Remove JSONOAuthLibCore (deprecated in 3.4.1)

[dopry]

JSONOAuthLibCore (OAUTH2_PROVIDER["OAUTH2_BACKEND_CLASS"] = "oauth2_provider.oauth2_backends.JSONOAuthLibCore") makes the OAuth token, introspection, and revocation endpoints read application/json request bodies instead of application/x-www-form-urlencoded. Those endpoints are defined by spec to use form-urlencoded bodies:

• token endpoint — RFC 6749 §3.2
• token introspection — RFC 7662 §2.1
• token revocation — RFC 7009 §2.1

Reading JSON on these endpoints is non-standard: it makes the server non-interoperable with spec-compliant OAuth clients/libraries for no capability gain (any client can send a form-encoded body). It's a long-standing compatibility shim and was effectively undocumented.

It is deprecated in 3.4.1 — instantiating it now emits a DeprecationWarning. This issue tracks its removal in 4.0:

• Remove the JSONOAuthLibCore class from oauth2_provider/oauth2_backends.py
• Remove its tests (tests/test_oauth2_backends.py::TestJSONOAuthLibCoreBackend)
• Add a "Removed" CHANGELOG entry and note it in the upgrade/migration docs

Context: originally surfaced via #613 (JSON introspection), which was closed wontfix for the same RFC 7662 reason.

[dopry]

Deprecation shipped in #1774 — JSONOAuthLibCore.__init__ now emits a DeprecationWarning, with the deprecation noted in the docs and CHANGELOG. This issue tracks the removal in 4.0.

---

Generated by Claude Code

[aviseth]

Happy to do this removal — one question on target before I open anything.

master is on __version__ = "3.4.0", 3.4.1 shipped on 2026-08-21, and the ## [unreleased] section of CHANGELOG.md is accumulating 3.x work (the JSONOAuthLibCore deprecation entry for #1774 is itself still sitting there unreleased). Since this is a public-API removal milestoned 4.0, is master the right target now, or would you rather it wait for a 4.0 branch?

If master is fine I'll take it: delete the class from oauth2_provider/core/backends_oauthlib.py, drop TestJSONOAuthLibCoreBackend, sweep the tree for remaining references (the OAUTH2_BACKEND_CLASS docs and the validate_bcp_configuration import in core/checks.py both name it), and add ### Removed + upgrade-guide notes.