Bug fixes
- Restore AuthorizationServer.create_authorization_response behavior, via #558 by @TurnrDev
- Include leeway in validate_iat() for JWT, via #565 by @dhallam
- Fix encode_client_secret_basic, via #594 by @Prilkop
- Use single key in JWK if JWS does not specify kid, via #596 by @dklimpel
- Fix error when RFC9068 JWS has no scope field, via #598 by @tanguilp
- Get werkzeug version using importlib, via #591 by @Sparrow0hawk
Breaking changes