[1.6.3] - 2026-08-17

Fixed

• The signature base string now applies RFC 5849 URI normalization (lowercase scheme and host, drop the default port, exclude the query and fragment), so requests with a query string, a default port, or a mixed-case host sign correctly.
• verify no longer double-encodes the token secret.
• form-decode splits each pair on the first = only, so padded base64 token secrets are no longer truncated.

[1.6.2] - 2026-07-12

Changed

• Migrate the build to deps.edn and tools.build, with Leiningen supported via lein-tools-deps.

[1.6.1]

• Bump commons-codec 1.18.0 to 1.22.0 and Bouncy Castle 1.80 to 1.84.

[1.6.0]

• Add RSA-SHA256 signatures.
• Accept PKCS#8 private keys in addition to PKCS#1.

[1.5.6]

• First release as net.clojars.savya/clj-oauth.
• Release HMAC-SHA256 support.
• Move to current Bouncy Castle, commons-codec, clj-http, and Clojure versions.