Release Highlights
- 📨 OAuth 2.0 Multiple Response Type Encoding
- 📦️ Support for JWT encoded profile claims
- 🔵 Golang version upgrade to v1.23.8
- 🕵️♀️ Vulnerabilities have been addressed
- CVE-2025-22871
- 🐛 Squashed some bugs
Important Notes
Breaking Changes
Changes since v7.8.2
- #3031 Fixes Refresh Token bug with Entra ID and Workload Identity (#3027)[https://github.com/oauth2-proxy/oauth2-proxy/issues/3028] by using client assertion when redeeming the token (@richard87)
- #3001 Allow to set non-default authorization request response mode (@stieler-it)
- #3041 chore(deps): upgrade to latest golang v1.23.x release (@TheImplementer)
- #1916 fix: role extraction from access token in keycloak oidc (@Elektordi / @tuunit)
- #3014 feat: ability to parse JWT encoded profile claims (@ikarius)