commit 61a22e921e054ba0d7481f17937efbedbdc4bf81
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sat Nov 14 16:51:27 2026 -0500
Update changelog for 3.21.0-2 release
commit 699e62b884f0d83c88b039b7b4d15b5a160eb2b5
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sat Nov 14 16:41:47 2026 -0500
drop unneeded patches
commit 91ae9a48df841bc99266c8dcaafbaeb9c0a555df
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sat Nov 14 21:36:04 2026 +0000
debian/control: bump Standards-Version to 4.7.4 (no changes needed)
commit 017ad4c9135962d87197d0105f98f1380e7caabf
Author: Reinhard Tartler <siretart@tauware.de>
Date: Sat Nov 14 21:31:49 2026 +0000
debian: switch to standard Salsa CI pipeline
commit ae5774800fddf3b9fca816a27ed636610a6a6d75
Merge: e62fd33 f55898a
Author: Reinhard Tartler <siretart@debian.org>
Date: Sat Nov 14 21:28:10 2026 +0000
Merge branch 'go-jose-v4' into 'debian/sid'
New upstream 3.21.0, move to go-jose v4
See merge request go-team/packages/golang-github-coreos-go-oidc-v3!2
commit f55898a4d16ae5061079e8e3aa9885f7458e7dd6
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Fri Nov 13 00:29:38 2026 +0100
Move to go-jose v4 with upstream 3.21.0
Upstream switched from square/go-jose.v2 to go-jose/v4 and no longer
imports golang.org/x/net. square/go-jose.v2 is not meant for forky
(#1152786).
commit a1f1751c60147f4593321b80e00034882e9b2ca4
Merge: e62fd33 06d770f
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Nov 14 20:49:32 2026 +0100
Update upstream source from tag 'upstream/3.21.0'
Update to upstream version '3.21.0'
with Debian dir 93992639728247aa24d08df97b8e685f8874e8b1
commit 06d770f174108775ce880935c55eaf94553f9d3f
Merge: cb32bf0 c914bd3
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date: Sat Nov 14 20:49:32 2026 +0100
New upstream version 3.21.0
commit c914bd380327a5a3a81403774d1a5d5b73772ce7
Author: Nicolas BRAINEZ <nicolas.brainez@ext.ec.europa.eu>
Date: Tue Sep 1 11:34:17 2026 +0200
oidc: ignore JWKs with unsupported key types rather than failing
Fixes https://github.com/coreos/go-oidc/issues/498
commit 75dfa5c0626c48e0ad8b761fdd9e1dc51cb8498a
Author: Eric Chiang <eric@oblique.security>
Date: Wed Jul 8 11:16:38 2026 -0700
oidc: add constants for "email" and "profile" scopes
I've intentionally left out "address" and "phone" since they seem
extremely dated compared to modern privacy practices. We shouldn't
encourage their use.
Fixes https://github.com/coreos/go-oidc/issues/385
Fixes https://github.com/coreos/go-oidc/pull/387
commit a89f0468ccc8e531b54f469053674a12c2258c72
Author: Eric Chiang <eric@oblique.security>
Date: Wed Jul 8 10:56:22 2026 -0700
oidc: add API for determining when issuer URLs mismatch
Fixes https://github.com/coreos/go-oidc/issues/471
Fixes https://github.com/coreos/go-oidc/pull/481
commit 6a69b6d27e137b9919e468417e438b02c51a54b2
Author: Eric Chiang <eric@oblique.security>
Date: Wed Jul 8 10:41:27 2026 -0700
readme: update README and docs
This change rewrites the readme and go docs to try to do a better job of
examplining what OpenID Connect is, and how to get started with the
package.
commit f9049c99079786740d492714fb33b671464312dd
Author: Eric Chiang <eric@oblique.security>
Date: Tue Jul 7 14:29:34 2026 -0700
oidc: ignore JWKs with unknown signing algorithms rather than failing
Fixes https://github.com/coreos/go-oidc/issues/490
commit 2f178e0a9df71f65464a9a8d25c388e798303323
Author: Eric Chiang <eric@oblique.security>
Date: Mon Jul 6 10:32:32 2026 -0700
SECURITY.md: add a security policy and point to project-level reporting
It doesn't make sense to contact RedHat security directly unless the
issue is in a RedHat product.
commit b3bc7daa5743acd0b6c604ad7e5c9b609b6d39f4
Author: Eric Chiang <eric@oblique.security>
Date: Thu Jun 18 10:00:47 2026 -0700
oidc: improve documentation for APIs
There are a number of open issues and PRs that can be already be served
by existing APIs. Specifically, anyone can parse the discovery document
from the Provider to support axillary specs.
Update the documentation to hopefully make the Provider.Claims API more
visiable. The logout example also uses this method.
Fixes https://github.com/coreos/go-oidc/issues/458
Fixes https://github.com/coreos/go-oidc/issues/424
Fixes https://github.com/coreos/go-oidc/pull/226
Fixes https://github.com/coreos/go-oidc/issues/409
commit 0db90530b3f5ab1808b26365441e366926b86f0b
Author: Eric Chiang <eric@oblique.security>
Date: Thu Jun 18 09:03:29 2026 -0700
oidc: modernize with new Go APIs
Run `go fix` then do a few more fixes by hand.
commit 4204f0b2b0f903070de5f51a459fe5e23faca113
Author: Eric Chiang <eric@oblique.security>
Date: Wed Jun 17 13:43:16 2026 -0700
oidc: add support for validating back-channel logout tokens
This PR adds support for OpenID Connect Back-Channel Logout, where a
relying party can receive a POST request from an identity provider
indicating a user's sessions should be revoked.
Because so much of this logic replicates the ID Token claims checks, the
API has been added to the existing IDTokenVerifier with a new
VerifyLogout method to go with the existing Verify method.
A full example app that has been tested against Auth0's Back-Channel
logout support is added to examples.
https://openid.net/specs/openid-connect-backchannel-1_0.html
commit f77e01c50994c6ad4f4c3a6ed3e2380bab1f1ff2
Author: Yannick Müller <mail@ynnk.dev>
Date: Mon Jun 15 20:31:50 2026 +0200
fix: Key refresh should set no-cache to get most up to date keys
commit da6b3bfca8af72414ee0e6e8746585ff5d206003
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed Apr 8 03:19:38 2026 +0000
build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)
---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
dependency-version: 4.1.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
commit 7f80694215d5eb5b28f851f35845439b1e1e9e5d
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed Apr 8 03:17:06 2026 +0000
build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.28.0 to 0.36.0.
- [Commits](https://github.com/golang/oauth2/compare/v0.28.0...v0.36.0)
---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
dependency-version: 0.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
commit 7271de57587bb756318f9819796ba846b1ba875a
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Apr 7 20:14:42 2026 -0700
.github: update go versions in CI
commit 3ccf20fdc4afab7c64881a108d6f4c17a4ecc24d
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Apr 7 20:10:45 2026 -0700
.github: configure dependabot
commit 35b8e031bcac7fed73b96b09d42e6e233a6e6562
Author: Eric Chiang <eric@oblique.security>
Date: Thu Nov 20 19:31:02 2025 -0800
oidc: improve error message for mismatched issuer URLs
Fixes #468
commit e62fd33d6dd8269d0a7d88f2347087f143fddd0b
Author: Richard Hansen <rhansen@rhansen.org>
Date: Tue Oct 7 20:06:53 2025 -0400
Fix golang.org/x/oauth2 dependency
The golang-golang-x-oauth2 source package builds two binary packages,
and dh-make-golang isn't smart enough to figure out which of the two
is associated with the source package's XS-Go-Import-Path field. It
apparently picks the last one declared, which in this case is the
wrong package.
commit e9584733f8bb6c4683d1e98b4fb22eee121f7dff
Author: Edward Viaene <ward@in4it.io>
Date: Fri Oct 3 14:25:41 2025 -0500
bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove x/net dependency
commit 69b167061fdb7270ef965f150ea6aabe11678728
Author: Aleksandr Ponimaskin <aleksandr.ponimaskin@zalando.de>
Date: Fri Aug 8 16:13:02 2025 +0200
refactor: Remove unused time injection from RemoteKeySet
Remove the time injection parameter and now function field from RemoteKeySet
as they were not being used in the codebase. This simplifies the constructor
signature and reduces unnecessary complexity in the JWKS key set implementation.
The time package import was also removed as it's no longer needed.
commit 8d1e57e7e7fb4db0bac61cc200d43846ba071977
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Jul 29 21:41:53 2025 -0700
oidc: verify the ID Token's signature before processing claims
This change updates the verification logic of this library to first
validate the ID Token instead of parsing claims. This hopefully makes it
harder for a malicious client to provide an invalid token for validation
that's crafted to cause this package to over-allocate memory. See the
associated bug and CVE-2025-27144.
Fixes https://github.com/coreos/go-oidc/pull/463
commit a7c457eacb849c163a496b29274242474a8f44ab
Author: Eric Chiang <eric@obliquesecurity.com>
Date: Thu Apr 3 14:22:44 2025 -0700
oidctest: fix import
commit aba1ce200a9dd76b14bbb455d4e5aea55e97cbb3
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Wed Aug 31 20:16:13 2022 -0700
oidc/oidctest: add new package
commit 60d436e8ea63774802ad6a0955f0c386edfefa8b
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Wed Mar 12 23:02:34 2025 -0700
*: bump dependency versions
commit 4b5f82d880aeabd881766d2d91bee8086d9a3b92
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Fri Jan 3 20:44:20 2025 -0800
oidc: add JSON tags to ProviderConfig
This PR adds JSON tags to allow parsing a ProviderConfig directly from
the OpenID Connect JSON metadata document. Since this is the preferred
workaround for providers that don't support discovery in a
spec-compliant way, such as returning the wrong issuer, or requiring a
URL parameter, make this path easier and add an example to the godoc.
Updates #445
Updates #444
Updates #439
Updates #442
Updates #344
Fixes #290
commit 0fe98873951208147e6d412602432038c91cda54
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Mon Jul 8 17:07:48 2024 +0000
oidc: ignore cancellation of remote key set context
This has largely caused confusion. Detach the context from its parent
and just use as a bag-of-values for configuration.
commit 308e77871b5cfc53d1bd20cf7335fc56bdcc78f2
Author: Christophe Lambin <christophe.lambin@gmail.com>
Date: Sun Jul 7 12:51:53 2024 +0200
chore(deps): bump dependencies to address security issues
commit 6b94bec0d3f54b3546c663f6c1f4dd2620bf5d49
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Wed May 8 12:29:08 2024 -0700
oidc: verify support for algs from discovery
commit 22dfdcabd450013b4d51ac15b6423f529d957e9f
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Mar 19 10:23:19 2024 -0700
update go-jose to v4
The biggest change between v3 and v4 is ParseSigned now requires a set
of allow listed algorithms. go-oidc was already doing this ad-hoc, so
the change is an improvement over the current logic.
commit 375c3705271111517c0256ce8df5c2e6810e94e7
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Mar 19 09:52:25 2024 -0700
add staticcheck to github actions
commit 0963f392e0fb016ce55f967cad5ec0364ad28aa7
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Mar 19 09:45:15 2024 -0700
updated github actions
commit 65ac18013331cffa70834a363acf40608e086638
Author: Brendan Gerrity <brendan.gerrity@datadoghq.com>
Date: Fri Feb 23 16:40:52 2024 -0500
fix minor typo
commit 6d6be43e852de391805e5a5bc14146ba3cdd4195
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed Nov 29 02:18:05 2023 +0000
build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1
Bumps [github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Changelog](https://github.com/go-jose/go-jose/blob/v3/CHANGELOG.md)
- [Commits](https://github.com/go-jose/go-jose/compare/v3.0.0...v3.0.1)
---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v3
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
commit 9c21d32c37ae298d90a42b6234eb2d2e53eb24d8
Author: Craig O'Donnell <cbodonnell@comcast.net>
Date: Thu Nov 2 10:31:25 2023 -0400
support provider device_authorization_endpoint
commit 3ebd0c9e4dcfceac8e1b23b1fb5ff8e7b8b61c2a
Author: benefactarch <auch.josh@gmail.com>
Date: Thu Oct 19 23:50:21 2023 -0400
chore: bump dependencies
commit 806b20a0e6f53d3f7a1043f62c33da022a663dec
Author: Nilesh Patra <nilesh@debian.org>
Date: Fri Oct 20 03:49:56 2023 +0530
Add siretart's changes for -2 upload
commit f0117a5f178cb36710dde42ede2154071b20ee94
Author: Rob Liebowitz <rliebowitz@morningconsult.com>
Date: Fri Jun 9 15:02:03 2023 -0400
oidc: use %w verb for wrapping errors
Errors wrapped using %v cannot be unwrapped. This means if there is an
underlying error such as `context.Canceled`, a caller cannot reliably
discover that error using any method other than string comparison. By
swapping to the %w verb, `errors.Is` and `errors.As` become valuable
tools for error discovery and behavior differentiation.
While by convention, some of the errors like `fetching keys %v` should
probably be changed to `fetching keys: %w` (with the `:` character),
this change opts not to do that to help preserve backward compatibility
for external error handling that uses string comparison today.
commit b203e58c24394ddf5e816706a7645f01280245c7
Author: guoguangwu <guoguangwu@magic-shield.com>
Date: Sat May 27 12:53:08 2023 +0800
io/ioutil deprecated
commit cd52382a51eb12b4a95207a3e39cbab87d9469e1
Author: lritter-fan <lritter@fanatics.com>
Date: Mon May 15 15:36:30 2023 -0700
oidc algs: added EdDSA as a supported algorithm
Support EdDSA alogrithm for providers.
commit 82f6983c39aa956604b86225c14eed00d5da0834
Author: James Tucker <jftucker@gmail.com>
Date: Mon Apr 24 16:55:34 2023 -0700
oidc: add UserInfoEndpoint returning the discocvered URL
This enables users detect if the provider.UserInfo method would fail
ahead of time, by checking for the empty string in UserInfoEndpoint.
Fixes #373
Fixes #374
commit 921a42b4b63d5b618d17d7e7a36a4acb59e643c6
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Mar 21 16:07:59 2023 +0000
*: gofmt all and update dependencies
commit 2936eb343ba21eb2fe96884984f0e9b6018c71fe
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Fri Jan 13 09:17:51 2023 -0800
oidc: restrict use of context.Background()
commit a8ceb9a2043fca2e43518633920db746808b1138
Author: Stephen Kitt <skitt@redhat.com>
Date: Tue Jan 3 14:58:07 2023 +0100
Bump golang.org/x dependencies
The latest versions simplify the transitive dependency tree (see
https://github.com/kubernetes/kubernetes/issues/113366 for details).
Signed-off-by: Stephen Kitt <skitt@redhat.com>
commit 151abff909b40811db068f29c1fbc827378f42f4
Author: Eric Chiang <eric.chiang.m@gmail.com>
Date: Tue Dec 27 18:49:32 2022 -0800
*: update go-jose package to latest
commit aad6768e93cd930b706c2e30a82bfeb2a39403c6
Author: Leo Antunes <costela@debian.org>
Date: Sat Nov 19 12:58:50 2022 +0100
fix(debian): correct vcs url for v3
commit c8480dce42ac786fab3c5465e76c6b1f19f1a698
Author: Leo Antunes <costela@debian.org>
Date: Sat Nov 19 12:17:42 2022 +0100
feat: initial debian version
Closes: #1024430
commit a049c8dfe9a761009e188dab644585a24a2111c6
Author: Leo Antunes <costela@debian.org>
Date: Sat Nov 19 10:56:26 2022 +0100
Ignore _build and quilt .pc dirs via .gitignore
Among the 1 debian patch available in version 3.4.0-2 of the package, we noticed the following issues:
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-coreos-go-oidc-v3.png){kind=link}