Revision history for Net-OAuth

0.32   Sun 16 Aug 00:51:04 BST 2026
       [Security]
       - The Net::OAuth smart_require function no longer memoizes
         failures, which allowed attackers to exhaust memory with
         requests for invalid signature methods. CVE-2026-72888

       - Net::OAuth::Client no longer allows silent downgrades from
         OAuth 1.0a to 1.0 when the remote provider drops the
         oauth_verifier.  The behavior can be re-enabled with the
         allow_v1a_downgrade option. CVE-2026-72887

       [Bug Fixes]
       - RSA-SHA1 now pins PKCS#1 v1.5 padding and the SHA-1 hash rather
         than inheriting Crypt::OpenSSL::RSA's defaults, which have drifted
         (SHA-256 in 0.29_01, RSA-PSS in 0.35). Against 0.35 and later this
         produced RSA-PSS signatures that no RFC 5849 3.4.3 compliant server
         will accept. Reported as Debian #1142954.

       [Other]
       - Switched to use Crypt::SysRandom for generating random bytes.

       [Tests]
       - t/02-rsa.t asserts the signature base string separately from the
         signature, so a failure distinguishes base-string construction from
         the crypto layer.

       - t/02-rsa.t skips with a diagnostic on Crypt::OpenSSL::RSA 0.35
         through 0.37, which disabled the PKCS#1 v1.5 padding that OAuth
         RSA-SHA1 requires; 0.38 re-enabled it.

       [Toolchain]
       - Recommend Crypt::OpenSSL::RSA 0.38 or later for RSA-SHA1.

       - Declared MIN_PERL_VERSION as 5.008001, the floor imposed by URI
         and MIME::Base32.

       - Added GitHub Actions CI covering perl 5.16 through latest, and a
         matrix pinning the Crypt::OpenSSL::RSA versions that bracket the
         padding change behind Debian #1142954.

       - Added author tests under xt/, guarded by AUTHOR_TESTING.

       - Corrected the AUTHOR metadata, which credited only the current
         maintainer. Keith Grennan is the author and copyright holder;
         Robert Rothenberg maintains.

       - Updated .mailmap and the AUTHOR POD to canonicalise on reachable
         addresses, as cpan.org no longer forwards mail.

       - MANIFEST now ships CONTRIBUTING.md, and no longer lists the
         generated META.json and META.yml, which distmeta writes into the
         distribution directory regardless.

       [Documentation]
       - Removed the Dancer demo application and rewrote the SYNOPSIS and
         README to be framework-agnostic. The demo linked to a domain that
         is now parked.

       - Added =encoding utf8 to Net::OAuth, which had a non-ASCII
         contributor name in its POD without one.

       [Documentation]
       - Added missing version and timestamp to Changes for v0.31.

       - Added missing acknowledgement to Changes for v0.31.

       - Added CONTRIBUTORS section to the POD.

       - Added a "How to Contribute" document.

0.31   Thu, 03 Apr 2025 16:51 BST
       [Bug Fixes]
       - Added missing dependency RT#70407.

       - Removed use of Digest::HMAC_SHA1 (thanks to James Raspass).

       [Documentation]
       - Updated Changes for v0.29 with CVE.

       - Updated the security policy.

       [Toolchain]
       - Remove Build.PL and just use Makefile.PL.

0.30   Fri, 03 Jan 2025 09:46 GMT
       [Bug Fixes]
       - Fixed syntax error in Net::OAuth::Client (oops).
       - Added missing VERSION to Net::OAuth::Client.

0.29   Fri, 03 Jan 2025 09:15 GMT
       [Security]
       - Net::OAuth::Client uses a better source of randomness for generating the nonce CVE-2025-22376

       [Bug Fixes]
       - Removed unnecessary prerequisite RT#69810 GH#4 GH#6
       - Fix broken dependency for URI::Escape GH#4 (thanks oiami)
       - Fix handling of uri_escape_utf RT#73705 (thanks Tomaž Šolc)

       [Documentation]
       - Reorganised Changes to almost follow CPAN::Changes::Spec
       - Updated author and maintainer information
       - Changed to consistent copyright information
       - Fixed typo RT#125292 RT#90007 GH#6 (thanks Gregor Herrmann)
       - Added a Security Policy (SECURITY.md) to the distribution

       [Tests]
       - Fixed randomly failing t/02-rsa.t test RT#125291 RT#125482 (thanks Gregor Herrmann)

       [Other]
       - Maintenance taken over by Robert Rothenberg <rrwo@cpan.org>
       - Added .mailmap to the repo
       - Distribution metadata now has the git repository (thanks Sergey Romanov) GH#6
       - Set up config_requires in Build.PL
       - Updated Build.PL configuration
       - Updated MANIFEST.SKIP rules

0.28   Fri, 06 Jan 2012 05:51:04 UTC
       - Added HMAC-SHA256 support

0.27   Wed, 16 Jun 2010 20:39:59 UTC
       - Added class for Yahoo! access token refresh request (thanks Marc Mims)

0.26   Wed, 16 Jun 2010 19:59:04 UTC
       - Message::encode no longer tries fix potential 'double-encoding' (in any case it appeared to be doing it wrong).
         Now it just complains if you try to pass in undecoded strings. (thanks Daisuke Maki and KATOU Akira)

0.25   Sun, 21 Mar 2010 03:50:40 UTC
       - Gah, $VERSION lameness

0.24   Sun, 21 Mar 2010 03:39:40 UTC
       - Fix test breakage in 0.23

0.23   Thu, 18 Mar 2010 17:23:36 UTC
       - Removed UNIVERSAL::require dependency
       - Net::OAuth->request constructor now dies if module fails to load (thanks Mike Schleif)
       - Fixed RT#55635 Incorrect dependencies (thanks Jens Rehsack)
       - Replaced die() with croak()

0.22   Thu, 11 Mar 2010 00:21:26 UTC
       - Renamed xAuthAccessTokenRequest to XauthAccessTokenRequest for CamelCaseConsistency
       - Added a couple tests for XauthAccessTokenRequest

0.21   Wed, 10 Mar 2010 22:20:49 UTC
       - Added xAuth support with xAuthAccessTokenRequest (thanks Masayoshi Sekimura and Simon Wistow)
       - Added performance patch to decrease stat() system calls when requiring modules (thanks Brad Whitaker)

0.20   Fri, 13 Nov 2009 18:56:55 UTC
       - Fixed RT#48867 - error in synopsis - thanks Adam Taylor!
       - Removed UTF8 double-encoding warning.  Now Net::OAuth::Message::encode() uses Encode::is_utf8() to determine if
         the input is already UTF-8 encoded.  If so, it runs decode_utf8() on it before sending it to uri_escape_utf8().
         Thanks Hector Garcia Alvarez!
       - Potentially fixed an issue found by Marc Mims, where HMAC_SHA1 was failing to load, breaking some CPAN tests.
         Build.PL now explicitly requires Digest::SHA1 and Encode.  Hopefully that fixes it.

0.19   Fri, 26 Jun 2009 17:30:06 UTC
       [Bug Fixes]
       - Fixed RT#47369 - Don't automatically set oauth_version parameter when message is created via from_hash (or
         from_url, from_post_body, etc).  Thanks COSIMO!

0.18   Thu, 25 Jun 2009 17:18:04 UTC
       [Bug Fixes]
       - Fixed accidental (though probably harmless) regression in 0.17

0.17   Thu, 25 Jun 2009 16:59:50 UTC
       [Bug Fixes]
       - Fixed RT#47293 - Message->from_hash was validating using the incorrect class, causing a 'Parameter X not valid
         for a message of type Y' message on V1.0a messages.  Thanks Jeff Dairiki!

0.16    Mon, 15 Jun 2009 18:36:17 UTC
        [Enhancements]
        - Added support for OAuth 1.0A - see POD section 'OAUTH 1.0A' for details - Net::OAuth still defaults to 1.0 for
          now

0.15    Fri, 05 Jun 2009 00:48:07 UTC
	- Added Twitter demo consumer
	- Warn if message parameter is already UTF-8 that it will be double-encoded; see I18N section of Net::OAuth manpage
	- Better handling of missing 'realm' parameter in Authorization header methods
	- Better handling of request_url parameter; see REQUEST_URL PARAMETER section of Net::OAuth manpage
	- Fixed RT#44699 - encode spaces to %20 rather than + in $message->to_url()

0.14    Sat, 13 Dec 2008 17:29:36 UTC
	- Add POD for consumer requests

0.13    Thu, 13 Nov 2008 22:45:46 UTC
	- Added support for Consumer Request (token-less / two-legged) message type

0.12    Fri, 04 Jul 2008 22:58:23 UTC
	- Added support for extensions - Net::OpenMicroBlogging in particular

0.11    Wed, 04 Jun 2008 16:50:14 UTC
	- Doc edits

0.1     Wed, 04 Jun 2008 16:27:50 UTC
        - Added demo, fixed docs

0.09    Tue, 03 Jun 2008 03:46:32 UTC
	- Fixed another annoying test failure

0.08   	Mon, 02 Jun 2008 17:41:52 UTC
  	- Fixed test failures found in 0.07.
        - More docs.
        - Added more deserialization methods.
        - Changed factory invocation from message('foo') to message('foo')->new(), to allow
          deserialization methods to be used instead of new().

0.07    Sun, 01 Jun 2008 16:04:26 UTC
        - Added a factory class, Net::OAuth
        - Added several 'Response' classes
        - Added UserAuthRequest and UserAuthResponse
        - Created a Message base class from which Request and Response inherit
        - Added some introductory documentation
        - Added more tests

0.06    Sat, 08 Mar 2008 00:57:40 UTC
        - Removed live test that stopped working

0.05    Mon, 19 Nov 2007 03:30:05 UTC
        - Integrated patch from Nobuo Danjou, for Draft 6 spec compliance

0.04    Fri, 19 Oct 2007 16:45:03 UTC
        - Integrated patch from SARTAK, fixing signature for RequestTokenRequest with HMAC-SHA1

0.03    Mon, 15 Oct 2007 01:35:17 UTC
        - Fixed header parsing

0.02    Tue, 02 Oct 2007 07:35:17 UTC
        - Added RSA-SHA1 support

0.01    Sun, 30 Sep 2007 13:35:06 UTC
        - First version, released on an unsuspecting world.
