3720d57fb6
fix(sso): accept SAML responses addressed to the callbackUrl ACS ( #11730 )
...
Co-authored-by: kaiizer777 <292549577+kaiizer777@users.noreply.github.com >
2026-10-14 10:22:19 +01:00
54e96dd6b0
fix(oauth): persist account cookie after implicit linking ( #11300 )
...
Co-authored-by: Vishesh Verma <visheshverma250703@gmail.com >
2026-09-16 15:59:56 +09:00
c11bfa667f
chore: release v1.6.33 ( #11292 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-09-15 07:01:23 +09:00
ecc4e0df7b
fix(core): preserve database option type inference ( #11291 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
Co-authored-by: Alexey Sokolov <alexvyber@gmail.com >
2026-09-15 06:55:48 +09:00
c768d73625
chore: release v1.6.32 ( #11288 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-09-15 03:40:46 +09:00
a17efd7cf0
fix(captcha): log Turnstile verification failures ( #11286 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-09-15 03:32:33 +09:00
886311168d
chore: release v1.6.31 ( #11241 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-09-10 18:16:55 +09:00
0e58f97aa1
feat(instrumentation): add option to disable tracing ( #11228 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-09-09 19:03:39 +09:00
better-release[bot] and GitHub
e84ec5e76d
chore: release v1.6.30 ( #10840 )
2026-08-17 15:05:06 -04:00
Taesu and GitHub
07c17189f5
fix(core): prevent async context initialization races ( #10833 )
2026-08-17 17:37:39 +00:00
better-release[bot] and GitHub
58c49eb97f
chore: release v1.6.29 ( #10809 )
2026-08-14 14:15:00 -04:00
e6e1b4e814
perf(db): replace sequential get-then-delete loop with parallel deletes in deleteSessions ( #10805 )
...
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-08-14 13:42:47 +00:00
86faaee69b
chore: release v1.6.28 ( #10796 )
...
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-08-13 22:29:39 +00:00
Taesu and GitHub
773de54b18
fix(client): deduplicate settled session requests during Suspense retries ( #10769 )
2026-08-13 22:04:08 +00:00
Taesu and GitHub
2ad2928f96
fix(build): restore declaration compatibility ( #10794 )
2026-08-13 18:21:53 +00:00
Taesu and GitHub
c92a1ca27b
chore: upgrade next to 16.3 ( #10787 )
2026-08-13 18:06:00 +00:00
Fabian Hiller and GitHub
11b91e27c3
docs: fix validator JSDoc to mention Standard Schema ( #10761 )
2026-08-12 18:29:40 +00:00
better-release[bot] and GitHub
be47e9418b
chore: release v1.6.27 ( #10686 )
2026-08-11 13:56:17 -04:00
999acbd41d
Merge commit from fork
...
* fix(sso): bind domain verification to provider state
Complete domain verification with an atomic guarded transition keyed by the provider row, exact domain snapshot, and unverified state. Concurrent provider mutations now return a retryable conflict instead of applying stale DNS proof.
Document the conflict behavior and cover provider mutation, replacement, deletion, simultaneous verification, memory-adapter, and downstream trust cases.
* fix(sso): allow domain verification when the stored bit is null
* test(sso): assert the resolved DNS hostname outside the mock callback
* fix(sso): require verified domains for organization assignment
Use verified persisted provider domains and canonical verified user emails for domain-derived routing and organization membership. Keep explicit organization-bound SSO provisioning separate from domain trust.
* fix(sso): scope domain verification to organization assignment
* fix(sso): keep verified provider lookup internal
---------
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-08-11 13:50:45 -04:00
Taesu and GitHub
b8077b74ef
fix(cli): align packages with running CLI version ( #10743 )
2026-08-10 16:47:54 +00:00
Taesu and GitHub
2ae491eac3
fix(types): align auth endpoints with better-call ( #10657 )
2026-08-07 11:33:52 +00:00
Taesu and GitHub
90b5093447
fix(client): deduplicate session requests across suspense retries ( #10676 )
2026-08-04 22:25:16 +00:00
Taesu and GitHub
c3dc5726b4
test(electron): wait for session refresh after sign-out ( #10685 )
2026-08-05 07:18:26 +09:00
better-release[bot] and GitHub
a16b30e843
chore: release v1.6.26 ( #10521 )
2026-08-04 17:15:45 -04:00
Jeroen van der Merwe and GitHub
9ede8059b5
fix(rate-limit): await database cleanup by default ( #10619 )
2026-08-03 10:48:19 +00:00
Krish Vachhani and GitHub
af50c45553
fix(one-tap): preserve client plugin inference with oneTapClient ( #10635 )
2026-08-03 10:47:22 +00:00
Gustavo Valverde and GitHub
222facff55
fix(jwt): resolve the transaction-scoped adapter when signing ( #10623 )
2026-08-01 12:04:34 +00:00
d8327f1fea
fix(email-otp): verify OTP before revealing whether the email exists ( #10605 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-07-31 07:32:40 +00:00
Taesu and GitHub
e7b0eba327
fix(oauth-proxy): preserve Apple user data ( #10599 )
2026-07-31 07:11:05 +00:00
Taesu and GitHub
5a811f1b43
fix(email-otp): pass verification type on sign-up ( #10608 )
2026-07-31 06:06:06 +00:00
Gustavo Valverde and GitHub
e18606b1c4
chore(deps): upgrade OpenTelemetry to v2 ( #10601 )
2026-07-30 22:32:35 +00:00
ea38fcac74
fix(db): skip null-parsed session token in findSessions instead of returning early ( #10580 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-07-29 09:02:48 +00:00
7552a3b563
perf(next-js): reuse the next/headers import promise in production ( #10467 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-07-29 08:13:24 +00:00
Taesu and GitHub
a30e274b5d
feat(core): add placeholder email utility ( #10576 )
2026-07-29 08:00:42 +00:00
e2c73fbec8
fix(jwt): preserve client plugin inference with jwtClient ( #10513 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-27 16:25:27 +00:00
Jash Ramde Karangiya and GitHub
2ebd766d60
fix(redis-storage): use SCAN instead of KEYS to avoid blocking Redis ( #10507 )
2026-07-27 16:23:01 +00:00
Taesu and GitHub
2b4a14f180
fix(email-otp): preserve otp after password validation errors ( #10552 )
2026-07-27 16:09:28 +00:00
1190e0498f
chore(deps): bump @babel/core from 7.29.0 to 7.29.7 ( #10548 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-07-27 13:54:12 +09:00
Taesu and GitHub
2e011495c8
chore: bump vite ( #10538 )
2026-07-27 13:50:25 +09:00
65b9f78e6b
chore(deps): bump body-parser from 2.2.2 to 2.3.0 ( #10471 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-07-25 08:26:55 +00:00
343ec2a066
chore(deps): bump @sveltejs/kit from 2.60.1 to 2.70.1 ( #10525 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-07-25 08:03:24 +00:00
Taesu and GitHub
a03e4c1867
fix: clean up sessions on user deletion ( #10520 )
2026-07-24 23:57:29 +00:00
better-release[bot] and GitHub
07a646ea19
chore: release v1.6.25 ( #10491 )
2026-07-23 11:44:59 -04:00
James Jackson and GitHub
0ffd1fb28d
fix: send Apple OAuth PKCE challenge ( #10294 )
2026-07-23 11:34:54 -04:00
Birk Skyum and GitHub
743935991f
fix(solid): expose $fetch and $store on the solid client ( #10444 )
2026-07-23 11:26:44 -04:00
dac701c94b
chore(deps): bump next from 16.2.6 to 16.2.11 ( #10493 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-23 13:14:48 +00:00
5124c34879
fix(one-tap): enforce google provider signup restrictions ( #10479 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-07-23 02:49:04 +00:00
better-release[bot] and GitHub
9a661c7b7a
chore: release v1.6.24 ( #10323 )
2026-07-22 06:30:26 -04:00
c020a9d6a2
fix(sso): redirect idp initiated saml flows in split origin deployments ( #10388 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-07-22 06:14:46 -04:00
4e685eef42
fix(open-api): include plugin user fields on sign-up/update bodies ( #10453 )
...
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-07-19 12:00:29 +00:00
Fabian HillerandGitHub
Jeroen van der MerweandGitHub
Krish VachhaniandGitHub
Jash Ramde KarangiyaandGitHub
James JacksonandGitHub
Birk SkyumandGitHub
