🔒 Security

• Fix Timing Attack Vulnerability in SCRAM Authentication

👻 Maintenance

• Updated dependencies and maven plugins.
• Use central-publishing-maven-plugin to deploy to Maven Central.

🏗️ Improvements

• Ensure the LICENSE file is included in the Jar file.
• Update of the saslprep dependency to 2.2.

👻 Maintenance

• Added coverage report module.
• Updated dependencies and maven plugins.
• Remove nexus-staging-maven-plugin.

Full Changelog: 3.0...3.1

💥 Breaking changes

• ⚠️ Full refactor of the scram java implementation, this release is compatible with Java 8+, but it's incompatible with previous releases ⚠️

🚀 New features

• Fully rewrite the ScramClient allowing negotiation of channel-binding properly.
• Create Multi-release Modular JARs, the modules names are:
  • com.ongres.scram.common for the common scram messages.
  • com.ongres.scram.client for the scram client implementation.
• Add StringPreparation.POSTGRESQL_PREPARATION, for any error in SASL preparation, it falls back to return the raw string.
• Now the released jars are reproducible.
• Publish CycloneDX SBOM.
• Implementation of tls-server-end-point channel binding data extraction.

🏗️ Improvements

• Update of the saslprep dependency to 2.1.
• Now the password is passed as a char[].
• Improve Javadoc documentation.

👻 Maintenance

• Migrate the main repo back to GitHub.
• Remove the shaded Bouncy Castle pbkdf2 and base64 implementation used for Java 7 support.