v1.1.8

1.1.8 - 2026-07-15

• TAG: v1.1.8
• COVERAGE: 69.47% -- 835/1202 lines in 42 files
• BRANCH COVERAGE: 47.75% -- 159/333 branches in 42 files
• 40.38% documented

Changed

• Raised the anonymous_loader runtime dependency floor to >= 0.1.1.

• Raised the auth-sanitizer runtime dependency floor to >= 0.2.2 and
  switched isolated sanitizer loading to the released anonymous_loader gem,
  including local workspace wiring for the new runtime dependency.

• Raised the oauth-tty runtime dependency floor to >= 1.0.11.

• Raised the anonymous_loader runtime dependency floor to >= 0.1.2.

• Retemplated generated project metadata, support documentation, CI workflows,
  binstubs, and development dependency floors with kettle-jem v7.0.0.

Fixed

• Updated the auth-sanitizer subprocess isolation spec to load the standard
  test bootstrap, including Ruby 2.4 backports.

• Made the Ruby 2.4 appraisal's legacy cgi dependency explicit.

• Corrected RubyGems homepage metadata to point at the gem documentation site.

• Corrected persisted Open Collective and repository topology metadata used by
  future template runs.

• Package configured license files in gem release file lists.

• Updated the dep-heads workflow so current TruffleRuby uses the generated
  gemfiles/dep_heads.gemfile directly, avoiding Appraisal bootstrap failures
  with TruffleRuby's bundled RubyGems/Bundler and gem.coop.

Added

• Added support for JRuby 10.1 and TruffleRuby 34.0.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.7

1.1.7 - 2026-06-15

• TAG: v1.1.7
• COVERAGE: 88.32% -- 839/950 lines in 33 files
• BRANCH COVERAGE: 58.67% -- 159/271 branches in 33 files
• 40.38% documented

Changed

• Retemplated repository metadata, workflows, modular gemfiles, documentation
  scaffolding, version_gem >= 1.1.12, and templating-isolated local workspace
  Gemfile wiring with the current kettle-jem template.

• Raised the auth-sanitizer runtime dependency floor to >= 0.2.1, so OAuth
  consumers get hash and nested-attribute inspect redaction fixes plus
  downstream RBS duplicate-declaration fixes.

• Raised the oauth-tty runtime dependency floor to >= 1.0.9.

• Raised the oauth-tty runtime dependency floor to >= 1.0.10, removing
  the transitive external cgi runtime dependency for Ruby 2.4 consumers.

Fixed

• Restored docs/CNAME so the generated documentation site keeps its custom domain.

• Pinned older Ruby appraisals to Rack 2.2 so rack-test remains compatible
  with the Ruby 2.4, Ruby 2.5, and JRuby 9.2 CI jobs.

• Derived an RSA public key from PEM private-key strings before signature
  verification, matching JRuby OpenSSL behavior while preserving RSA-SHA1
  verification semantics.

• Removed the external cgi runtime dependency because the only cgi gem
  releases installable on Ruby 2.4 call String#delete_prefix, which is
  unavailable on Ruby 2.4.

• Removed the external erb dependency from the Ruby 2.4 appraisal because
  Ruby 2.4 already provides ERB and the released erb gem depends on external
  cgi.

• Added a private-key-backed RSA-SHA1 verification fallback for JRuby OpenSSL
  versions that raise OpenSSL::PKey::PKeyError during public-key
  verification.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.6

1.1.6 - 2026-06-07

• TAG: v1.1.6
• COVERAGE: 89.05% -- 838/941 lines in 33 files
• BRANCH COVERAGE: 60.46% -- 159/263 branches in 33 files
• 40.38% documented

Changed

• Retemplated project workflows, appraisals, and development tooling with the
  current kettle-jem template.
• Documented current OAuth::Consumer configuration options, including token
  request redirect safety settings, and corrected the OAuth 1.0a usage example.
• Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• Hardened OAuth token endpoint redirect handling after the GHSA-pp92-crg2-gfv9
  review: token redirects are now bounded, resolved explicitly, and rejected
  when they cross origins unless explicitly enabled.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.5

1.1.5 - 2026-05-20

• TAG: v1.1.5
• COVERAGE: 84.79% -- 864/1019 lines in 37 files
• BRANCH COVERAGE: 54.91% -- 151/275 branches in 37 files
• 40.86% documented

Changed

• auth-sanitizer v0.1.3

Fixed

• Load auth-sanitizer through an internal isolated loader so requiring oauth does not add top-level Auth or AuthSanitizer constants that may collide with downstream applications.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.4

1.1.4 - 2026-05-16

• TAG: v1.1.4
• COVERAGE: 84.64% -- 854/1009 lines in 36 files
• BRANCH COVERAGE: 54.91% -- 151/275 branches in 36 files
• 40.78% documented

Added

• Add auth-sanitizer integration for inspect-time secret redaction in core OAuth objects.
• Traditional OAuth::VERSION constant

Changed

• Redact sensitive values from #inspect in OAuth::Consumer, OAuth::Token, and OAuth::Signature::Base.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.3

1.1.3 - 2025-11-06

• TAG: v1.1.3
• COVERAGE: 81.70% -- 817/1000 lines in 36 files
• BRANCH COVERAGE: 50.54% -- 140/277 branches in 36 files
• 40.71% documented

Added

• base64 dependency, fixes Ruby 3.4 and 3.5 HEAD compatibility

Fixed

• Fix ActionController request proxy NoMethodError when building signatures
  • define wrap_values on OAuth::RequestProxy::Base
  • remove duplicate from ActionDispatchRequest
  • add specs

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.2

1.1.2 - 2025-09-21

• TAG: v1.1.2
• COVERAGE: 81.78% -- 817/999 lines in 36 files
• BRANCH COVERAGE: 50.54% -- 140/277 branches in 36 files
• 40.71% documented

Added

• Corrected SHA-256 & SHA-512 checksums for release 1.1.1

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.1

1.1.1 - 2025-09-21

• TAG: v1.1.1
• COVERAGE: 81.70% -- 817/1000 lines in 36 files
• BRANCH COVERAGE: 50.54% -- 140/277 branches in 36 files
• 40.71% documented

Added

• kettle-dev v1.1.18
• Internal escape & unescape methods
  • Stop relying on URI / CGI for escaping and unescaping
  • They are both unstable across supported versions of Ruby (including 3.5 HEAD)
• Tests against Rails-specific code are now run in CI
• Documented OAuth 1.0, 1.0a differences

Changed

• converted minitest => rspec

Removed

• dependency on em-http-request
  • now lazy Loaded so it can be optional, since some systems fail to install it, and it doesn't seem maintained

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

v1.1.0

What's Changed

• 🔥 Extract CLI to new oauth-tty gem by @pboling in #275
• 271/snaky hash by @pboling in #276

Full Changelog: v1.0.0...v1.1.0

v1.0.1

Full Changelog: v1.0.0...v1.0.1