• FIX(example): stop corrupting the web conformance POST through cors-proxy. (4eea7cd8)
• FIX(oidc): rethrow platform OidcException from getPlatformEndSessionResponse unwrapped. (ab422b70)
• FIX: await futures returned inside try blocks (unawaited_return_in_try_block). (452d6ee1)
• FIX(example): register the RP's true application_type with the test plan. (1253d9be)
• FEAT(oidc_core): mTLS transport, end-to-end alias routing and web guard (#386). (d3bd7213)
• FEAT(oidc_core): adopt and persist RFC 7592 credential rotation through the manager (#385). (0b6f57c1)
• BREAKING FIX(oidc_core): reject a discovery document whose issuer does not match. (fab65a06)
• BREAKING FEAT(oidc_default_store): bump flutter_secure_storage to ^11 (#451). (166f394e)

• FIX(oidc_core): probe check_session_iframe once more after RP-initiated logout. (c3540c22)
• FIX(oidc_core): require at_hash on the implicit id_token token response. (6cd96cd0)
• FIX(oidc_core): settle userChangesAfterInit from inside init(), not via initFuture (#453). (a349ae98)
• FIX(oidc_core): userChangesAfterInit — single init attachment, closed-controller guards (#453). (e239f8a3)
• FIX: await futures returned inside try blocks (unawaited_return_in_try_block). (452d6ee1)
• FIX(oidc_core): close mTLS phase 2 review gaps (#386). (85bc47c8)
• FIX(oidc_core): don't retain userChangesAfterInit listeners until dispose (#453). (c0d8c48f)
• FIX(oidc_core): require c_hash and at_hash on the hybrid front-channel id_token. (7b3b2ec6)
• FEAT(oidc_core): report the post-logout session check as OidcEndSessionConfirmationEvent. (457e32c5)
• FEAT(oidc_core): mTLS transport, end-to-end alias routing and web guard (#386). (d3bd7213)
• FEAT(oidc_core): adopt and persist RFC 7592 credential rotation through the manager (#385). (0b6f57c1)
• FEAT(oidc_core): add userChangesAfterInit() to tell "not initialized" from "signed out". (29b09f77)
• DOCS(oidc_core): do not present changed as proof the OP logout worked. (333d0a64)
• DOCS(oidc_core): document Azure AD B2C and Entra options for strict issuer validation. (c9ca9cdd)
• DOCS(oidc_core): state the exact DCR carry-over set (#385). (9282adaa)
• DOCS(oidc_core): align DCR dartdoc with manager-driven rotation (#385). (43b3eeba)
• BREAKING FIX(oidc_core): re-verify the restored session when a background discovery refresh is rejected. (80381f47)
• BREAKING FIX(oidc_core): never keep or use a rejected discovery document. (14db08c2)
• BREAKING FIX(oidc_core): reject a discovery document whose issuer does not match. (fab65a06)
• BREAKING FIX(oidc_core): judge id_token hash requiredness from the response's own tokens (#466). (88d922b6)
• BREAKING FEAT(oidc_core): OidcIdTokenValidationContext for flow-aware id_token validation. (d5538e50)

Note: This release has breaking changes.

• FIX(example): keep the front-channel logout URI off Uri.base on native. (be8a8968)
• FIX(example): serve the web RP at a conformant https origin. (e62500b0)
• FIX(example): size the web per-test cap to the workload, not the reverse. (932fb6ca)
• FIX(example): web loses Hybrid/Implicit to a timeout budget, not a fragment bug. (624a502e)
• FIX(example): gate Dynamic RP, which needs an RP-hosted request_uri. (dda2caea)
• FIX(example): gate the logout profiles the suite cannot run, and count logouts. (bfa48dbd)
• FIX(example): let the suite supply Dynamic RP's module variant. (05b0c847)
• FIX(example): resolve WebFinger after setup, and dump the plan on a 500. (3406f070)
• FIX(oidc_android): forward Map-valued raw intent extras instead of dropping them. (7ffda6a7)
• FEAT(oidc_core): manager-level dynamic client registration (RFC 7591). (fe4b4c4e)
• FEAT(oidc_core): implement WebFinger issuer discovery (OIDC Discovery §2, RFC 7033). (213657b8)
• FEAT(oidc_core,oidc_web_core): bound the interactive web flow with flowTimeoutSeconds. (7282efa0)
• BREAKING FIX(oidc_core): the REGISTERED token_endpoint_auth_method wins over the caller's. (262bdfd4)
• BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)

Note: This release has breaking changes.

• BREAKING FIX(oidc_android): restore the redirect receiver as a fallback capture path (#418) (#419). (8df8bc61)

Note: This release has breaking changes.

• FEAT(oidc_web_core): status-driven redirect.html + app-ack wire (#116, #227, #256) (#397). (3ea11929)
• FEAT(oidc_core): emit OidcTokenRefreshFailedEvent on refresh failures; clamp the expiring-refire loop (#392). (0b581dff)
• BREAKING FEAT(oidc_core): cache-first init as the new default, discovery TTL cache, loaded-token validity controls (#399). (de3e2287)

Note: This release has breaking changes.

• FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
• FIX(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. (482f0186)
• FIX(example): add patrol RunnerUITests UI-testing target for iOS. (21b740f6)
• FIX(example): wrap patrol conformance placeholder with SharedValue.wrapApp. (831df91c)
• FIX(example): use FlutterFragmentActivity for Auth Tab (ComponentActivity). (e6e9be47)
• FIX: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. (3b8ef447)
• FIX(spm,native): SwiftPM layout migration + conformance fixes; fix Android build. (47f7bd25)
• FIX(native): harden iOS threading, simplify Android redirect to one-line setup. (a7553f32)
• FIX: handle refresh responses without id_token. (4af363be)
• FEAT(observability): native browser events via the existing OidcEvent stream (Phase 3). (91d1f5bd)
• BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)
• BREAKING FEAT(oidc_core): remove the strictJwtVerification fail-open opt-out. (ee2146f9)
• BREAKING FEAT(oidc_android): switch to Auth Tab only, remove Custom Tabs path. (05bf0181)
• BREAKING FEAT(oidc_android): add flowTimeoutSeconds to fix headless CI hang. (01c844f5)
• BREAKING FEAT: merge oidc_ios + oidc_macos into a unified oidc_darwin plugin. (db73858e)
• BREAKING FEAT(options): redesign native options API (v1 clean break, no AppAuth framing). (a78954fe)
• BREAKING FEAT(oidc_macos): first-party ASWebAuthenticationSession; drop flutter_appauth. (dc13f411)
• BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
• BREAKING CHORE: v1 dependency upgrade + drop the pigeon global-tool wrapper. (45b62a3e)

Note: This release has breaking changes.

• FEAT: improve offline mode integration tests with app startup handling. (18a586c9)
• FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
• FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
• BREAKING FEAT(oidc_default_store): use flutter_secure_storage. (a9441511)
• BREAKING FEAT: Add offline mode events and error handling. (7479fd15)

Note: This release has breaking changes.

• FEAT: add OIDC conformance test suite with API client and test runner. (a651a7d8)
• BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
• BREAKING FIX: migrate to simple_secure_storage (#270). (723560a7)
• BREAKING FEAT: Support WASM (#253). (8b2931ef)

• TESTS: Added integration tests to run the official oidc conformance suite, this pumps our test coverage from 22% to almost 45%, effectively doubling it!

  • Tests are run on ALL platforms (linux, macos, windows, android, ios, web).
  • Tests check the authorization code flow only for now.
  • BREAKING FEAT: Support for multiple OidcUserManager instances, by adding the id field to differentiate them.
    • See docs entry
  • FEAT: Updated the example app to use the new OidcUserManager.id, with the ability to add your own custom managers in the UI.

  [!IMPORTANT] We have also officially submitted our package to the openid foundation for certification.

Note: This release has breaking changes.

• BREAKING FEAT: support hooks (#228). (f2d9d9c6)

Note: This release has breaking changes.

• REFACTOR: minor lints and refactors. (5ab9af70)
• BREAKING CHORE(deps): upgrade flutter_appauth to v9.0.0 (#199). (f027af34)

Note: This release has breaking changes.

• FIX: oidc not passing options properly. (b2fdf5fe)
• FEAT: support offline auth. (cced6013)
• DOCS: update changelogs. (b0ffeb43)
• BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

Note: This release has breaking changes.

• BREAKING DEPS: update min flutter version to 3.22.0 and min dart version to 3.4.0

• FEAT: WASM support

• BREAKING REFACTOR: moved all the non-flutter code in OidcUserManager to the oidc_core package as OidcUserManagerBase.

  • This means that you will have to add import 'package:oidc_core/oidc_core.dart' in addition to the usual package:oidc import.

• FIX: improve OidcEndpoints error handling.

• FIX: options passed in OidcUserManagerSettings were not getting used in implicit auth and logout.

• FEAT: support offline auth via the setting OidcUserManagerSettings.supportOfflineAuth (false by default).

  • This will keep the user logged in even if the app can't contact the server.

  Note: While offline auth is convenient for users with unstable internet, it has a security risk, due to not being able to contact the IdP to refresh the token or get user info.

• FEAT: add getIdToken to OidcUserManagerSettings.

  • This is useful for OAuth IdPs, As it allows the developer to make OidcUserManager use the access token as an id token for example.

• FEAT: fixed some UI logic in the example.

• FIX: Opening in new tab not working reliably in Safari for iOS #31.

• FEAT: introduced a new dart package oidc_web_core which exposes OidcUserManagerWeb and OidcWebStore. They can be used in dart web apps (like ngdart). And also support WASM.

• DOCS: updated the docs website with new entries to the added features.

• BREAKING CHANGE: separated session management settings into its own class, in OidcUserManagerSettings.sessionManagementSettings and disabled it by default.

Migration Guide

before:

OidcUserManagerSettings(
    sessionStatusCheckInterval: //...
    sessionStatusCheckStopIfErrorReceived: //...
)

after:

OidcUserManagerSettings(
    sessionManagementSettings: OidcSessionManagementSettings(
        enabled: true, // false by default.
        interval: //...
        stopIfErrorReceived: //...
    )
)

• FIX: mac os and ios.
• FEAT: added device authorization endpoint.

• Update a dependency to the latest release.

• FEAT: add response form userInfo endpoint to the user object.

• Update a dependency to the latest release.

Note: This release has breaking changes.

• BREAKING CHANGE: all packages.

• Update a dependency to the latest release.