v2.9.0

2.9.0 (2026-04-16)

Features

• add HEADER_MAPPING_BASE flag to control JWT claims source for HEADER_MAPPING (#144) (a43f4f4), closes #143

v2.8.1

2.8.1 (2026-04-13)

Bug Fixes

• trim userinfo to mapped fields before storing in session cookie (#141) (683d79a)
• use /v2 module path (#139) (fb2d63e)

v2.8.0

2.8.0 (2026-04-03)

Features

• forward authenticated user identity to upstream via headers (#135) (e847ed5), closes #130

v2.7.0

2.7.0 (2026-04-03)

Features

• add unauthenticated /healthz endpoint for health checks (#131) (9803d0f)

Bug Fixes

• prevent panic on SSE reverse proxy when backend closes connection (#128) (76d1ac5)
• set JWT audience claim to external URL for RFC 8707 compliance (#133) (351305a), closes #129

v2.6.1

2.6.1 (2026-03-18)

Bug Fixes

• generate server-side OAuth state when client omits it (#126) (940e91e)

v2.6.0

2.6.0 (2026-03-16)

Features

• Add OIDC Attribute-Based Authorization (#120) (51b6e85)
• support injecting cryptographic keys via env vars (#119) (ec9e857)

Bug Fixes

• fix prettier formatting in oauth-setup.md (#124) (ef5731d)
• normalize external URL with trailing slash per RFC 3986 (#125) (e377aa9)

v2.5.4

2.5.4 (2026-03-03)

Bug Fixes

• follow backend 307/308 redirects in transparent proxy (#116) (4546f40)
• widen OAuth signature columns from VARCHAR(255) to VARCHAR(512) (#117) (68437b1), closes #111

v2.5.3

2.5.3 (2026-01-03)

Bug Fixes

• send MCP initialize metadata for stdio backends (#106) (16de9cd)

v2.5.2

2.5.2 (2025-12-04)

Bug Fixes

• docker: update base image to golang:1.22-bookworm and switch to debian:bookworm-slim (#98) (dbeabda)
• upgrade dependencies (#100) (8c1c8fd)
• upgrade Go version to 1.25 in workflow files (#101) (3b869e9)

v2.5.1

2.5.1 (2025-12-04)

Bug Fixes

• idp: replace hardcoded issuer with external URL in IDP router (#96) (a7dbccb)