Bump version to 2.39.0

Author: jeremyevans

CHANGELOG

@@ -1,4 +1,4 @@
-=== master
+=== 2.39.0 (2025-05-22)
 
 * Allow usage with Roda's plain_hash_response_headers plugin and Rack 3+ (jeremyevans)
 

doc/release_notes/2.39.0.txt

@@ -0,0 +1,19 @@
+= Improvements
+
+* Rodauth now supports Roda's plain_hash_response_headers plugin on
+  Rack 3+, by using lowercase response header keys, instead of
+  relying on Roda's default conversion of response header keys to
+  lowercase.
+
+* When setting login_return_to_requested_location? to true, by
+  default, Rodauth will no longer return to the requested location if
+  it is more than 2048 bytes in size.  This is to avoid exceeding the
+  4K cookie size limit.  You can modify this limit using the new
+  login_return_to_requested_location_max_path_size configuration
+  method.
+
+* Rodauth now uses JSON.generate instead of JSON.fast_generate to
+  avoid a deprecation warning in recent json gem versions.
+
+* Rodauth now uses allowed_origins instead of origin when using
+  WebAuthn 3.4+ to avoid a deprecation warning.

lib/rodauth/version.rb

@@ -6,7 +6,7 @@ module Rodauth
   MAJOR = 2
 
   # The minor version of Rodauth, updated for new feature releases of Rodauth.
-  MINOR = 38
+  MINOR = 39
 
   # The patch version of Rodauth, updated only for bug fixes from the last
   # feature release.