web/server/vendor/github.com/xdg-go/scram/CHANGELOG.md

CHANGELOG

v1.2.0 - 2025-11-24

Added

• Channel binding support for SCRAM-PLUS variants (RFC 5929, RFC 9266)
• GetStoredCredentialsWithError() method that returns errors from PBKDF2 key derivation instead of panicking.
• Support for Go 1.24+ stdlib crypto/pbkdf2 package, which provides FIPS 140-3 compliance when using SHA-256 or SHA-512 hash functions.

Changed

• Minimum Go version bumped from 1.11 to 1.18.
• Migrated from github.com/xdg-go/pbkdf2 to stdlib crypto/pbkdf2 on Go 1.24+. Legacy Go versions (<1.24) continue using the external library via build tags for backward compatibility.
• Internal error handling improved for PBKDF2 key derivation failures.

Deprecated

• GetStoredCredentials() is deprecated in favor of GetStoredCredentialsWithError(). The old method panics on PBKDF2 errors to maintain backward compatibility but will be removed in a future major version.

Notes

• FIPS 140-3 compliance is available on Go 1.24+ when using SCRAM-SHA-256 or SCRAM-SHA-512 with appropriate salt lengths (≥16 bytes). SCRAM-SHA-1 is not FIPS-approved.

v1.1.2 - 2022-12-07

• Bump stringprep dependency to v1.0.4 for upstream CVE fix.

v1.1.1 - 2022-03-03

• Bump stringprep dependency to v1.0.3 for upstream CVE fix.

v1.1.0 - 2022-01-16

• Add SHA-512 hash generator function for convenience.

v1.0.2 - 2021-03-28

• Switch PBKDF2 dependency to github.com/xdg-go/pbkdf2 to minimize transitive dependencies and support Go 1.9+.

v1.0.1 - 2021-03-27

• Bump stringprep dependency to v1.0.2 for Go 1.11 support.

v1.0.0 - 2021-03-27

• First release as a Go module