chore: release v0.3.2

CHANGELOG.md

@@ -7,6 +7,47 @@ project follows [Semantic Versioning](https://semver.org/) while the API is stil
 
 ## [Unreleased]
 
+## [0.3.2](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.2) - 2026-07-26
+
+### Changed
+
+- Harden SSO provider trust ([#183](https://github.com/salasebas/rustauth/pull/183))
+- [codex] Add verified Generic OIDC profile extraction ([#186](https://github.com/salasebas/rustauth/pull/186))
+- [codex] Preserve offline refresh-token semantics ([#205](https://github.com/salasebas/rustauth/pull/205))
+- release v0.3.1 ([#175](https://github.com/salasebas/rustauth/pull/175))
+- update Cargo.lock dependencies
+- *(release)* add release-plz automation
+
+### Fixed
+
+- *(stripe)* validate success redirect
+- fail closed when OIDC HTTP client build fails ([#176](https://github.com/salasebas/rustauth/pull/176))
+- *(sso)* harden saml acs idp-initiated responses
+- *(sso)* require org admin for provider registration ([#196](https://github.com/salasebas/rustauth/pull/196))
+- *(sso)* enforce saml assertion signature policy ([#200](https://github.com/salasebas/rustauth/pull/200))
+- *(sso)* require signed SAML SLO logout requests ([#201](https://github.com/salasebas/rustauth/pull/201))
+- *(sso)* prevent provider update org reassignment ([#198](https://github.com/salasebas/rustauth/pull/198))
+- fix scim filter complexity limits ([#177](https://github.com/salasebas/rustauth/pull/177))
+- *(scim)* deny empty required role allow-list
+- *(sso)* cap SAML SLO message inflation ([#184](https://github.com/salasebas/rustauth/pull/184))
+- *(plugins)* restrict email OTP verification endpoints
+- *(plugins)* reject unverified generic oauth id tokens ([#179](https://github.com/salasebas/rustauth/pull/179))
+- fix generic oauth fail-closed http client ([#180](https://github.com/salasebas/rustauth/pull/180))
+- fix phone otp storage ([#182](https://github.com/salasebas/rustauth/pull/182))
+- reject protected admin user updates ([#185](https://github.com/salasebas/rustauth/pull/185))
+- *(organization)* authorize invitation team assignment
+- *(organization)* authorize add-member team assignment
+- *(admin)* reject reserved create-user data fields ([#199](https://github.com/salasebas/rustauth/pull/199))
+- *(phone-number)* require password before sign-in OTP ([#202](https://github.com/salasebas/rustauth/pull/202))
+- *(passkey)* bind verification to challenge config
+- fix oauth client reference id update ([#181](https://github.com/salasebas/rustauth/pull/181))
+- *(oauth)* enforce skip-consent boundary
+- *(oauth)* prevent public client downgrade
+- *(oauth)* bind introspection and revocation to clients
+- break plugins/fred dev-dep cycle and repair post-0.3.0 CI
+- repair release preflight ([#207](https://github.com/salasebas/rustauth/pull/207))
+- *(ci)* restore failing checks ([#208](https://github.com/salasebas/rustauth/pull/208))
+
 ## [0.3.1](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.1) - 2026-07-02
 
 ### Changed

Cargo.toml

@@ -35,7 +35,7 @@ default-members = [
 ]
 
 [workspace.package]
-version = "0.3.1"
+version = "0.3.2"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/salasebas/rustauth"
@@ -60,38 +60,38 @@ josekit = "0.10"
 hkdf = "0.12"
 data-encoding = "2"
 deadpool-postgres = "0.14.1"
-rustauth-core = { path = "crates/rustauth-core", version = "0.3.1", default-features = false }
-rustauth-i18n = { path = "crates/rustauth-i18n", version = "0.3.1" }
-rustauth-oidc = { path = "crates/rustauth-oidc", version = "0.3.1" }
-rustauth = { path = "crates/rustauth", version = "0.3.1" }
+rustauth-core = { path = "crates/rustauth-core", version = "0.3.2", default-features = false }
+rustauth-i18n = { path = "crates/rustauth-i18n", version = "0.3.2" }
+rustauth-oidc = { path = "crates/rustauth-oidc", version = "0.3.2" }
+rustauth = { path = "crates/rustauth", version = "0.3.2" }
 actix-web = { version = "4.13", default-features = false }
 axum = "0.8"
 camino = { version = "1.1", features = ["serde1"] }
 cargo_metadata = "0.19"
 clap = { version = "4.5", features = ["derive", "env"] }
 clap_complete = "4.5"
 inquire = "0.7"
-rustauth-oauth = { path = "crates/rustauth-oauth", version = "0.3.1", default-features = false }
-rustauth-oauth-provider = { path = "crates/rustauth-oauth-provider", version = "0.3.1" }
-rustauth-fred = { path = "crates/rustauth-fred", version = "0.3.1" }
-rustauth-plugins = { path = "crates/rustauth-plugins", version = "0.3.1" }
-rustauth-passkey = { path = "crates/rustauth-passkey", version = "0.3.1" }
-rustauth-redis = { path = "crates/rustauth-redis", version = "0.3.1" }
-rustauth-scim = { path = "crates/rustauth-scim", version = "0.3.1" }
-rustauth-social-providers = { path = "crates/rustauth-social-providers", version = "0.3.1" }
-rustauth-saml = { path = "crates/rustauth-saml", version = "0.3.1" }
-rustauth-sqlx = { path = "crates/rustauth-sqlx", version = "0.3.1", default-features = false }
-rustauth-sso = { path = "crates/rustauth-sso", version = "0.3.1", default-features = false }
-rustauth-stripe = { path = "crates/rustauth-stripe", version = "0.3.1" }
-rustauth-telemetry = { path = "crates/rustauth-telemetry", version = "0.3.1", default-features = false }
-rustauth-deadpool-postgres = { path = "crates/rustauth-deadpool-postgres", version = "0.3.1" }
+rustauth-oauth = { path = "crates/rustauth-oauth", version = "0.3.2", default-features = false }
+rustauth-oauth-provider = { path = "crates/rustauth-oauth-provider", version = "0.3.2" }
+rustauth-fred = { path = "crates/rustauth-fred", version = "0.3.2" }
+rustauth-plugins = { path = "crates/rustauth-plugins", version = "0.3.2" }
+rustauth-passkey = { path = "crates/rustauth-passkey", version = "0.3.2" }
+rustauth-redis = { path = "crates/rustauth-redis", version = "0.3.2" }
+rustauth-scim = { path = "crates/rustauth-scim", version = "0.3.2" }
+rustauth-social-providers = { path = "crates/rustauth-social-providers", version = "0.3.2" }
+rustauth-saml = { path = "crates/rustauth-saml", version = "0.3.2" }
+rustauth-sqlx = { path = "crates/rustauth-sqlx", version = "0.3.2", default-features = false }
+rustauth-sso = { path = "crates/rustauth-sso", version = "0.3.2", default-features = false }
+rustauth-stripe = { path = "crates/rustauth-stripe", version = "0.3.2" }
+rustauth-telemetry = { path = "crates/rustauth-telemetry", version = "0.3.2", default-features = false }
+rustauth-deadpool-postgres = { path = "crates/rustauth-deadpool-postgres", version = "0.3.2" }
 diesel = { version = "2.3", default-features = false }
 diesel-async = { version = "0.9", default-features = false }
-rustauth-diesel = { path = "crates/rustauth-diesel", version = "0.3.1", default-features = false }
-rustauth-tokio-postgres = { path = "crates/rustauth-tokio-postgres", version = "0.3.1" }
-rustauth-actix-web = { path = "crates/rustauth-actix-web", version = "0.3.1" }
-rustauth-axum = { path = "crates/rustauth-axum", version = "0.3.1" }
-rustauth-cli = { path = "crates/rustauth-cli", version = "0.3.1" }
+rustauth-diesel = { path = "crates/rustauth-diesel", version = "0.3.2", default-features = false }
+rustauth-tokio-postgres = { path = "crates/rustauth-tokio-postgres", version = "0.3.2" }
+rustauth-actix-web = { path = "crates/rustauth-actix-web", version = "0.3.2" }
+rustauth-axum = { path = "crates/rustauth-axum", version = "0.3.2" }
+rustauth-cli = { path = "crates/rustauth-cli", version = "0.3.2" }
 openidconnect = { version = "4.0.1", default-features = false, features = ["reqwest", "rustls-tls"] }
 publicsuffix2 = { version = "0.5.2", default-features = false, features = ["std", "idna"] }
 quick-xml = "0.41"

crates/rustauth-cli/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.3.2](https://github.com/salasebas/rustauth/compare/v0.3.1...v0.3.2) - 2026-07-26
+
+### Changed
+
+- update Cargo.lock dependencies
+
 ## [0.3.0] - 2026-06-15
 
 ### Added

crates/rustauth-core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.3.2](https://github.com/salasebas/rustauth/compare/v0.3.1...v0.3.2) - 2026-07-26
+
+### Fixed
+
+- *(ci)* restore failing checks ([#208](https://github.com/salasebas/rustauth/pull/208))
+
 ## [0.3.1](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.1) - 2026-07-02
 
 ### Fixed

crates/rustauth-fred/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.3.2](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.2) - 2026-07-26
+
+### Changed
+
+- release v0.3.1 ([#175](https://github.com/salasebas/rustauth/pull/175))
+
+### Fixed
+
+- break plugins/fred dev-dep cycle and repair post-0.3.0 CI
+- repair release preflight ([#207](https://github.com/salasebas/rustauth/pull/207))
+
 ## [0.3.1](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.1) - 2026-07-02
 
 ### Fixed

crates/rustauth-oauth-provider/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.3.2](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.2) - 2026-07-26
+
+### Changed
+
+- release v0.3.1 ([#175](https://github.com/salasebas/rustauth/pull/175))
+- [codex] Preserve offline refresh-token semantics ([#205](https://github.com/salasebas/rustauth/pull/205))
+
+### Fixed
+
+- fix oauth client reference id update ([#181](https://github.com/salasebas/rustauth/pull/181))
+- *(oauth)* enforce skip-consent boundary
+- *(oauth)* prevent public client downgrade
+- *(oauth)* bind introspection and revocation to clients
+
 ## [0.3.1](https://github.com/salasebas/rustauth/compare/v0.3.0...v0.3.1) - 2026-07-02
 
 ### Fixed