AppAuth 3.0.0

Summary:
This is a breaking release, required to support Xcode 27. Minimum deployment targets are bumped to iOS 15.0, macOS 12.0, tvOS 15.0 and watchOS 9.0. Swift Package Manager users will need Swift 5.7 / Xcode 14 or later to resolve the package.

Separately, resumeExternalUserAgentFlowWithURL:error: is now a required member of OIDExternalUserAgentSession to allow access by Swift callers. Projects that must keep supporting iOS 12-14 should stay on AppAuth 2.x, which remains buildable with Xcode 26 and earlier.

Detailed Changelog:

• BREAKING: Updates made to support Xcode 27. (#972, #973)
  -- Raised minimum deployment targets to iOS 15.0, macOS 12.0, tvOS 15.0 and watchOS 9.0 (minimum for Xcode 27).
  -- Swift Package Manager users: The required swift-tools-version bump from 5.3 to 5.7, to pickup the new platforms, results in package resolution now requiring Swift 5.7 / Xcode 14 or later.
  -- Projects that must keep supporting iOS 12-14 should stay on AppAuth 2.x, which remains buildable with Xcode 26 and earlier.
• BREAKING: resumeExternalUserAgentFlowWithURL:error: is now required in OIDExternalUserAgentSession to fix a Swift compiler crash (no workaround) caused by its @optional status with NSError **. Implementers must now provide this method. Affects projects since 2.1.0. (#955, #970)
• Swift callers now spell the method resumeExternalUserAgentFlow(_:). Since the method is no longer optional, you don't need optional-chaining anymore. For those migrating from 2.1.0, replace try session.resumeExternalUserAgentFlow?(with: url) with try session.resumeExternalUserAgentFlow(url). Objective-C callers are unaffected. (#966, #970)
• Replace case range with explicit case labels in OIDTokenUtilities. Addresses issue #947. (#963)
• Update the addressable gem to address CVE-2026-35611. Addresses issue #958. (#965)

AppAuth 2.1.0

Summary:
This release removes fallbacks to the external browser whenever ASWebAuthenticationSession isn't able to start. This could be caused by Guided Access mode - which will now fail with an error rather than crashing. In addition, the release adds a new SwiftUI + SPM sample app to make testing changes easier in a modern dev environment.

Changelog:

• Add SwiftUI + Swift Package Manager sample app under Examples/Example-iOS_Swift-SPM. (#952)
• Removed external browser (Safari) fallback from OIDExternalUserAgentIOS. If ASWebAuthenticationSession fails to start (e.g., Guided Access is enabled), the authorization flow now fails with an error instead of opening an external browser. (#954)
• Added resumeExternalUserAgentFlowWithURL:error: to OIDExternalUserAgentSession protocol, returning errors via an out-parameter instead of throwing NSException. The previous method is deprecated and forwards to the new one. (#955)
• Added OIDErrorCodeURLMismatch and OIDErrorCodeInvalidAuthorizationFlow error codes. (#955)

AppAuth 2.0.0

• Raise minimum supported iOS version to iOS 12. (#918)
• Remove deprecated [UIApplication openURL:] method to compile with Xcode 16. (#911)

AppAuth 1.7.6

• Fix OIDExternalUserAgentIOSCustomBrowser on versions iOS 10+ (#871)
• Update runners in tests.yml to macos-13. (#886)

AppAuth 1.7.5

• Use correct xcconfig syntax for podspec (#851)

AppAuth 1.7.4

• Adds defines module to AppAuth.podspec (#845)

AppAuth 1.7.3

• Fix missing manifest in bundle using SPM (#833)

AppAuth 1.7.2

• Streamline copying of privacy manifest (#830)

AppAuth 1.7.1

• Add back missing method to OIDAuthorizationResponse (#825)
• Fix OIDTokenRequest for AppAuthCore and AppAuthTV (#826)

AppAuth 1.7.0

• Introduce addtional http headers to OIDTokenRequest (#770)
• Fix nullability annotation for -[OIDExternalUserAgentIOS init] (#727)
• Feat: allow custom nonce in OIDAuthorizationRequest (#788)
• Introduce addtional http headers to OIDTokenRequest (#770)
• Add privacy manifest (#822)