openiddict/openiddict-core 8.0.0-preview.5 on GitHub

This release introduces the following changes:

The Quartz.NET integration (OpenIddict.Quartz) was removed and replaced by a new BackgroundService-based worker directly shipping as part of the OpenIddict.Core package. No additional code is required to enable this new service. See #2556 for more information.

Tip

While the Quartz-based pruning logic was opt-in, the new logic is opt-out. For those who prefer using their own pruning mechanism, the new OpenIddictCoreBuilder.DisableAutomatic*Pruning() APIs can be used to disable pruning:

builder.Services.AddOpenIddict()
    .AddCore(options =>
    {
        // Note: by default, OpenIddict automatically prunes authorizations, sessions and tokens
        // that are no longer valid at regular intervals. For those who prefer using their own
        // pruning mechanism (e.g based on Quartz.NET or Hangfire), automatic pruning can be disabled.
        //
        options.DisableAutomaticAuthorizationPruning()
               .DisableAutomaticSessionPruning()
               .DisableAutomaticTokenPruning();
    });

Important

While Quartz.NET is no longer supported out-of-the-box in OpenIddict 8.x, it is still possible to opt-out the new BackgroundService-based pruning mechanism and create a custom IJob that manually calls IOpenIddictAuthorizationManager.PruneAsync()/IOpenIddictSessionManager.PruneAsync()/IOpenIddictTokenManager.PruneAsync().

A new SetAllowedDecompressionMethods() API was introduced in the System.Net.Http integration packages to limit the decompression methods they can use when extracting HTTP responses. While not recommended, this new option can be used to mitigate the recent CVE-2026-111497 vulnerability. See #2568 for more information (thanks @m3nax! ❤️)
HTTP response payloads are no longer logged by default when encountering an error. A new EnableSensitivePayloadLogging() API was added to opt out this new behavior. See #2558 for more information (thanks @zengqinglei and @m3nax! ❤️)
The Discord web provider was updated to use server configuration discovery, which allows the OpenIddict client to dynamically determine whether the iss parameter is allowed in the authorization responses returned by Discord (thanks @StellaAlexis! ❤️)
Multiple code paths have been updated to rethrow OperationCanceledException when appropriate.
All the .NET and third-party dependencies have been updated to their latest version.