CHANGELOG

Copy Markdown View Source

0.2.0 - 2026-08-18

  • Breaking: require Poison ~> 6.0. Consumers are now pinned to Poison 6 and can no longer resolve 4.x or 5.x. The call surface is unaffected — Poison.decode/2 and the keys: :atoms option are byte-identical between 4.0.1 and 6.0.0.
  • Breaking: minimum Elixir is now ~> 1.12, matching Poison 6's own requirement.
  • Changed: updated every dependency to its latest release, including Ueberauth 0.6.3 -> 0.10.8 and meck 0.8.13 -> 1.2.0.
  • Changed: raised dev/test requirements that had capped themselves below their current major — dialyxir ~> 0.5 -> ~> 1.4, meck ~> 0.8.4 -> ~> 1.2.
  • Security: the committed lockfile's transitive Plug moved 1.11.0 -> 1.20.3, clearing CVE-2026-8468 (HIGH), CVE-2026-56814 (MEDIUM) and CVE-2026-56813 (LOW) from this repo's own CI. Consumers resolve their own Plug and were never exposed through this package.
  • Removed: dead require Logger left behind when debug logging was dropped in 0.1.6.
  • Changed: maintainership. Dragos Daian is now listed as maintainer alongside original author Ian Luites, and the package's repository links point at the appsinacup fork this is published from, with upstream credited separately.
  • Changed: the CHANGELOG now ships in the package and on hexdocs; it was absent from the files list before.
  • Fixed: LICENSE carried two stacked copies of the MIT text, the first with an empty copyright holder. Consolidated to a single text retaining all three holders (Ian Luites, kouwasi, Dragos Daian).
  • Fixed: compiles warning-free on Elixir 1.20 — :preferred_cli_env replaced with def cli/0, use Mix.Config with import Config, and use Plug.Test with explicit import Plug.Test / import Plug.Conn.

0.1.6 - 2026-07-01

  • Changed: require HTTPoison ~> 3.0 so downstream apps use patched Hackney 4.x.
  • Changed: update ExCoveralls test dependency to avoid pulling vulnerable Hackney through test-only deps.

0.1.4 - 2025-11-28

  • Fix: remove stray/unimplemented auth/1 head to avoid CI compile errors when used as a dependency.

0.1.3 - 2025-11-28

  • Update dependencies: httpoison -> ~> 2.0, credo -> ~> 1.7

0.1.5 - 2025-11-29

  • Fix: Proper CSRF state handling and validation:
    • Strategy now stores a 'state' token during the request phase (session + response cookie) and validates state on callback.
    • Callback validation checks session, cookie, and CSRF-derived state candidates and short-circuits early on CSRF mismatches so later validation cannot overwrite the error.
  • Tests: Added/updated unit tests to cover state round-trip flows, cookie-only scenarios, session-only scenarios, missing/mismatched state cases, and valid happy paths.
  • Changed: bumped package version to 0.1.5 and updated HTTP client dependency to HTTPoison ~> 2.0.
  • Note: This release will be published to Hex under the package name ueberauth_steam_strategy due to the original ueberauth_steam name being already registered.