Upgrade to release 4.0.1:
- CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token
endpoint did not validate the device_code parameter. A request
with a known client_id and a bogus device_code could obtain a
bearer token. DeviceCodeGrant.validate_token_request now calls
DeviceCodeGrant.validate_device_code(), which rejects missing or
unknown device codes (invalid_request / invalid_grant) and
delegates the code's authorization status to the new
RequestValidator.validate_device_code() hook, per RFC 8628
Section 3.5.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
