oauth2 2.1.0

v2.1.0

on Ruby Gems

2.1.0 - 2026-10-25

• TAG: v2.1.0
• COVERAGE: 98.48% -- 649/659 lines in 16 files
• BRANCH COVERAGE: 93.53% -- 217/232 branches in 16 files
• 90.83% documented

Changed

• BREAKING: allow_cross_origin_redirects now defaults to false. Cross-origin redirects are blocked before credentials are replayed. Set allow_cross_origin_redirects: true explicitly to retain the previous behavior (deprecated).

Security

• GHSA-cmh8-5q25-68v6 - OAUTH_DEBUG token-request secrets are redacted; see gh!769. Reported by iamibi.

• gh!769 - Redact secrets in structured token-request debug bodies, expand the default filtered credential keys, and require auth-sanitizer >= 0.2.5 by @makssein

• gh!775 - Strip Authorization headers, request bodies, and query parameters from cross-origin redirects by @Huge

• gh!776 - Redact configured sensitive response options from tokenless access-token initialization errors by @Huge