by @stloyd in #1946
• Enable integration tests on Symfony 6 by @stloyd in #1947
• Prevent refreshing non-expired token by @stloyd in #1948
• Update GH actions by @stloyd in #1949
• Remove deprecations reported by Symfony 6.x by @stloyd in #1951
• Improve compatibility with Symfony 6.x by @stloyd in #1950
• Prevent fatal error when token doesn't have resource owner name set by @stloyd in #1952
• Run tests against PHP 8.3 by @stloyd in #1953

Full Changelog: 2.0.0-BETA3...2.0.0

• Bugfix: Prevent refreshing non-expired tokens
• Bugfix: Remove deprecations reported by Symfony 6.x
• Bugfix: Prevent fatal error when token doesn't have resource owner name set

Changelog

• BC Break: Dropped support for Symfony: 4.4 & 6.0.*,
• BC Break: Class Templating\Helper\OAuthHelper was merged into Twig\Extension\OAuthRuntime,
• BC Break: When resource owner class doesn't define TYPE constant or is null, then key will be calculated by converting its class name without ResourceOwner suffix to snake_case, if neither is felt, then \LogicException will be thrown,
• Deprecated: method UserResponseInterface::getUsername() was deprecated in favour of UserResponseInterface::getUserIdentifier() to match changes in Symfony Security component,
• Enhancement: @internal resourceOwner oauth types in Configuration are calculated automatically by scandir. All classes extended from GenericOAuth[X]ResourceOwner get oauth[X] type. If class only implements ResourceOwnerInterface then its oauth type is unknown. ResourceOwner key (parameter type in configs) should have defined ResourceOwner::TYPE constant. Each user defined custom ResourceOwner class that implemented ResourceOwnerInterface will be registered automatically. If autoconfigure option is disabled user have to add the tag hwi_oauth.resource_owner to the service definition,
• Enhancement: Class ConnectController was split into two smaller ones, Connect\ConnectController & Connect\RegisterController,
• Bugfix: Added OAuth1ResourceOwner & OAuth2ResourceOwner to cover case of implementing custom oauth resource owners,
• Bugfix: Fixed Authorization Header in CleverResourceOwner::doGetRequest,
• Bugfix: Catch also the TransportExceptionInterface in AbstractResourceOwner::getResponseContent() method,
• Bugfix: Current matched Firewall is respected during generation of resource owner check path links,
• Bugfix: Prevent fatal error in OAuthUserProvider::loadUserByOAuthUserResponse() when nickname is not available in OAuth response,
• Bugfix: Use newer version of firebase/php-jwt library,
• Chore: Removed not used Symfony Templating component

What's Changed

• Add Apple client_secret auto generation by @Seb33300 in #1884
• Update ConnectController.php by @stephanvierkant in #1886
• Merged Templating\Helper\OAuthHelper class directly into Twig\Extension\OAuthRuntime by @stloyd in #1888
• Added OAuth1ResourceOwner & OAuth2ResourceOwner by @stloyd in #1889
• Refactor ConnectController & split it into smaller ones by @stloyd in #1887
• Improve RefreshOAuthTokenCompilerPass class quality by @stloyd in #1881
• Added getIdentifier() into PathUserResponse to match Symfony changes by @stloyd in #1883
• Improve Configuration.php readability by @gassan in #1891
• Fixed wrong class name in SensioConnectUserResponse by @stloyd in #1894
• Allow "symfony/flex" plugin by @stloyd in #1908
• Removed support for Symfony ~6.0 by @stloyd in #1907
• Fixed links to documentation by @stloyd in #1909
• Remove invalid CI job by @stloyd in #1910
• Fix typo by @dlondero in #1899
• Fix Authorization header for CleverResourceOwner.php by @gassan in #1868
• Catch also the TransportExceptionInterface in AbstractResourceOwner::getResponseContent() method by @stloyd in #1911
• Current matched Firewall is respected during generation of check path links. by @gassan in #1890
• Added funding button by @stloyd in #1912
• All ResourceOwners are collected automatically. by @gassan in #1872
• Fixed configuration of custom resource owners by @stloyd in #1915
• Add custom resource owner to confirm it's working correctly by @stloyd in #1916
• Fix typo in configuration comment by @reyostallenberg in #1933
• Update apple connector doc link by @Nek- in #1929
• Fix PHP 8.2 compatibility by @IonBazan in #1926
• Avoid confusion about Symfony version support dropped by @lyrixx in #1936
• Added feature to auto hint towards specific idp by @pimjansen in #1931
• Prevent fatal error in loadUserByOAuthUserResponse() when nickname is not available in OAuth response by @stloyd in #1913
• Fixed wrong PHP version used in CI by @stloyd in #1941
• Fix CS and PHPStan by @Seb33300 in #1938
• Remove symfony/templating by @GromNaN in #1940
• Temporary skip broken test on Symfony 6 by @stloyd in #1942
• Don't use native file session in tests by @stloyd in #1943
• Remove BC layer for Symfony 4.4 by @stloyd in #1945

New Contributors

• @Seb33300 made their first contribution in #1884
• @dlondero made their first contribution in #1899
• @reyostallenberg made their first contribution in #1933
• @lyrixx made their first contribution in #1936
• @pimjansen made their first contribution in #1931
• @GromNaN made their first contribution in #1940

Full Changelog: 2.0.0-BETA2...2.0.0-BETA3

• BC Break: Dropped support for Symfony: 6.0.*,
• BC Break: Class Templating\Helper\OAuthHelper was merged into Twig\Extension\OAuthRuntime,
• BC Break: When resource owner class doesn't define TYPE constant or is null, then key will be calculated by converting its class name without ResourceOwner suffix to snake_case, if neither is felt, then \LogicException will be thrown,
• Deprecated: method UserResponseInterface::getUsername() was deprecated in favour of UserResponseInterface::getUserIdentifier() to match changes in Symfony Security component,
• Enhancement: @internal resourceOwner oauth types in Configuration are calculated automatically by scandir. All classes extended from GenericOAuth[X]ResourceOwner get oauth[X] type. If class only implements ResourceOwnerInterface then its oauth type is unknown. ResourceOwner key (parameter type in configs) should have defined ResourceOwner::TYPE constant. Each user defined custom ResourceOwner class that implemented ResourceOwnerInterface will be registered automatically. If autoconfigure option is disabled user have to add the tag hwi_oauth.resource_owner to the service definition,
• Enhancement: Class ConnectController was split into two smaller ones, Connect\ConnectController & Connect\RegisterController,
• Bugfix: Added OAuth1ResourceOwner & OAuth2ResourceOwner to cover case of implementing custom oauth resource owners,
• Bugfix: Fixed Authorization Header in CleverResourceOwner::doGetRequest,
• Bugfix: Catch also the TransportExceptionInterface in AbstractResourceOwner::getResponseContent() method,
• Bugfix: Current matched Firewall is respected during generation of resource owner check path links,
• Bugfix: Prevent fatal error in OAuthUserProvider::loadUserByOAuthUserResponse() when nickname is not available in OAuth response,
• Bugfix: Use newer version of firebase/php-jwt library,
• Chore: Removed not used Symfony Templating component

Changelog

• Deprecated: configuration parameter firewall_names, firewalls are now computed automatically - all firewalls that have defined oauth authenticator/provider will be collected,
• Added: Ability to automatically refresh expired access tokens (only for derived from GenericOAuth2ResourceOwner resource owners), if option refresh_on_expire set to true,
• Enhancement: Refresh token listener is disabled by default and will only be enabled if at least one resource owner has option refresh_on_expure set to true,
• Enhancement: (@internal) Removed/replaced redundant argument $firewallNames from controllers. If controller class was copied and replaced, adapt list of arguments: In controller use $resourceOwnerMapLocator->getFirewallNames(),
• Bugfix: RefreshTokenListener cannot be lazy. If current firewall is lazy (or anonymous: lazy) then current auth token is often initializing on kernel.response. In this case new access token will not be stored in session. Therefore, the expired token will be refreshed on each request,
• Bugfix: InteractiveLoginEvent will be triggered also for OAuthAuthenticator,
• Maintain: Changed config files from *.xml to *.php (services and routes). Xml routing configs connect.xml, login.xml and redirect.xml are steel present but deprecated. Please use *.php variants in your includes instead.

Details What's Changed

• increase phpstan to level 2 by @dmaicher in #1754
• Define hwi_oauth.connect.confirmation parameter by @franmomu in #1756
• Maintain | Remove Makefile in favour of composer scripts by @stloyd in #1766
• make twig extension lazy by using a Runtime by @dmaicher in #1741
• Remove support for FOSUser bundle by @stloyd in #1732
• bump to phpstan level 3 by @dmaicher in #1770
• Bump minimal PHP version to 7.4 by @XWB in #1774
• Maintain | Adjust codebase to match PHPStan level 5 by @stloyd in #1771
• Use type hints and return types in ResourceOwnerMapInterface by @XWB in #1773
• Rework ResourceOwnerMap to use service locator instead of whole DI container by @stloyd in #1775
• Bugfix | Prevent issue with missing parameter when connect option is not enabled by @stloyd in #1782
• Maintain | Update min. Twig version to work with PHP 8 by @stloyd in #1789
• [BC Break] Rework resource owners to use Symfony Http Client internally by @stloyd in #1681
• BC Break | Make classes final where expected & adjust types to PHP 7.4 by @stloyd in #1778
• Maintain | Update tests to use type & return hints by @stloyd in #1791
• Update Yahoo resource owner to use OAuth2 by @stloyd in #1790
• [2.x] Fix HTTP client definition by @Jean85 in #1792
• Maintain | Fixed php-cs-fixer & phpstan reports by @stloyd in #1801
• Rework Github Actions to be more efficient by @stloyd in #1807
• Update link to LinkedIn by @alexisLefebvre in #1811
• Fix EntityUserProviderTest by @sjerdo in #1822
• Fix parsing OAuth1.0a responses for Twitter by @sjerdo in #1821
• Spotify | Add path for profile picture by @sjerdo in #1819
• Pass content in HTTP POST request on OAuth server by @rmlev in #1826
• Fix code style issue by @sjerdo in #1827
• Maintain | Update compatibility with PHP 8.1 by @stloyd in #1828
• Maintain | Rework CI by @stloyd in #1829
• Maintain | Update PHPStan to version 1.0 by @stloyd in #1830
• Maintain | Add support for Symfony 6 by @stloyd in #1800
• Maintain | Merge branch 1.4 into master one by @stloyd in #1834
• Maintain | Run new security already on Symfony 5.4 by @stloyd in #1837
• Bugfix | Test BC layer for Symfony Security <5.4 by @stloyd in #1839
• Bugfix | Fixed issue when connect configuration is not set but ConnectController was used by @stloyd in #1844
• Reviewed authenticator and made refreshToken method public. by @gassan in #1831
• Maintain | Adjust docs to follow Symfony changes by @stloyd in #1845
• Bugfix | Added missing RememberMeBadge into OAuth passport by @stloyd in #1846
• Force particular methods on internal routes by @stloyd in #1847
• Maintain | Rework bundle structure to match Symfony best practices by @stloyd in #1799
• oauth token of the same class will be created. fix in tests by @gassan in #1849
• Track oauth requests by symfony-profiler by @gassan in #1852
• Allow null User for refreshing oauth token by @gassan in #1855
• Http client for symfony 4.4 by @gassan in #1856
• RFC | Lets switch configs from xml to php by @gassan in #1859
• Review: Removed/replaced redundant parameter $firewallNames in Controllers by @gassan in #1861
• auto refresh oauth2 token on expire by @gassan in #1850
• Maintain | Improved code quality by adding hint & return types by @stloyd in #1863
• Keycloak: default paths mapping for a new created keycloak realm by @gassan in #1858
• Removed option firewall_names by @gassan in #1864
• Maintain | Added new Composer 2.2 config for "allow-plugins" by @stloyd in #1865
• Bugfix: Refresh token listener should not be lazy. by @gassan in #1867
• set resourceOwner services directly without using tag by @dmaicher in #1874
• Bugfix: InteractiveLoginEvent Event will be triggered also for OAuthAuthenticator by @gassan in #1877

New Contributors

• @sjerdo made their first contribution in #1822
• @rmlev made their first contribution in #1826
• @gassan made their first contribution in #1831

Full Changelog: 1.4.5...2.0.0-BETA2

• Deprecated: configuration parameter firewall_names, firewalls are now computed automatically - all firewalls that have defined oauth authenticator/provider will be collected,
• Added: Ability to automatically refresh expired access tokens (only for derived from GenericOAuth2ResourceOwner resource owners), if option refresh_on_expire set to true,
• Enhancement: Refresh token listener is disabled by default and will only be enabled if at least one resource owner has option refresh_on_expure set to true,
• Enhancement: (@internal) Removed/replaced redundant argument $firewallNames from controllers. If controller class was copied and replaced, adapt list of arguments: In controller use $resourceOwnerMapLocator->getFirewallNames(),
• Bugfix: RefreshTokenListener cannot be lazy. If current firewall is lazy (or anonymous: lazy) then current auth token is often initializing on kernel.response. In this case new access token will not be stored in session. Therefore, the expired token will be refreshed on each request,
• Bugfix: InteractiveLoginEvent will be triggered also for OAuthAuthenticator,
• Maintain: Changed config files from *.xml to *.php (services and routes). Xml routing configs connect.xml, login.xml and redirect.xml are steel present but deprecated. Please use *.php variants in your includes instead.

Changelog

• BC Break: Dropped PHP 7.3 support,
• BC Break: Dropped support for Symfony: >=5.1 & <5.4 (still with BC layer included),
• BC Break: OAuthExtension is now a lazy Twig extension using a Runtime,
• BC Break: removed support for FOSUserBundle,
• BC Break: changed process() argument for Form/RegistrationFormHandlerInterface, from Form $form to FormInterface $form,
• BC Break: changed form class name in template Resources/views/Connect/connect_confirm.html.twig from fos_user_registration_register to registration_register,
• BC Break: removed configuration option fosub from oauth_user_provider,
• BC Break: removed configuration options hwi_oauth.fosub, & all related DI parameters,
• BC Break: removed DI parameter hwi_oauth.registration.form.factory in favour of declaring form class name as DI parameter: hwi_oauth.connect.registration_form,
• BC Break: changed ResourceOwnerMapInterface::hasResourceOwnerByName signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerByName signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerByRequest signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerCheckPath signature, update if you use a custom resource owner,
• BC Break: ResourceOwnerMap uses service locator instead of DI container,
• BC Break: Removed abstract services: hwi_oauth.abstract_resource_owner.generic, hwi_oauth.abstract_resource_owner.oauth1 & hwi_oauth.abstract_resource_owner.oauth2,
• BC Break: Removed setName() method from OAuth/ResourceOwnerInterface,
• BC Break: changed __construct() argument for OAuth/ResourceOwner/AbstractResourceOwner, from HttpMethodsClient $httpClient to HttpClientInterface $httpClient,
• BC Break: replaced php-http/httplug-bundle with symfony/http-client
• BC Break: removed hwi_oauth.http configuration,
• BC Break: reworked bundles structure to match Symfony best practices:
  • bundle code moved to: src/,
  • tests moved to: tests/,
  • docs moved from Resources/doc into: docs/,
• BC Break: routes provided by bundle now have methods requirements:
  • hwi_oauth_connect_service: GET & POST,
  • hwi_oauth_connect_registration: GET & POST,
  • hwi_oauth_connect: GET,
  • hwi_oauth_service_redirect: GET,
• Added support for PHP 8.1,
• Added support for Symfony 5.4 & 6.0,

Kudos to "Old" Contributors (random order)

• @stloyd - you can sponsor my work on this bundle 😍
• @dmaicher
• @franmomu
• @XWB
• @Jean85
• @alexisLefebvre

New Contributors

• @sjerdo made their first contribution in #1822
• @rmlev made their first contribution in #1826
• @gassan made their first contribution in #1831

Full Changelog: 1.4.5...2.0.0-BETA1

• BC Break: Dropped PHP 7.3 support,
• BC Break: Dropped support for Symfony: >=5.1 & <5.4,
• BC Break: OAuthExtension is now a lazy Twig extension using a Runtime,
• BC Break: removed support for FOSUserBundle,
• BC Break: changed process() argument for Form/RegistrationFormHandlerInterface, from Form $form to FormInterface $form,
• BC Break: changed form class name in template Resources/views/Connect/connect_confirm.html.twig from fos_user_registration_register to registration_register,
• BC Break: removed configuration option fosub from oauth_user_provider,
• BC Break: removed configuration options hwi_oauth.fosub, & all related DI parameters,
• BC Break: removed DI parameter hwi_oauth.registration.form.factory in favour of declaring form class name as DI parameter: hwi_oauth.connect.registration_form,
• BC Break: changed ResourceOwnerMapInterface::hasResourceOwnerByName signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerByName signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerByRequest signature, update if you use a custom resource owner,
• BC Break: changed ResourceOwnerMapInterface::getResourceOwnerCheckPath signature, update if you use a custom resource owner,
• BC Break: ResourceOwnerMap uses service locator instead of DI container,
• BC Break: Removed abstract services: hwi_oauth.abstract_resource_owner.generic, hwi_oauth.abstract_resource_owner.oauth1 & hwi_oauth.abstract_resource_owner.oauth2,
• BC Break: Removed setName() method from OAuth/ResourceOwnerInterface,
• BC Break: changed __construct() argument for OAuth/ResourceOwner/AbstractResourceOwner, from HttpMethodsClient $httpClient to HttpClientInterface $httpClient,
• BC Break: replaced php-http/httplug-bundle with symfony/http-client
• BC Break: removed hwi_oauth.http configuration,
• BC Break: reworked bundles structure to match Symfony best practices:
  • bundle code moved to: src/,
  • tests moved to: tests/,
  • docs moved from Resources/doc into: docs/,
• BC Break: routes provided by bundle now have methods requirements:
  • hwi_oauth_connect_service: GET & POST,
  • hwi_oauth_connect_registration: GET & POST,
  • hwi_oauth_connect: GET,
  • hwi_oauth_service_redirect: GET,
• Added support for PHP 8.1,
• Added support for Symfony 5.6,

Changelog:

• Bugfix: Fixed BC break by restoring wrongly moved AbstractOAuthToken::getCredentials() method,

• Bugfix: Fixed: BC break by restoring wrongly moved AbstractOAuthToken::getCredentials() method,

• Bugfix: Fixed support for PHP 8.1,
• Bugfix: Fixed support for Symfony 5.4,
• Bugfix: Fixed VkontakteResourceOwner option: api_version to not point to deprecated one,
• Bugfix: RequestStack::getMasterRequest() is deprecated since Symfony 5.3, use RequestStack::getMainRequest() if exists,
• Maintain: Added GenericOAuth1ResourceOwnerTestCase, GenericOAuth2ResourceOwnerTestCase & ResourceOwnerTestCase test case classes for easier unit testing custom resource owners

• Bugfix: remove @final declaration from OAuthFactory & FOSUBUserProvider,
• Maintain: added .gitattributes to reduce amount of code in archives,

• Bugfix: Define missing hwi_oauth.connect.confirmation parameter,
• Bugfix: Added missing success/failure handlers,

• BC Break: dropped Symfony 5.0 support as it is EOL,
• BC Break: dropped PHP 7.2 support as it is EOL,
• BC Break: changed __construct() argument for OAuth/RequestDataStorage/SessionStorage, from SessionInterface $session to RequestStack $requestStack,
• BC Break: all internal classes are "softly" marked as final,
• Added: Symfony 5.1 Security system support,
• Added: Forward compatibility layer for session service deprecation,
• Added: state support for service authentication URL's,
• Added: ability to change the response after HWIOAuthEvents::CONNECT_COMPLETED is fired,
• Added: PHPStan static analyse into CI,
• Fixed: OAuthProvide to properly refresh data inside tokens,
• Fixed: PHP notice in AppleResourceOwner,
• Fixed: use new GitHub API in GitHubResourceOwner,
• Fixed: functional tests with & without FOSUserBundle,
• Fixed: controller don't depend on service container if possible,
• Maintain: removed Wunderlist resource owner,
• Maintain: removed several Symfony BC layers,
• Maintain: removed Prophecy in favour of PHPUnit mocking,

• BC Break: dropped support for Symfony <4.4,
• BC Break: dropped support for Doctrine Bundle <2.0,
• Added PHP 8 support,
• Upgraded Facebook API to v8.0,
• Upgraded Twitch resource owner to incorporate latest Twitch API,
• Fixed: undefined id_token exception in Azure resource owner,
• Docs: changed firewall name to match flex receipt,
• Maintain: moved from Travis CI to Github Actions,

• BC Break: dropped Symfony 4.3 support,
• Added first_name & last_name in AzureResourceOwner,
• Added: support for multiple OAuth2 state parameters,
• Added: Apple resource owner,
• Fixed: updated Azure authorization & access_token urls,
• Fixed: Doctrine persistence deprecation errors,
• Allow modification of the response in FilterUserResponseEvent,

• Added Symfony 5 support,
• Added domain whitelist service to avoid open redirect on target_path,
• Fixed: session service was not injected in LoginController,
• Fixed: missing setContainer call to service configuration for LoginController,
• Fixed: client id and client secret must be set in Auth0ResourceOwner::doGetTokenRequest,
• Fixed: missing client id and client secret in Auth0ResourceOwner,
• Twig dependency on LoginController is now optional,

• Dropped support for PHP 5.6, 7.0 and 7.1,
• Dropped support for FOSUserBundle 1.3,
• Dropped support for Symfony 2.8,
• Minimum Symfony 3 requirement is 3.4,
• Minimum Symfony 4 requirement is 4.3,
• Fixed: WindowsLive Resource Owner token request,
• Fixed: Update Facebook API to v3.1,
• Fixed: Update Linkedin API to v2,
• Fixed: YahooResourceOwner::doGetUserInformationRequest uses wrong arguments,
• Fixed: Symfony deprecation warning in symfony/config,
• Fixed: SensioConnect now uses new API URLs,
• Fixed: Do not add Authorization header if no client_secret is present,
• Fixed: LoginController::connectAction should not fail if no token is available,
• Added: Genius.com resource owner,
• Added: HTTPlug 2.0 support,
• Added: Keycloak resource owner,
• Added: The controller is now available as a service,
• Added: Allow to use HTTP Basic auth for token request,
• [BC break] Class Configuration has been marked final,
• [BC break] Class ConnectController has been marked final,
• [BC break] Class HWIOAuthExtension has been marked final,
• [BC break] Class OAuthExtension has been marked final,
• [BC break] Class SetResourceOwnerServiceNameCompilerPass has been marked final,
• [BC break] Class ConnectController extends AbstractController instead of Controller,
• [BC break] Service hwi_oauth.http_client has been marked private,
• [BC break] Service hwi_oauth.security.oauth_utils has been marked private,
• [BC break] Several service class parameters have been removed,

• Fixed: Vkontakte profile picture & nickname path,
• Fixed: Content-Length header must be a string,
• Fixed: Upgraded GitLab end point to v4,
• Fixed: Resource owner map parameters must be public,
• Fixed: Azure resource owner infos_url should not be empty,
• Fixed: Don't start sessions twice & don't start sessions if already started,
• Fixed: Updated BitBucket docs,
• Added: Further compatibility changes for Symfony 4.1,
• Added: LinkedIn first- & last- names,
• Added: Facebook profile picture

• Fixed: VK requires API version now,
• Fixed: Updated Slack resource owner to use new Slack API methods,
• Fixed: Changing authorization and access token to v2 for LinkedIn,
• Fixed: Fix double call of getUserInformation() in ConnectController,
• Fixed: Fix serialization of AccountNotLinkedException,
• Fixed: Check for grant_rule value IS_AUTHENTICATED_FULLY in DI configuration,
• Fixed: Don't execute OAuthProvider::refreshAccessToken() when there is no refresh token

• BC BREAK: Replaced PHPUnit_Framework_TestCase with PHPUnit\Framework\TestCase in tests,
• Added: Implemented getUserInformation() for Dropbox v2,
• Fixed: Headers passed to httpRequest() method in various resource owners,
• Fixed: Marked some services as public to make code compatible with Symfony 4

• BC BREAK: Fully replaced Buzz library with usage of HTTPlug & Guzzle 6,
• BC BREAK: hwi.http_client config options are remove. HTTP configuration must rely on the HTTPlug client,
• BC BREAK: Template engine other than Twig are no longer supported,
• BC BREAK: Option hwi_oauth.templating_engine was removed,
• Added: Symfony 4 support,
• Added: php-http/httplug-bundle support, to auto-provide needed HTTPlug services and get full Symfony integration,
• Added: hwi.http.client and hwi.http.message_factory config keys to provide your own HTTPlug services,
• Added: HWIOAuthEvents,
• Added: ResourceOwnerInterface::addPaths() method for easier managing paths in resource owners,
• Fixed: Update Facebook API to v2.8,

• Fixed: Bitbucket2 resource owner,
• Fixed: GitHub resource owner documentation,
• Fixed: Don't require any form for the connect feature,
• Fixed: Uncaught exception with custom error page,
• Fixed: php-cs-fixer updated to latest version & run on base code

• Fixed: Prevent uncaught exception when redirecting to invalid route,
• Fixed: Add more details too exception when account was not linked,
• Fixed: Odnoklassinki resource owner,
• Fixed: Office365 resource owner,
• Fixed: StackExchange resource owner,
• Fixed: WeChat resource owner,
• Fixed: WindowsLive resource owner

• Fixed error that could occur with message "302 Header already sent",
• Exclude tests from Composer autoloader

• Fixed: OAuthHelper should fallback to new Request in case of receiving null,
• Fixed: Better FOSUserBundle integration,
• Fixed: Serialization issue in WechatResourceOwner,
• Fixed: Incorrect refresh token in WechatResourceOwner,
• Fixed: Broken TrelloResourceOwner,
• Fixed: Removed dead code in OAuthProvider,
• Fixed: Update Facebook API to v2.7,
• Added: Symfony 3 support,
• Added: Redirect to target_path after successful registration/connection,
• Added: Asana resource owner,
• Added: Bitbucket resource owner,
• Added: Clever resource owner,
• Added: Itembase resource owner,
• Added: Jawbon resource owner,
• Added: Office365 resource owner,
• Added: Wunderlist resource owner,
• Added: Hungarian translation

• Fixed: Request parameters are not copied into new Request on forward,
• Fixed: Fixed scope deprecating message,
• Fixed: Resolved deprecated message in ConnectController,
• Fixed: Removed usage of deprecated code in tests

• Fixed: Change Discogs URL from http to https,
• Fixed: Update Facebook API URLs to not use outdated ones

• Fixed: Remove usage of deprecated Twig function form_enctype & replace with usage of form_start/form_end,
• Fixed: Mark as not fully compatible with Symfony ~3.0,
• Fixed: Multiple firewalls can now have different resource owners,
• Fixed: Wrong URL generated for Safesforce resource owner,
• Added: include_email option into Twitter resource owner,
• Added: Hungarian translation,
• Added: Documentation about FOSUser integration

• [BC break] Added UserResponseInterface#getFirstName() method, also a new default path firstname was added, this path holds the first name of user,
• [BC break] Added UserResponseInterface#getLastName() method, also a new default path lastname was added, this path holds the last name of user,
• [BC break] Added UserResponseInterface::getOAuthToken() & basic implementation in AbstractUserResponse,
• [BC break] GenericOAuth1ResourceOwner::getRequestToken() is now public method (was protected),
• Added: configuration parameter firewall_name (will be removed in next major version) renamed to firewall_names to support multiple firewalls,
• Added: configuration parameter: failed_auth_path which contains route name, on which user will be redirected after failure when connecting accounts (i.e. user denies connection),
• Added: appsecret_proof functionality support to the Facebook resource owner,
• Added: sandbox functionality support to the Salesforce resource owner,
• Added Auth0 resource owner,
• Added Azure resource owner,
• Added BufferApp resource owner,
• Added Deezer resource owner,
• Added Discogs resource owner,
• Added EveOnline resource owner,
• Added Fiware resource owner,
• Added Hubic resource owner,
• Added Paypal resource owner,
• Added Reddit resource owner,
• Added Runkeeper resource owner,
• Added Slack resource owner,
• Added Spotify resource owner,
• Added Soundcloud resource owner,
• Added Strava resource owner,
• Added Toshl resource owner,
• Added Trakt resource owner,
• Added Wechat resource owner,
• Added Wordpress resource owner,
• Added Xing resource owner,
• Added Youtube resource owner,
• Fixed: Revoking tokens for Facebook & Google resource owners,
• Fixed: Instagram allows only GET calls to fetch user details,
• Fixed: ResourceOwnerMap no longer depends on deprecated ContainerAware class,
• Fixed: Wrong usage of json_decode in Mail.ru resource owner,
• Fixed: Transform storage exceptions in OAuth1 resource owners into AuthenticationException
• Fixed: Default scopes & fields for VKontakte resource owner

• Fix: Remove deprecated Twig features
• Fix: Undefined variable in FOSUBUserProvider::refreshUser
• Fix: Restore property accessor for Symfony 2.3

• Fix: Remove BC break for Symfony < 2.5,
• Fix: Compatibility issues with Symfony 2.6+,
• Fix: Deprecated graph URLs for FacebookResourceOwner

• Fix: SessionStorage::save() could throw php error,
• Fix: OAuthToken::isExpired() always returned false,
• Fix: FoursquareResourceOwner, TwitchResourceOwner, SensioConnectResourceOwner not working with bearer header,
• Fix: Don't use deprecated fields in FacebookResourceOwner,
• Fix: FOSUBUserProvider::refreshUser() always returning old user,

• Fix: InstagramResourceOwner regression while getting user details,
• Fix: Add smooth migration for session (de)serialization

• Fix: LinkedinResourceOwner regression while getting user details,
• Fix: OAuth revoke functionality to be available wider,
• Fix: Removed undocumented functionality from SinaWeiboResourceOwner,
• Fix: Always remove default ports from URLs to match OAuth 1.0a, Spec: 9.1.2

• Fix: Instagram OAuth redirect to one url,
• Fix: FOSUBUserProvider should also implement UserProviderInterface,
• Fix: YahooResourceOwner infos_url to use new format,
• Fix: Send authorization via headers instead of URL parameter,
• Fix: GithubResourceOwner revoke method,
• Fix: Add login routing documentation note

• Fix: Incorrect redirect URL when no parameters are set,
• Fix: Add missing parameter prompt for GoogleResourceOwner,
• Fix: WordpressResourceOwner user details API call,
• Fix: PHP Notice when oauth_callback_confirmed was set too false,
• Fix: PHP Fatal when session returns boolean instead of object,
• Fix: Add missing query parameters for FacebookResourceOwner

• Fix: Prevent SessionUnavailableException when returns back from service,
• Fix: EntityUserProvider should implement UserProviderInterface,
• Fix: createdAt property was missing when serializing the OAuthToken,
• Added Italian translations

• Fix: Change Twitter API call to use SSL URL,
• Fix: Problems with options in VkontakteResourceOwner,
• Fix: Problems with OAuth 1.0a token & YahooResourceOwner,
• Fix: Throw exception in FOSUBUserProvider when username is missing
• Added SalesForce resource owner

• [BC break] AccountConnectorInterface::connect() method now requires the first parameter to be instance of Symfony\Component\Security\Core\User\UserInterface
• [BC break] ConnectController::authenticateUser() method now requires the first parameter to be instance of Symfony\Component\HttpFoundation\Request
• [BC break] Removed AbstractResourceOwner::addOptions() method
• [BC break] OAuthUtils::getAuthorizationUrl() & OAuthUtils::getLoginUrl() methods now expect first parameter to be instance of Symfony\Component\HttpFoundation\Request
• [BC break] LinkedIn resource owner now uses OAuth2 approach, visit official web page for details how to migrate: https://developer.linkedin.com/documents/authentication#migration
• [BC break] Dropbox resource owner now uses OAuth2 approach
• Added ability to merge response parts into single path
• Added Bitly resource owner
• Added Box resource owner
• Added Dailymotion resource owner
• Added DeviantArt resource owner
• Added Eventbrite resource owner
• Added Mail.ru resource owner
• Added Sina Weibo resource owner
• Added QQ.com resource owner
• Added Trello resource owner
• Added Wordpress resource owner

• [BC break] Added ResourceOwnerInterface::isCsrfTokenValid() method
• [BC break] Removed OAuth1RequestTokenStorageInterface along with the implementations
• [BC break] AbstractResourceOwner::__construct() now requires RequestDataStorageInterface instance as last argument
• Fix: Yandex resource owner using invalid parameter when requesting user data
• Fix: To prevent unusual content headers response from resource owners should be first threaten as json and only in case of failure threaten as query text
• Fix: Instagram resource owner is not able to receive user data more than once
• Added ability to disable confirmation page when connecting accounts
• Added CSRF protection for OAuth2 providers (turned off by default)
• Added RequestDataStorageInterface along with implementation
• Added Stereomood resource owner

• [BC break] GenericOAuth2ResourceOwner::getAccessToken() now returns an array instead of a string. This array contains the access token and its 'expires_in' value, along with any other parameters returned from the authentication provider
• [BC break] Added OAuthAwareExceptionInterface#setToken(), OAuthAwareExceptionInterface#getRefreshToken(), OAuthAwareExceptionInterface#getRawToken(), OAuthAwareExceptionInterface#getExpiresIn() methods
• [BC break] Renamed AbstractResourceOwner::doGetAccessTokenRequest to doGetTokenRequest
• [BC break] Removed AdvancedPathUserResponse & AdvancedUserResponseInterface
• [BC break] Added UserResponseInterface#getEmail(), UserResponseInterface#getProfilePicture(), UserResponseInterface#getRefreshToken(), UserResponseInterface#getExpiresIn(), UserResponseInterface#setOAuthToken() methods
• [BC break] Removed UserResponseInterface::setAccessToken() method
• [BC break] Removed AbstractUserResponse::getOAuthToken() method because it was ambiguous
• [BC break] PathUserResponse#setPaths() method no longer overwrite default paths
• [BC break] PathUserResponse#getPath() method no longer throws an exception if path not exists
• [BC break] PathUserResponse#getValueForPath() removed second argument from this method, it will not throw exception anymore if response or value is missing, but now will return null instead
• [BC break] Added ResourceOwnerInterface#getOption($name) method
• [BC break] ResourceOwnerInterface#getUserInformation() now must receive array ($accessToken) as first parameter, also added second parameter ($extraParameters) to be consistent along all implementations
• Added OAuthToken::getRefreshToken(), OAuthToken::setRefreshToken(), OAuthToken::getExpiresIn(), OAuthToken::setExpiresIn(), OAuthToken::getRawToken(), OAuthToken::setRawToken()
• Added AbstractResourceOwner#addOptions() & ResourceOwnerInterface#setOption($name, $value) methods which allows easy overwriting resource specific options
• Added support for options: access_type, request_visible_actions, approval_prompt & hd in Google resource owner
• Added 37signals resource owner
• Added Amazon resource owner
• Added Bitbucket resource owner
• Added Disqus resource owner
• Added Dropbox resource owner
• Added Flickr resource owner
• Added Instagram resource owner
• Added Odnoklassniki resource owner
• Added Yandex resource owner

• Fix: use Symfony\Component\Security\Core\User\UserInterface in EntityUserProvider::refreshUser
• Fix: made SessionStorage compatible with Symfony 2.0

• Fix: Regression done in version 0.2.8 blocking usage without FOSUserBundle
• Fix: OAuthUtils::getAuthorizationUrl() ignoring given redirect URL

• Fix: Added missing parts in user providers like: loadUserByUsername() or refreshUser() methods
• Fix: Registering of user provider services
• Fix: Make OAuthUtils::signRequest() compatible with OAuth1.0a specification

• Fix: Polish oauth error detection to cover cases from i.e. Facebook resource owner
• Fix: Changed authorization url for Vkontakte resource owner

• Fix: Use same check for FOSUserBundle compatibility to prevent strange errors with calls of undefined services
• Fix: User-land aliased (resource owner) services have the appropriate name

• Fix: Use user identifier represented as string for Twitter to prevent issues with losing accuracy for large numbers (i.e. Javascript) or type comparison (i.e. MongoDB)
• Fix: Don't depend on arg_separator.output data for URL generation to prevent issues

• Fix: Throw Symfony\Component\Security\Core\Exception\AccessDeniedException & Symfony\Component\HttpKernel\Exception\NotFoundHttpException instead of \Exception to make cases more clear
• Fix: Detect oauth_problem as authorization error and inform user instead logging error in background
• Fix: Request extra parameters should have higher priority than default
• Fix: How urls are build in resource owners
• Fix: Missing parameter in YahooResourceOwner

• Added AbstractUserResponse::getOAuthToken() method to allow fetching only OAuth token details
• Added french translation
• Fix: FB incompatibility with 'error' field in response

• Fix: FOSUB registration form handler
• Fix: Use API 1.1 for Twitter, not the deprecated 1.0

• Fixed issue with FOSUserBundle 2.x integration

• Added support for a target_path_parameter in order to control the redirect path after login
• Added hwi_oauth_authorization_url() twig helper function
• Added Jira resource owner
• Added Yahoo resource owner
• Added setting realm in configuration
• Added support for FOSUserBundle 2.x integration
• Added Stack Exchange resource owner
• Fix: configuration parameter firewall_name is required
• Fix: prevent throwing AlreadyBoundException when using FOSUserBundle 1.x integration
• Fix: check for availability of profilePicture in views before calling it
• Fix: InMemoryProvider now shows user nickname as name instead of unique identifier
• Fix: don't set realm option if is empty in request headers
• Fix: for infinity loop blockade and error token response handling

• [BC break] Renamed path username to identifier to make it more clear that this path should hold the unique user identifier (previously username)
• [BC break] Method UserResponseInterface#getUsername() now always returns a real unique user identifier, and uses path identifier
• [BC break] OAuth1RequestTokenStorageInterface#save() second param $token must now be an array
• [BC break] Configuration type 'generic' is renamed to 'oauth2'
• [BC break] redirect.xml routing has to be imported. See the setup docs
• Added UserResponseInterface#getRealName() method, also a new default path realname was added, this path holds the real name of user
• Added UserResponseInterface#getNickName() method, also a new default path nickname was added, this path holds the nickname of user
• Added UserResponseInterface#getAccessToken() and UserResponseInterface#setAccessToken
• Added OAuthToken#getCredentials() returns an empty string to be consistent with the security component. The access token can still be retrieved from the getAccessToken() method
• Added change that forces all authentication requests are now redirected to the login path
• Added change that makes firewall_name option required setting
• Added OAuth 1.0a support (linkedin/twitter/generic)