v1.9.1

Security

• fix: reject malformed Host/X-Forwarded-Host headers before URL construction to close a DPoP htu cross-endpoint replay bypass #244 (tusharpandey13)

v1.9.0

Added

• feat: add publicKey option for asymmetric verification without discovery #229 (ankita10119)

v1.8.0

Added

• feat: Add Multiple Custom Domains (MCD) support #218 (ankita10119)

v1.7.4

Added

• docs: Add DPoP jti replay prevention examples to EXAMPLES.md #215 (ankita10119)

v1.7.3

Fixed

• Fix: unauthorized response code #213 (ankita10119)

v1.7.2

Added

• docs: Add Ask DeepWiki badge to README #202 (arpit-jn)
• feat: add Claude Code PR Review workflow #206 (ankita10119)
• Update the docs folder with latest contents. #192 (nandan-bhat)

Fixed

• Fix: Remove overly restrictive request body/query validation (Issue #193) #208 (ankita10119)

v1.7.1

Fixed

• fix: fix broken link on README.md #188 (nandan-bhat)

v1.7.0

Added

• feat: Add DPoP (Demonstrating Proof of Possession) authentication support #183 (nandan-bhat)
• Update engines to support Node 24 #186 (frederikprijck)

v1.6.1

Added

• Add support for node 22.1.0 #167 (nandan-bhat)

v1.6.0

Added

• nbf claim validation should include clockTolerance #115 (adamjmcgrath)