ueberauth_steam_strategy

## 0.2.0 - 2026-08-18

- Breaking: require Poison `~> 6.0`. Consumers are now pinned to Poison 6 and can
  no longer resolve 4.x or 5.x. The call surface is unaffected — `Poison.decode/2`
  and the `keys: :atoms` option are byte-identical between 4.0.1 and 6.0.0.
- Breaking: minimum Elixir is now `~> 1.12`, matching Poison 6's own requirement.
- Changed: updated every dependency to its latest release, including Ueberauth
  0.6.3 -> 0.10.8 and meck 0.8.13 -> 1.2.0.
- Changed: raised dev/test requirements that had capped themselves below their
  current major — dialyxir `~> 0.5` -> `~> 1.4`, meck `~> 0.8.4` -> `~> 1.2`.
- Security: the committed lockfile's transitive Plug moved 1.11.0 -> 1.20.3,
  clearing CVE-2026-8468 (HIGH), CVE-2026-56814 (MEDIUM) and CVE-2026-56813 (LOW)
  from this repo's own CI. Consumers resolve their own Plug and were never exposed
  through this package.
- Removed: dead `require Logger` left behind when debug logging was dropped in 0.1.6.
- Changed: maintainership. Dragos Daian is now listed as maintainer alongside
  original author Ian Luites, and the package's repository links point at the
  appsinacup fork this is published from, with upstream credited separately.
- Changed: the CHANGELOG now ships in the package and on hexdocs; it was absent
  from the `files` list before.
- Fixed: LICENSE carried two stacked copies of the MIT text, the first with an
  empty copyright holder. Consolidated to a single text retaining all three
  holders (Ian Luites, kouwasi, Dragos Daian).
- Fixed: compiles warning-free on Elixir 1.20 — `:preferred_cli_env` replaced with
  `def cli/0`, `use Mix.Config` with `import Config`, and `use Plug.Test` with
  explicit `import Plug.Test` / `import Plug.Conn`.

## 0.1.6 - 2026-07-01

- Changed: require HTTPoison ~> 3.0 so downstream apps use patched Hackney 4.x.
- Changed: update ExCoveralls test dependency to avoid pulling vulnerable Hackney through test-only deps.

## 0.1.4 - 2025-11-28

- Fix: remove stray/unimplemented auth/1 head to avoid CI compile errors when used as a dependency.

## 0.1.3 - 2025-11-28

- Update dependencies: httpoison -> ~> 2.0, credo -> ~> 1.7

## 0.1.5 - 2025-11-29

- Fix: Proper CSRF state handling and validation:
	- Strategy now stores a 'state' token during the request phase (session + response cookie) and validates state on callback.
	- Callback validation checks session, cookie, and CSRF-derived state candidates and short-circuits early on CSRF mismatches so later validation cannot overwrite the error.
- Tests: Added/updated unit tests to cover state round-trip flows, cookie-only scenarios, session-only scenarios, missing/mismatched state cases, and valid happy paths.
- Changed: bumped package version to 0.1.5 and updated HTTP client dependency to HTTPoison ~> 2.0.
- Note: This release will be published to Hex under the package name `ueberauth_steam_strategy` due to the original `ueberauth_steam` name being already registered.