- feat: add useRefreshTokenLock to serialize refresh token renewal across tabs
- feat: improve handling of silent renew race conditions
- Make offline_access refresh-token warning configurable
- Fix: don't send code_challenge in PAR flow when disablePkce is true
- test: convert validation specs to await firstValueFrom
- fix(public) : Export PopupResult to public
- chore: sync package-lock.json with package.json
- docs: fix typos, broken links, and invalid Docusaurus directive
- ci: build docs only on push to main, not on PRs
- fix(check-session): require exact origin match in postMessage handler