release 1.9.0

Author: kevinlzw

.github/issue_template.md

@@ -7,7 +7,7 @@ A new issue about a bug should be verified with a minimized example.
 
 ###### Environment
 
-- lua-resty-openidc version (e.g. 1.8.0)
+- lua-resty-openidc version (e.g. 1.9.0)
 - OpenID Connect provider (e.g. Keycloak, Azure AD)
 
 ###### Expected behaviour

ChangeLog

@@ -1,4 +1,4 @@
-unreleased
+07/01/2026
 - do not use the shared JWT verification cache for bearer JWT validation
   calls that pass additional claim validators, preventing a token accepted
   by one validator set from bypassing a stricter validator set on cache hit.
@@ -46,6 +46,7 @@ unreleased
 - prune stale and excess pending authorization states from the session during
   authorization requests, configurable with authorization_state_expires_in and
   authorization_state_max_number; see #553.
+- release 1.9.0
 
 09/13/204
 - cross-tenant requests are fixed with lua-resty session 4.0.x; closes #526

lib/resty/openidc.lua

@@ -85,7 +85,7 @@ local function can_use_token_auth_method(method, opts)
 end
 
 local openidc = {
-  _VERSION = "1.8.0"
+  _VERSION = "1.9.0"
 }
 
 local supported_dpop_signing_algs = {

lua-resty-openidc-1.8.0-1.rockspec lua-resty-openidc-1.9.0-1.rockspeclua-resty-openidc-1.8.0-1.rockspec renamed to lua-resty-openidc-1.9.0-1.rockspec

@@ -1,8 +1,8 @@
 package = "lua-resty-openidc"
-version = "1.8.0-1"
+version = "1.9.0-1"
 source = {
     url = "git+https://github.com/zmartzone/lua-resty-openidc",
-    tag = "v1.8.0",
+    tag = "v1.9.0",
     dir = "lua-resty-openidc"
 }
 description = {