Log message:
py-authlib: updated to 1.3.0

Version 1.3.0

Bug fixes

Restore AuthorizationServer.create_authorization_response behavior
Include leeway in validate_iat() for JWT
Fix encode_client_secret_basic
Use single key in JWK if JWS does not specify kid
Fix error when RFC9068 JWS has no scope field
Get werkzeug version using importlib

Breaking changes

RFC9068 implementation

Log message:
py-authlib: updated to 1.2.1

Version 1.2.1

Released on Jun 25, 2023

Apply headers in ClientSecretJWT.sign method
Allow falsy but non-None grant uri params
Fixed authorize_redirect for Starlette v0.26.0
Removed has_client_secret method and documentation
Removed request_invalid and token_revoked remaining occurences and documentation
Fixed RFC7591 grant_types and response_types default values

Log message:
py-authlib: updated to 1.2.0

Version 1.2.0

Not passing request.body to ResourceProtector
Use flask.g instead of _app_ctx_stack
Add headers parameter back to ClientSecretJWT
Always passing realm parameter in OAuth 1 clients
Implemented RFC7592 Dynamic Client Registration Management Protocol
Add default_timeout for requests OAuth2Session and AssertionSession.
Deprecate jwk.loads and jwk.dumps

Log message:
py-authlib: updated to 1.1.0

Version 1.1.0

This release contains breaking changes and security fixes.

Allow to pass claims_options to Framework OpenID Connect clients.
Fix .stream with context for HTTPX OAuth clients.
Fix Starlette OAuth client for cache store.

Breaking changes:

Raise InvalidGrantError for invalid code, redirect_uri and no user errors in \ 
OAuth 2.0 server.

The default authlib.jose.jwt would only work with JSON Web Signature algorithms, \ 
if you would like to use JWT with JWE algorithms, please pass the algorithms \ 
parameter:

jwt = JsonWebToken(['A128KW', 'A128GCM', 'DEF'])
Security fixes: CVE-2022-39175 and CVE-2022-39174, both related to JOSE.

Version 1.0.1

Fix authenticate_none method.
Allow to pass in alternative signing algorithm to RFC7523 authentication methods.
Fix missing_token for Flask OAuth client.
Allow openid in any place of the scope.
Security fix for validating essential value on blank value in JWT.

Version 1.0.0

We have dropped support for Python 2 in this release. We have removed built-in \ 
SQLAlchemy integration.

OAuth Client Changes:

The whole framework client integrations have been restructured, if you are using \ 
the client properly, e.g. oauth.register(...), it would work as before.

OAuth Provider Changes:

In Flask OAuth 2.0 provider, we have removed the deprecated OAUTH2_JWT_XXX \ 
configuration, instead, developers should define .get_jwt_config on OpenID \ 
extensions and grant types.

SQLAlchemy integrations has been removed from Authlib. Developers should define \ 
the database by themselves.

JOSE Changes

JWS has been renamed to JsonWebSignature
JWE has been renamed to JsonWebEncryption
JWK has been renamed to JsonWebKey
JWT has been renamed to JsonWebToken
The "Key" model has been re-designed, checkout the :ref:`jwk_guide` \ 
for updates.

Added ES256K algorithm for JWS and JWT.

Log message:
*: convert to versioned_dependencies for py-cryptography

Log message:
*: bump PKGREVISION for egg.mk users

They now have a tool dependency on py-setuptools instead of a DEPENDS

Log message:
py-authlib: updated to 0.15.5

Version 0.15.5
Make Authlib compatible with latest httpx
Make Authlib compatible with latest werkzeug
Allow customize RFC7523 alg value

Log message:
security: Replace RMD160 checksums with BLAKE2s checksums

All checksums have been double-checked against existing RMD160 and
SHA512 hashes

Unfetchable distfiles (fetched conditionally?):
./security/cyrus-sasl/distinfo \ 
cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2

Log message:
security: Remove SHA1 hashes for distfiles

Log message:
py-authlib: updated to 0.15.4

0.15.4:
Unknown changes