01/21/2023
- clean WWW-Authenticate header in main request as well if this is a subrequest; closes #42
  this avoids the WWW-Authenticate header to be sent in HTTP 200 responses; thanks @ErmakovDmitriy
- depend on liboauth2 1.4.5.3
- release 3.3.1

12/06/2022
- change Makefile install procedure
- depend on liboauth2 1.4.5.2
- release 3.3.0

07/27/2022
- depend on liboauth2 1.4.5 with multi-treading fix for "OAuth2TokenVerify jwk <key>"
- release 3.2.3

07/01/2021
- change configure.ac to find Apache flags correctly

06/07/2021
- depend on liboauth2 1.4.2.1 with fixed iat slack validation defaults
- set WWW-Authenticate environment variable to allow for complex Require logic; see 
  https://github.com/zmartzone/mod_auth_openidc/discussions/572
  example:
  Header always append WWW-Authenticate %{OAUTH2_BEARER_SCOPE_ERROR}e "expr=(%{REQUEST_STATUS} == 401) && (-n reqenv('OAUTH2_BEARER_SCOPE_ERROR'))"  
- release 3.2.2

02/01/2021
- depend on liboauth2 1.4.1 with support for RFC 8705 mTLS Client Certificate bound access tokens
- release 3.2.1

12/22/2020
- depend on liboauth2 1.4.0
- release 3.2.0

11/13/2020
- add OAuth2CryptoPassphrase

11/10/2020
- allow setting a cache with OAuth2Cache

11/07/2020
- change Require keyword from "claim" to "oauth2_claim" to avoid interference with mod_auth_openidc
- depend on liboauth2 >= 1.4.0 with new oauth2_token_verify (dpop) interface
- bump to 3.2.0-dev

09/12/2019
- depend on liboauth2 1.2.0 with new request header API
- bump to 3.1.0

07/04/2019
- depend on liboauth2 1.1.1 with log encapsulation changes
- bump to 3.0.2

05/20/2019
- add Apache Require claim authorization functions
- bump to 3.0.1

03/22/2019
- initial import of version 3.0.0
