diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c68f16d2..8efc46f13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,28 +20,44 @@ Please file a bug if you notice a violation of semantic versioning.
### Added
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security
+
+## [2.0.19] - 2026-05-15
+
+- TAG: [v2.0.19][2.0.19t]
+- COVERAGE: 100.00% -- 515/515 lines in 14 files
+- BRANCH COVERAGE: 100.00% -- 174/174 branches in 14 files
+- 89.11% documented
+
+### Added
+
- [gh!707][gh!707] Add `OAuth2.config[:filtered_label]` to configure the placeholder used for filtered sensitive values in inspected objects and debug logging output by @pboling
- [gh!707][gh!707] Add `OAuth2.config[:filtered_debug_keys]` to configure which key names have their values redacted from debug logging output by @pboling
### Changed
- [gh!707][gh!707] Make inspect-time and debug-log filters snapshot their configuration at initialization time rather than tracking later config changes by @pboling
-- Refactor sensitive-value filtering to use `auth-sanitizer` while preserving `OAuth2::FilteredAttributes` as a permanent API alias by @pboling
-
-### Deprecated
+- [gh!714][gh!714]Refactor sensitive-value filtering to use `auth-sanitizer` while preserving `OAuth2::FilteredAttributes` as a permanent API alias by @pboling
### Removed
- Remove the internal `OAuth2::ThingFilter` and `OAuth2::SanitizedLogger` implementations now provided by `auth-sanitizer` by @pboling
-### Fixed
-
### Security
- [gh!707][gh!707] Redact sensitive values from debug logging output, including Authorization headers and common token/secret fields in headers, query strings, form bodies, and JSON payloads by @pboling
- - NOTE: debug logging has always been, and remains, opt-in. It is turned off by defualt.
+ - NOTE: debug logging has always been, and remains, opt-in. It is turned off by default.
[gh!707]: https://github.com/ruby-oauth/oauth2/pull/707
+[gh!714]: https://github.com/ruby-oauth/oauth2/pull/714
## [2.0.18] - 2025-11-08
@@ -747,7 +763,9 @@ Please file a bug if you notice a violation of semantic versioning.
[gemfiles/readme]: gemfiles/README.md
-[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.18...HEAD
+[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.19...HEAD
+[2.0.19]: https://github.com/ruby-oauth/oauth2/compare/v2.0.18...v2.0.19
+[2.0.19t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.19
[2.0.18]: https://github.com/ruby-oauth/oauth2/compare/v2.0.17...v2.0.18
[2.0.18t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.18
[2.0.17]: https://github.com/ruby-oauth/oauth2/compare/v2.0.16...v2.0.17
diff --git a/Gemfile.lock b/Gemfile.lock
index 7b4b84441..a4889eec7 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,7 +1,7 @@
PATH
remote: .
specs:
- oauth2 (2.0.18)
+ oauth2 (2.0.19)
auth-sanitizer (~> 0.1)
faraday (>= 0.17.3, < 4.0)
jwt (>= 1.0, < 4.0)
@@ -22,7 +22,7 @@ GEM
rake (>= 10)
thor (>= 0.14)
ast (2.4.3)
- auth-sanitizer (0.1.1)
+ auth-sanitizer (0.1.2)
version_gem (~> 1.1, >= 1.1.9)
backports (3.25.3)
base64 (0.3.0)
@@ -386,7 +386,7 @@ CHECKSUMS
ansi (1.6.0) sha256=ac9ea0c0ea8d32fb4e271348e609963ac78882f34b73836c2a02b3622e666658
appraisal2 (3.0.6) sha256=09387896b6c8c8c0ff0749af691ddff5e3168de2f06b591a80d8fd8b6394d147
ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
- auth-sanitizer (0.1.1) sha256=e2607b13c27b005c72fbf12952afe8f8ad70156a08dadb99ae5487972290ca01
+ auth-sanitizer (0.1.2) sha256=29f7638d74b2a19ff890008f1561165668a78969a4d90bc85e991128825a7c03
backports (3.25.3) sha256=94298d32dc3c40ca15633b54e282780b49e2db0c045f602ea1907e4f63a17235
base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
benchmark (0.5.0) sha256=465df122341aedcb81a2a24b4d3bd19b6c67c1530713fd533f3ff034e419236c
@@ -436,7 +436,7 @@ CHECKSUMS
nokogiri (1.19.3-x86_64-darwin) sha256=77f3fba57d46c53ab31e62fc6c28f705109d1bf6264356c76f132b2be5728d4d
nokogiri (1.19.3-x86_64-linux-gnu) sha256=2f5078620fe12e83669b5b17311b32532a8153d02eee7ad06948b926d6080976
nokogiri (1.19.3-x86_64-linux-musl) sha256=248c906d2166eca5efb56d52fdee5f9a1f51d69a72e2b64fdac647b4ce39ea3f
- oauth2 (2.0.18)
+ oauth2 (2.0.19)
ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
diff --git a/README.md b/README.md
index 246e049bc..d067f9a00 100644
--- a/README.md
+++ b/README.md
@@ -1514,7 +1514,7 @@ Thanks for RTFM. ☺️
[📌gitmoji]: https://gitmoji.dev
[📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
[🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.526-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.515-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
[🔐security]: SECURITY.md
[🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
[🔐irp]: IRP.md
diff --git a/REEK b/REEK
index e69de29bb..c0f05d1fe 100644
--- a/REEK
+++ b/REEK
@@ -0,0 +1,2 @@
+./reek: 1: Error:: not found
+./reek: 2: Error:: not found
diff --git a/docs/OAuth2/AccessToken.html b/docs/OAuth2/AccessToken.html
index 686f2ca9d..e79bd4c9c 100644
--- a/docs/OAuth2/AccessToken.html
+++ b/docs/OAuth2/AccessToken.html
@@ -6,13 +6,13 @@
Class: OAuth2::AccessToken
- — Documentation by YARD 0.9.38
+ — Documentation by YARD 0.9.43
-
+
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Class: OAuth2::Authenticator
+
+
+
+
+
+
+
+ - Inherits:
+ -
+ Object
+
+
+ - Object
+
+ - OAuth2::Authenticator
+
+
+ show all
+
+
+
+
+
+
+
+
+
+
+ - Includes:
+ - FilteredAttributes
+
+
+
+
+
+
+
+
+ - Defined in:
+ - lib/oauth2/authenticator.rb
+
+
+
+
+
+
Overview
+
+
Builds and applies client authentication to token and revoke requests.
+
+
Depending on the selected mode, credentials are applied as Basic Auth
+headers, request body parameters, or only the client_id is sent (TLS).
+
+
+
+
+
+
+
+
+
+
+
+
Instance Attribute Summary collapse
+
+
+
+
+
+
+
+ Class Method Summary
+ collapse
+
+
+
+
+
+
+ Instance Method Summary
+ collapse
+
+
+
+
+
+
+
+
+
Constructor Details
+
+
+
+
+ #initialize(id, secret, mode) ⇒ Authenticator
+
+
+
+
+
+
+
+
Create a new Authenticator
+
+
+
+
+
+
+
+
+
+
+24
+25
+26
+27
+28
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 24
+
+def initialize(id, secret, mode)
+ @id = id
+ @secret = secret
+ @mode = mode
+end
+ |
+
+
+
+
+
+
+
+
Instance Attribute Details
+
+
+
+
+
+
+ #id ⇒ Symbol, ...
+
+
+
+
+
+
+
+
+
+
+
+
+16
+17
+18
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 16
+
+def id
+ @id
+end
+ |
+
+
+
+
+
+
+
+
+
+ #mode ⇒ Symbol, ...
+
+
+
+
+
+
+
+
+
+
+
+
+16
+17
+18
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 16
+
+def mode
+ @mode
+end
+ |
+
+
+
+
+
+
+
+
+
+ #secret ⇒ Symbol, ...
+
+
+
+
+
+
+
+
+
+
+
+
+16
+17
+18
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 16
+
+def secret
+ @secret
+end
+ |
+
+
+
+
+
+
+
+
+
Class Method Details
+
+
+
+
+
+ .encode_basic_auth(user, password) ⇒ String
+
+
+
+
+
+
+
+
Encodes a Basic Authorization header value for the provided credentials.
+
+
+
+
+
+
+
+
+
+
+60
+61
+62
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 60
+
+def encode_basic_auth(user, password)
+ "Basic #{Base64.strict_encode64("#{user}:#{password}")}"
+end
+ |
+
+
+
+
+
+
+
+
Instance Method Details
+
+
+
+
+
+ #apply(params) ⇒ Hash
+
+
+
+
+
+
+
+
Apply the request credentials used to authenticate to the Authorization Server
+
+
Depending on the configuration, this might be as request params or as an
+Authorization header.
+
+
User-provided params and header take precedence.
+
+
+
+
+
+
+
+
+
+
+39
+40
+41
+42
+43
+44
+45
+46
+47
+48
+49
+50
+51
+52
+ |
+
+ # File 'lib/oauth2/authenticator.rb', line 39
+
+def apply(params)
+ case mode.to_sym
+ when :basic_auth
+ apply_basic_auth(params)
+ when :request_body
+ apply_params_auth(params)
+ when :tls_client_auth
+ apply_client_id(params)
+ when :private_key_jwt
+ params
+ else
+ raise NotImplementedError
+ end
+end
+ |
+
+
+
+
+
+
+
+
+
+
+
+
+