What should be in v5.0.0

[jankapunkt]

The milestone for v5 is here: https://github.com/node-oauth/node-oauth2-server/milestone/1

From what I see we should get rid of dependencies that are nowadays deeply integrated into the node environment:

• remove bluebird and callbacks related
• promisify-any
• util.inherits

I think these are definitley to be added.

I also see implementing PKCE as crucial feature but we still need people to test this one in their environments. I am going to integrate it in ours but we only cover the authorization code workflow. How can we get more people to test such a feature? Maybe publish release-candidates on NPM, containing only this feature as addition?

What else from the open issues should be included into v5? I have some candidate issues that are still floating around:

• scope bug, related
• [meta] list of original project pr (some issues are left)
• InvalidClientError should return 401
• Confirmance tests
• b64 regex token checks
• Missing tests
• SonarQube: Weak Cryptography in generateRandomToken
• Missing distinction between public and confidential clients
• validateScope and veryifyScope are anti-patterns?!