The flows shown in the dot graph (see #642 (comment)) uncovered an issue in the order of the calls.

Resource Owner Password Grant

validate_grant_type is called AFTER validate_user, which can lead to unexpected behavior depending of the validate_user implementation (e.g. create a session on the idP side but should be forbidden). For the other flows, validate_grant_type is correctly called BEFORE.

Since it changes the request validator calling order, it is considered as a breaking change.