OAuth2 v2.0.10 Released with Expanded Compatibility and Security Enhancements

The OAuth2 Ruby gem has just reached version 2.0.10, a significant release focused on improving stability, compatibility, and security. Maintainer Peter H. Boling emphasizes the importance of upgrading while reassuring users that it can be done confidently, thanks to comprehensive testing. This version ensures 100% test coverage and supports a wide range of Ruby versions, including MRI Ruby (from v2.3 to v3.4), JRuby, and TruffleRuby. It also remains compatible with popular dependencies such as Faraday, JWT, Logger, MultiXML, and Rack.

A notable aspect of this release is its strict adherence to Semantic Versioning (SemVer), ensuring backward compatibility and reducing the risk of breakages. Improvements include cryptographic signing of gem releases with a 20-year certificate, enhanced documentation, compliance with RFC 7009 for token revocation, and better error handling with standardized error types.

New features such as the `token_name` option and `OAuth2::OAUTH_DEBUG` constant add more configurability. Deprecated behaviors were removed or updated, like switching space encoding from ‘+’ to ‘%20’, making the JSON response parser more resilient, and disallowing sensitive data in inspect outputs. Two internal dependencies were also externalized into separate gems: `snaky_hash` and `version_gem`. Boling encourages the community to test, upgrade, and sponsor future development efforts.