• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

• FIX(example): keep the front-channel logout URI off Uri.base on native. (be8a8968)
• FIX(example): serve the web RP at a conformant https origin. (e62500b0)
• FIX(example): size the web per-test cap to the workload, not the reverse. (932fb6ca)
• FIX(example): web loses Hybrid/Implicit to a timeout budget, not a fragment bug. (624a502e)
• FIX(example): gate Dynamic RP, which needs an RP-hosted request_uri. (dda2caea)
• FIX(example): gate the logout profiles the suite cannot run, and count logouts. (bfa48dbd)
• FIX(example): let the suite supply Dynamic RP's module variant. (05b0c847)
• FIX(example): resolve WebFinger after setup, and dump the plan on a 500. (3406f070)
• FIX(oidc_android): forward Map-valued raw intent extras instead of dropping them. (7ffda6a7)
• FEAT(oidc_core): manager-level dynamic client registration (RFC 7591). (fe4b4c4e)
• FEAT(oidc_core): implement WebFinger issuer discovery (OIDC Discovery §2, RFC 7033). (213657b8)
• FEAT(oidc_core,oidc_web_core): bound the interactive web flow with flowTimeoutSeconds. (7282efa0)
• BREAKING FIX(oidc_core): the REGISTERED token_endpoint_auth_method wins over the caller's. (262bdfd4)
• BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)

Note: This release has breaking changes.

• FIX(example): keep the front-channel logout URI off Uri.base on native. (be8a8968)
• FIX(example): serve the web RP at a conformant https origin. (e62500b0)
• FIX(example): size the web per-test cap to the workload, not the reverse. (932fb6ca)
• FIX(example): web loses Hybrid/Implicit to a timeout budget, not a fragment bug. (624a502e)
• FIX(example): gate Dynamic RP, which needs an RP-hosted request_uri. (dda2caea)
• FIX(example): gate the logout profiles the suite cannot run, and count logouts. (bfa48dbd)
• FIX(example): let the suite supply Dynamic RP's module variant. (05b0c847)
• FIX(example): resolve WebFinger after setup, and dump the plan on a 500. (3406f070)
• FIX(oidc_android): forward Map-valued raw intent extras instead of dropping them. (7ffda6a7)
• FEAT(oidc_core): manager-level dynamic client registration (RFC 7591). (fe4b4c4e)
• FEAT(oidc_core): implement WebFinger issuer discovery (OIDC Discovery §2, RFC 7033). (213657b8)
• FEAT(oidc_core,oidc_web_core): bound the interactive web flow with flowTimeoutSeconds. (7282efa0)
• BREAKING FIX(oidc_core): the REGISTERED token_endpoint_auth_method wins over the caller's. (262bdfd4)
• BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)

• Update a dependency to the latest release.

• FIX(oidc_web_core): surface the flow timeout as OidcException, not TimeoutException. (be6a5316)
• FIX(oidc_android): forward Map-valued raw intent extras instead of dropping them. (7ffda6a7)
• FIX(oidc_android): dismiss the Custom Tab after the intent-filter redirect. (34a83693)
• DOCS(test): state the wiring guard's single-layer scope. (e25e04b8)
• BREAKING FIX(oidc_android): report the options the Auth Tab path cannot apply. (8b7226ce)
• BREAKING FIX(oidc_android): apply the documented Custom Tabs options natively. (9e83a10b)

Note: This release has breaking changes.

• BREAKING FIX(oidc_android): restore the redirect receiver as a fallback capture path (#418) (#419). (8df8bc61)

• BREAKING FIX(oidc_android): restore the redirect receiver as a fallback capture path (#418) (#419). (8df8bc61)

Note: This release has breaking changes.

• FEAT(oidc_web_core): status-driven redirect.html + app-ack wire (#116, #227, #256) (#397). (3ea11929)
• FEAT(oidc_core): emit OidcTokenRefreshFailedEvent on refresh failures; clamp the expiring-refire loop (#392). (0b581dff)
• BREAKING FEAT(oidc_core): cache-first init as the new default, discovery TTL cache, loaded-token validity controls (#399). (de3e2287)

• FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
• FIX(crypto_keys_plus): resolve pub.dev publish dry-run warnings. (5bee9a89)
• FEAT(crypto): RSASSA-PSS (PS256/384/512) + EdDSA/Ed25519. (6c5c6741)
• BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)

Note: This release has breaking changes.

• FIX: resolve all four library bugs; drive honest unit coverage to ~95% (#368). (c86bee17)
• FIX(oidc_darwin): implement flowTimeoutSeconds for the Apple ASWebAuthenticationSession flow. (482f0186)
• FIX(example): add patrol RunnerUITests UI-testing target for iOS. (21b740f6)
• FIX(example): wrap patrol conformance placeholder with SharedValue.wrapApp. (831df91c)
• FIX(example): use FlutterFragmentActivity for Auth Tab (ComponentActivity). (e6e9be47)
• FIX: pre-v1 correctness — certification claim, license, Android queries, honest native option docs. (3b8ef447)
• FIX(spm,native): SwiftPM layout migration + conformance fixes; fix Android build. (47f7bd25)
• FIX(native): harden iOS threading, simplify Android redirect to one-line setup. (a7553f32)
• FIX: handle refresh responses without id_token. (4af363be)
• FEAT(observability): native browser events via the existing OidcEvent stream (Phase 3). (91d1f5bd)
• BREAKING REFACTOR: remove rxdart; adopt bdaya_shared_value ^5.0.0. (0d65d7fd)
• BREAKING FEAT(oidc_core): remove the strictJwtVerification fail-open opt-out. (ee2146f9)
• BREAKING FEAT(oidc_android): switch to Auth Tab only, remove Custom Tabs path. (05bf0181)
• BREAKING FEAT(oidc_android): add flowTimeoutSeconds to fix headless CI hang. (01c844f5)
• BREAKING FEAT: merge oidc_ios + oidc_macos into a unified oidc_darwin plugin. (db73858e)
• BREAKING FEAT(options): redesign native options API (v1 clean break, no AppAuth framing). (a78954fe)
• BREAKING FEAT(oidc_macos): first-party ASWebAuthenticationSession; drop flutter_appauth. (dc13f411)
• BREAKING FEAT: consolidate jose_plus, crypto_keys_plus, x509_plus into the workspace. (3fffc6cd)
• BREAKING CHORE: v1 dependency upgrade + drop the pigeon global-tool wrapper. (45b62a3e)

• FEAT: improve offline mode integration tests with app startup handling. (18a586c9)
• FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
• FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
• BREAKING FEAT(oidc_default_store): use flutter_secure_storage. (a9441511)
• BREAKING FEAT: Add offline mode events and error handling. (7479fd15)

Note: This release has breaking changes.

• FEAT: improve offline mode integration tests with app startup handling. (18a586c9)
• FEAT: update dependencies and enhance offline mode test handling. (a57d6490)
• FEAT: enhance offline mode handling in tests and user manager. (e0cae79a)
• BREAKING FEAT(oidc_default_store): use flutter_secure_storage. (a9441511)
• BREAKING FEAT: Add offline mode events and error handling. (7479fd15)

• DOCS: remove logo branding from screenshots. (2acf65d3)

• FEAT: add OIDC conformance test suite with API client and test runner. (a651a7d8)
• BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
• BREAKING FIX: migrate to simple_secure_storage (#270). (723560a7)
• BREAKING FEAT: Support WASM (#253). (8b2931ef)

Note: This release has breaking changes.

• FEAT: add OIDC conformance test suite with API client and test runner. (a651a7d8)
• BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
• BREAKING FIX: migrate to simple_secure_storage (#270). (723560a7)
• BREAKING FEAT: Support WASM (#253). (8b2931ef)

• FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)

• Update a dependency to the latest release.

• DOCS: Add openid certification mark (#240). (89313199)

• FEAT: Enhance OIDC store with manager ID support. (56f42f2d)

• TESTS: Added integration tests to run the official oidc conformance suite, this pumps our test coverage from 22% to almost 45%, effectively doubling it!

  • Tests are run on ALL platforms (linux, macos, windows, android, ios, web).
  • Tests check the authorization code flow only for now.
  • BREAKING FEAT: Support for multiple OidcUserManager instances, by adding the id field to differentiate them.
    • See docs entry
  • FEAT: Updated the example app to use the new OidcUserManager.id, with the ability to add your own custom managers in the UI.

  [!IMPORTANT] We have also officially submitted our package to the openid foundation for certification.

• BREAKING FEAT: support hooks (#228). (f2d9d9c6)

Note: This release has breaking changes.

• BREAKING FEAT: support hooks (#228). (f2d9d9c6)

• REFACTOR: minor lints and refactors. (5ab9af70)
• BREAKING CHORE(deps): upgrade flutter_appauth to v9.0.0 (#199). (f027af34)

Note: This release has breaking changes.

• REFACTOR: minor lints and refactors. (5ab9af70)
• BREAKING CHORE(deps): upgrade flutter_appauth to v9.0.0 (#199). (f027af34)

• FIX: oidc not passing options properly. (b2fdf5fe)
• FEAT: support offline auth. (cced6013)
• DOCS: update changelogs. (b0ffeb43)
• BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

Note: This release has breaking changes.

• FIX: oidc not passing options properly. (b2fdf5fe)
• FEAT: support offline auth. (cced6013)
• DOCS: update changelogs. (b0ffeb43)
• BREAKING FIX: Opening in new tab not working reliably in Safari for iOS #31. (2e30028b)

• Update a dependency to the latest release.

• Update a dependency to the latest release.

• Update a dependency to the latest release.

• BREAKING FEAT: Support WASM (#253). (8b2931ef)

Note: This release has breaking changes.

• BREAKING DEPS: update min flutter version to 3.22.0 and min dart version to 3.4.0

• FEAT: WASM support

• BREAKING REFACTOR: moved all the non-flutter code in OidcUserManager to the oidc_core package as OidcUserManagerBase.

  • This means that you will have to add import 'package:oidc_core/oidc_core.dart' in addition to the usual package:oidc import.

• FIX: improve OidcEndpoints error handling.

• FIX: options passed in OidcUserManagerSettings were not getting used in implicit auth and logout.

• FEAT: support offline auth via the setting OidcUserManagerSettings.supportOfflineAuth (false by default).

  • This will keep the user logged in even if the app can't contact the server.

  Note: While offline auth is convenient for users with unstable internet, it has a security risk, due to not being able to contact the IdP to refresh the token or get user info.

• FEAT: add getIdToken to OidcUserManagerSettings.

  • This is useful for OAuth IdPs, As it allows the developer to make OidcUserManager use the access token as an id token for example.

• FEAT: fixed some UI logic in the example.

• FIX: Opening in new tab not working reliably in Safari for iOS #31.

• FEAT: introduced a new dart package oidc_web_core which exposes OidcUserManagerWeb and OidcWebStore. They can be used in dart web apps (like ngdart). And also support WASM.

• DOCS: updated the docs website with new entries to the added features.

• FEAT: Use package:clock to get the current time instead of DateTime.now() to simplify testing.
• FIX: Attempt to refresh expired tokens on initialization instead of throwing them away.
  • Now your users will have to login less.
  • This works only when there is a refresh token available.
  • Doesn't work with silent authorization (e.g. implicit auth and prompt: none).
• DOCS: Updated docs and example.
• DEPS: Use jose_plus: ^0.4.4 which uses package:clock as well for JWT validation.

• FEAT: Support overriding the discovery document.
• FEAT: added events stream to OidcUserManager.

• BREAKING FIX: hasInit is set to true too early in init() of OidcUserManagerBase (#275). (d704aa5f)
• BREAKING FIX: migrate to simple_secure_storage (#270). (723560a7)
• BREAKING FEAT: Support WASM (#253). (8b2931ef)

• BREAKING CHANGE: separated session management settings into its own class, in OidcUserManagerSettings.sessionManagementSettings and disabled it by default.

Migration Guide

before:

OidcUserManagerSettings(
    sessionStatusCheckInterval: //...
    sessionStatusCheckStopIfErrorReceived: //...
)

after:

OidcUserManagerSettings(
    sessionManagementSettings: OidcSessionManagementSettings(
        enabled: true, // false by default.
        interval: //...
        stopIfErrorReceived: //...
    )
)

• DOCS: added sessionManagementSettings to the wiki.
• DOCS: add how to use accesstoken to the wiki.

• FEAT: add refreshToken() to OidcUserManager.

• FIX: incorrect state handling.
• FEAT: improve userInfo handling by adding userInfoSettings to OidcUserManagerSettings.

• FEAT: update changelogs to reflect breaking changes and new features for multiple OIDC platforms. (4caca121)

Change Log

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

2025-06-12

Changes

Packages with breaking changes:

• oidc_linux - v0.4.0

Packages with other changes:

• oidc - v0.12.0
• oidc_core - v0.14.0
• oidc_default_store - v0.4.0
• oidc_desktop - v0.6.0
• oidc_web_core - v0.3.1
• oidc_android - v0.7.0+2
• oidc_flutter_appauth - v0.6.0+2
• oidc_ios - v0.7.0+2
• oidc_macos - v0.7.0+2
• oidc_platform_interface - v0.6.0+6
• oidc_web - v0.6.0+6
• oidc_windows - v0.3.1+11

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• oidc_android - v0.7.0+2
• oidc_flutter_appauth - v0.6.0+2
• oidc_ios - v0.7.0+2
• oidc_macos - v0.7.0+2
• oidc_platform_interface - v0.6.0+6
• oidc_web - v0.6.0+6
• oidc_windows - v0.3.1+11

• FIX: mac os and ios.
• FEAT: added device authorization endpoint.

• BREAKING FEAT: Support WASM (#253). (8b2931ef)

• FIX(oidc_web_core): use isA() for JS interop checks. (724c9a2a)

2025-10-10

Changes

Packages with breaking changes:

• oidc - v0.13.0
• oidc_android - v0.8.0
• oidc_core - v0.15.0
• oidc_default_store - v0.5.0
• oidc_desktop - v0.7.0
• oidc_flutter_appauth - v0.7.0
• oidc_ios - v0.8.0
• oidc_linux - v0.5.0
• oidc_loopback_listener - v0.3.0
• oidc_macos - v0.8.0
• oidc_platform_interface - v0.7.0
• oidc_web - v0.7.0
• oidc_web_core - v0.4.0
• oidc_windows - v0.4.0

Packages with other changes:

• There are no other changes in this release.

• Update a dependency to the latest release.

• DOCS: fix PKCE link.

• FEAT: Enhance OIDC store with manager ID support. (56f42f2d)

Change Log

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

2025-06-06

Changes

Packages with breaking changes:

• oidc - v0.11.0
• oidc_core - v0.13.0
• oidc_default_store - v0.3.0

Packages with other changes:

• oidc_web_core - v0.3.0+5
• oidc_desktop - v0.5.0+5
• oidc_ios - v0.7.0+1
• oidc_platform_interface - v0.6.0+5
• oidc_macos - v0.7.0+1
• oidc_android - v0.7.0+1
• oidc_web - v0.6.0+5
• oidc_linux - v0.3.0+16
• oidc_flutter_appauth - v0.6.0+1
• oidc_windows - v0.3.1+10

Packages with dependency updates only:

Packages listed below depend on other packages in this workspace that have had changes. Their versions have been incremented to bump the minimum dependency versions of the packages they depend upon in this project.

• oidc_web_core - v0.3.0+5
• oidc_desktop - v0.5.0+5
• oidc_ios - v0.7.0+1
• oidc_platform_interface - v0.6.0+5
• oidc_macos - v0.7.0+1
• oidc_android - v0.7.0+1
• oidc_web - v0.6.0+5
• oidc_linux - v0.3.0+16
• oidc_flutter_appauth - v0.6.0+1
• oidc_windows - v0.3.1+10

• FEAT: add response form userInfo endpoint to the user object.

• BREAKING FEAT: Support WASM (#253). (8b2931ef)

Note: This release has breaking changes.

• BREAKING CHANGE: all packages.

• DOCS: remove logo branding from screenshots. (2acf65d3)

• Update a dependency to the latest release.

• FEAT: support logout.

• FEAT: initial version.

• DOCS: Add openid certification mark (#240). (89313199)

• Update a dependency to the latest release.

• FEAT: added more helpers.