This patch release fixes concurrent requests with the same token failing because of another request's introspection call.

• When several requests with the same token arrived together, they shared one introspection call, and if that call failed, every waiting request failed with it. A request that had joined just before the backchannel HttpClient timeout could fail almost immediately with another request's timeout. Now only the request that started the call gets that failure, and each request that was waiting retries once with a call of its own. Errors returned by the introspection endpoint, and network errors, are still shared as before. #341 (fixes #281)
• Introspection now respects client disconnects. If the client of the request that started an introspection call disconnects, the call is cancelled and any requests waiting on it make their own call. A request whose client disconnects while it waits on another request's call stops waiting. Before this release, the introspection call always ran to completion. #341

This release targets .NET 8, .NET 9 and .NET 10.

This patch release fixes pushed authorization requests (PAR) using a different client authentication method than the token endpoint.

• PAR now uses OidcClientOptions.TokenClientCredentialStyle, the same setting the token endpoint uses. Before this release, PAR sent the client secret in the Authorization header, while the token endpoint sent it in the request body, which is the default. Providers that require one authentication method per client, such as Authelia, rejected this, and the only workaround was to turn PAR off. If you use a client secret with the default settings, PAR now sends it in the request body. #351 (fixes #349)
• Update Microsoft.Extensions.Logging.Abstractions and System.Text.Json to 10.0.13, and raise the minimum System.IdentityModel.Tokens.Jwt version for Duende.IdentityModel.OidcClient.Extensions to 8.19.2. #376

This release still targets netstandard2.0, .NET 8, .NET 9 and .NET 10.

This minor release of Duende.AccessTokenManagement introduces several improvements and a bug fix.

• Add per-client cache settings for client credentials tokens #368
• Make token max lengths configurable per flow #367
• Don't share user token refreshes across request parameters #366
• Downgrade user token log messages from Error to Warning #317
• Add XML docs for the public API #359
• Update dependencies to the October 2026 .NET servicing release #375

This minor release of Duende.AccessTokenManagement introduces several small improvements.

• Prevent Null Reference Exception in Non-HttpContext scenario #342
• Regenerate Client Assertions on DPoP nonce retry in AccessTokenManagement #345

This minor release adds support for dpop in combination with client assertions. (Note, DPoP is only available in .Net 8 and higher)

• Introduce the capability to refresh the dpop proof on a retry
  #344

This minor release introduces foundational capability to refresh Client Assertions. This is required to support client assertions with both PAR and DPoP.

• Introduce ClientAssertionFactory to allow refreshing of Client Assertions during retries #343

• Updated Duende.IdentityModel dependency to 8.0.1

• Update Duende.IdentityModel dependency to 8.0.1

Update Microsoft.Bcl.Memory dependency to 10.0.4 due to a vulnerability in Microsoft.Bcl.Memory GHSA-73j8-2gch-69rq

• .NET 10 users are not affected as this transitive dependency is conditionally excluded for projects that target .NET 10.
• .NET 8 and .NET 9 users are affect and need to either explicitly reference Microsoft.Bcl.Memory.10.0.4 or update to Duende.IdentityModel.8.0.1

• Update Duende.IdentityModel dependency to version 8.0.1