Release 3.0.1

[senid231]

Bumps the version to 3.0.1 and moves the changelog's Unreleased entry under 3.0.1.

Patch release: it ships one fix, #27.

Fixes

• OIDC filter_parameters entries match exact keys instead of substrings, so host params such as code_id, state_eq and order[state] show up in logs again (filter_parameters symbols hide host params like code_id and state_eq #26, Anchor OIDC filter_parameters so host params like code_id and state_eq stay visible #27). Token keys (code_verifier, id_token, access_token, refresh_token) are filtered at any depth. code, state, session_state and nonce are filtered only at the top level.

Check before upgrading

Up to 3.0.0 the engine hid every param whose name contained code, state, nonce or a token name, at any depth. After 3.0.1 these show in logs in plain text:

• names that only contain those words, such as invite_code, reset_code, verification_code;
• nested code, state, session_state, nonce, such as user[code].

Hosts must add any of these that carry secrets to their own filter_parameters. The CHANGELOG spells this out with an example.

This ships as a patch because the old filtering was a bug, not a documented contract.