Changelog

0.2.1 — 2026-06-10

Security hardening.

TokenIssuer validates secret/private_key presence and HMAC key length at construction, so misconfiguration fails at startup instead of on the first token issuance (CWE-665).
JWT jti now uses secrets.token_hex instead of uuid4 (CWE-330).
A warning is emitted when audience is unset (audience verification disabled) and the first time an in-memory revoked token is recorded (it does not propagate across worker processes).
verify_password only treats credential mismatch / invalid-hash as a failed check; unexpected errors are logged instead of silently returning False (CWE-755).

Security hardening.

401 responses now return a generic "Invalid or expired token" detail; the underlying PyJWT message is logged at DEBUG instead of leaked to clients (CWE-201).
TokenIssuer rejects HMAC secrets shorter than 32 bytes per RFC 7518 §3.2 (CWE-1022).
requires_scopes uses explicit scope → scopes precedence so an explicit empty scope no longer silently falls back (CWE-840).
requires_scopes() with no arguments raises ValueError at construction rather than producing a permissive dependency (CWE-284).
Reserved JWT claims (exp, iat, jti, type, sub, iss, aud, nbf) supplied via extra_claims are dropped with a warning instead of overwriting issuer-controlled values.
PasswordHasher now uses explicit OWASP-aligned argon2id parameters (time_cost=3, memory_cost=65536, parallelism=4).
The active-issuer registry uses WeakKeyDictionary to avoid the id(app) ABA hazard.

Initial release.