Changelog

Wicket follows Semantic Versioning. During the 0.x stage, minor version changes may include incompatible changes, so read the corresponding entry before upgrading. The complete record is in CHANGELOG.md at the repository root.

v0.1.4 · 2026-08-21

• Toolchain: the development toolchain is pinned to the Go 1.27.0 stable release (previously a 1.27 pre-release). The go 1.27 declaration in go.mod is unchanged, so downstream modules are not affected.
• No production code changes.

v0.1.3 · 2026-08-08

• Fix: ClaimsIdentity now survives a full JSON round trip. Previously its internal fields were silently dropped during serialization, so any persistent adapter lost the subject claims in authorization codes, refresh tokens, device codes, and backchannel requests after the first write and read — showing up as access tokens without sub at the UserInfo endpoint. Hosts that use persistent storage should upgrade as soon as possible.
• Docs: the in-repository documentation was refreshed throughout, and a root README was added.

v0.1.2 · 2026-08-07

• CI adjustments and documentation alignment; no API changes.

v0.1.1 · 2026-08-07

• Added: generic accessors on the composition root, Get[T any]() (T, bool) and GetRequired[T any]() T.
• The dependency injection container was regenerated with a pinned version of the generator.

v0.1.0 · 2026-08-07

The first version that can be pulled in with go get github.com/gonewx/wicket.

• Finalized the public storage ports: context.Context as the first parameter, sentinel errors when a record doesn't exist, handle-based access, versioned refresh token updates (optimistic concurrency), and expiration decided uniformly on the core side. Note: as of v0.1.4, refresh token expiration and rotation policies are not implemented yet; see Refresh token.
• Conformance suites for adapter authors: storage/storagetest, session/sessiontest, and keymgmt/keymgmttest, each exporting SuiteVersion; adapters declare the version they follow with ConformsTo().
• Host-side storage injection seams: in-memory fallback is allowed only when explicitly declared, with checks at wiring time; a unified root lifecycle handles resource release.
• Stateless external credential verification packages: Apple / Google (local signature validation), WeChat and phone number (server-side exchange).

Related reading

• Persistence
• Writing a storage adapter