Changes for version 0.04 - 2026-08-18
- SECURITY fix CVE-2026-75866: the authorization server issued access tokens outside a client's registration, reported by cpansec.
- grant_types and scopes are now enforced, deny by default.
- SECURITY: client_credentials is refused to a public client with invalid_client (RFC 6749 4.4).
- COMPATIBILITY: a client registered without scopes now gets no scope, and one registered without grant_types can use no grant.
Modules
OAuth2 and OpenID Connect for Punk applications
resource server bearer token checkers
a cached JWKS key set
provider presets for Punk::OAuth2
one configured OAuth2/OIDC provider
an OAuth2/OIDC authorization server
DBI storage for the authorization server
a token-endpoint response
shared helpers for Punk::OAuth2
social login for Punk applications