[osanderson]

🤖 I have created a release beep boop

0.61.0 (2026-10-26)

⚠ BREAKING CHANGES

• resource: resource.NewVerifier under AssuranceProduction refuses a Limits.MaxClockSkew under 10 seconds or over 60 seconds. Development assurance is unchanged, and serverresource.NewVerifier inherits the server's already-bounded value.
• client: RevokeToken takes a client.TokenSet instead of a fapi.Secret and refuses a set from another issuer or with no recorded issuer. TokenSetSealer.Seal refuses a set with no recorded issuer. ExchangeCode refuses a response another Client validated. Under AssuranceProduction, client.New refuses CallbackBindingDeviceLocalStore unless the redirect URI is loopback http to 127.0.0.1 or [::1] or a private-use URI scheme. See UPGRADING.md.
• server: under AssuranceProduction, server.New now refuses a ClientCertificateTrust of NoClientCertificateChainTrust, by value or pointer. A deployment whose TLS termination verifies client certificate chains passes ClientCertificateChainVerifiedUpstream instead, which behaves the same; otherwise pass TrustedClientCAs, or NoPKIClientAuthentication when no client uses tls_client_auth. See UPGRADING.md.
• resource.NewOpaqueAccessTokens takes the issuer as a second argument and NewVerifier refuses an OpaqueAccessTokens without an Issuer. Opaque access tokens issued before this release, and records written before v0.58.0 (in practice refresh tokens issued before 2026-10-20), are refused, so their users must authorize again. With an Audience set, an opaque token record without an audience is refused. server.OpaqueAccessTokens refuses to issue without an issuer. A custom resource.AccessTokenResolver must report the issuer of any token carrying a grant_id or code_grant_id claim, or Verify answers 500. Revocation store keys for grants now contain the issuer URL. See UPGRADING.md.
• server: a client registered with AllowedResources no longer gets issuer-audience access tokens when resource indicators are enabled. With a single entry, a request naming no resource is for that resource; with several, it fails with invalid_target. Such a client that calls the UserInfo endpoint must list the issuer identifier in its AllowedResources (and the server must accept it as a resource), then name a resource in every request. See UPGRADING.md.
• federation: a statically registered client is authenticated only with keys from Dependencies.ClientKeys, never with ones its federation metadata publishes, and a federation client only with its federation keys. Automatic registration no longer registers a client authentication method or assertion algorithm outside a superior's policy on token_endpoint_auth_method or token_endpoint_auth_signing_alg, refuses an empty token_endpoint_auth_methods_supported or token_endpoint_auth_signing_alg_values_supported, and refuses an empty string for any string parameter it reads. See UPGRADING.md.

Features

• keys: bind a JWKSIssuerKeySource to its issuer (476bfd4)
• resource: add AuthorizationContext.GrantID and CodeGrantID (d3c3eef)
• server: show and narrow resources at consent; confine federation clients' resources (593801c)

Bug Fixes

• bump Go toolchain to 1.26.10 for GO-2026-6809 (a685dc5)
• client: bind CIBA sessions to the client that began them (b58eb5d)
• client: bind code exchange, revocation and sealing to the issuer (d83df91)
• client: bound cached DPoP nonces and forget one a request was refused for (58b99ea)
• client: refuse a DPoP request whose path its htu would normalize (452fcab)
• complete the per-issuer store backstop for access tokens, old records and grant revocation (dd9c3c1)
• extension: refuse authorization_details with a second top-level value (eceefde)
• federation: keep static client keys, RP choices and empty values within policy (15606f7)
• refuse JOSE and metadata JSON with a second top-level value (8d41a12)
• resource: describe a credential-binding failure as an invalid token (144564b)
• resource: hold MaxClockSkew to 10-60 seconds under production (d63e6ec)
• server: bind attested authorization codes to the client instance; re-check grant types (d6bcaad)
• server: confine requests naming no resource to the client's AllowedResources (b289a81)
• server: read client_id one way for an embedder's attested client (54c160c)
• server: refuse NoClientCertificateChainTrust under production assurance (cb9e739)
• tighten iat, JWE zip, private-member and UserInfo typ checks (d379bfa)

---

This PR was generated with Release Please. See documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[osanderson]

🤖 Created releases:

• v0.61.0

🌻