Gustavo Valverde
381fc6cfaf
chore: sync main to next
2026-06-11 18:18:13 -07:00
Gautam Manchandani and GitHub
bf39cbf13f
feat(phone-number): add server-side OTP consumption API ( #9766 )
2026-06-11 16:58:16 -07:00
Taesu and GitHub
b36c38f984
feat(captcha)!: support wildcard endpoint matching ( #10004 )
2026-06-11 23:47:25 +00:00
Damien Maspero and GitHub
e468ff37ce
docs: update Node.js built-in SQLite status to Release Candidate ( #9914 )
2026-06-10 23:13:39 -07:00
Taesu and GitHub
3e99e6c77e
fix(admin): create credential account in setUserPassword when missing ( #9482 )
2026-06-11 05:36:55 +00:00
6987c628f1
fix(cli): resolve SvelteKit, Vite asset, and Cloudflare virtual-module imports ( #9834 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-11 01:06:43 +00:00
Gustavo Valverde
d7bba8ee33
Merge origin/next into chore/sync-main-to-next
2026-06-10 11:34:38 -07:00
Gustavo Valverde
bf7f2c5b4e
chore: sync main to next
2026-06-10 11:30:38 -07:00
Eric Luce and GitHub
82dbc9b8bf
docs: add ProofKit FileMaker adapter ( #9980 )
2026-06-10 11:26:02 -07:00
Prakash Kumar and GitHub
128bc34572
docs: add horizontal scrolling to landing page code block ( #9975 )
2026-06-09 23:22:24 -07:00
Bereket Engida and GitHub
cb1cbfa4cc
fix: address bug findings across packages ( #9974 )
2026-06-09 19:46:12 -07:00
Gustavo Valverde and GitHub
87e7aa5e0f
fix(api): validate Origin/Referer on cookieless email sign-in and sign-up ( #9973 )
2026-06-10 01:43:41 +00:00
Gustavo Valverde and GitHub
76a33429fc
fix(session): fire session-delete hooks for preserved sessions on secondaryStorage ( #9969 )
2026-06-10 00:40:56 +00:00
Gustavo Valverde and GitHub
3e852a2650
fix(oauth-provider): report unsupported_token_type for JWT access-token revocation ( #9970 )
2026-06-10 00:39:26 +00:00
Gustavo Valverde and GitHub
7abaaed53f
fix(oauth-provider): make private_key_jwt jti single-use atomic across processes ( #9964 )
2026-06-10 00:36:06 +00:00
Gustavo Valverde and GitHub
ec8a38c08f
feat(generic-oauth): verify discovery id_tokens and enable id_token sign-in ( #9966 )
2026-06-10 00:34:26 +00:00
Paola Estefanía de Campos and GitHub
afcb4dd7f3
docs(two-factor): document newSession is null during 2FA challenge ( #9957 )
2026-06-09 13:15:00 -07:00
Taesu and GitHub
6a8dfa4f3e
docs(changelog): show contributor avatars with proper size and styling ( #9956 )
2026-06-09 19:44:32 +00:00
Gustavo Valverde and GitHub
af572166a2
fix(auth)!: harden validateUserInfo source contract ( #9940 )
2026-06-07 22:52:59 -07:00
0cbaf81bed
feat(oauth): server-trusted state channel; fix anonymous cookieless linking ( #9930 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-08 01:00:05 +00:00
91f235f860
feat(auth): add per-provider requireEmailVerification for social sign-in ( #9929 )
...
Co-authored-by: Gautam Manchandani <161146829+GautamBytes@users.noreply.github.com >
2026-06-08 00:31:20 +00:00
e0140297a5
fix(electron)!: enforce S256 PKCE and harden origin checks ( #9645 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 23:43:06 +00:00
d23735b1de
feat(passkey): resolve authenticator name from AAGUID at read time ( #9927 )
...
Co-authored-by: Maxwell Weru <1645026+mburumaxwell@users.noreply.github.com >
2026-06-07 23:22:39 +00:00
ea64709ae6
docs: security update for June 2026 ( #9884 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-07 14:41:58 -07:00
41cca606d1
feat(auth): add user.validateUserInfo provisioning gate ( #9864 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-07 14:34:48 -07:00
Gustavo Valverde and GitHub
b32094a46d
docs(oauth-provider): reframe back-channel logout changeset and fill doc gaps ( #9916 )
2026-06-06 07:39:23 -07:00
Gustavo Valverde and GitHub
e0d2b9eb9b
feat(oauth-provider)!: add OIDC back-channel logout ( #9304 )
2026-06-06 07:06:53 -07:00
74c32fe56e
docs: clarify organization-owned api keys also require a user ( #9780 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-05 21:09:03 -07:00
7fe0e2b165
feat: add clientAssertion support to the Microsoft Entra ID social provider ( #9898 )
...
Co-authored-by: Bereket Engida <86073083+Bekacru@users.noreply.github.com >
Co-authored-by: Bereket Engida <Bekacru@gmail.com >
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-05 20:28:46 -07:00
Suliman Abdulrazzaq and GitHub
f3396987a9
docs: add DBSC plugin documentation ( #9892 )
2026-06-05 18:58:50 -07:00
Gustavo Valverde and GitHub
40b392ae21
feat(oauth)!: accumulate granted scopes as grantedScopes string[] ( #9825 )
2026-06-04 17:54:52 -04:00
Decker and GitHub
3bc7d09083
docs: restore Commet plugin documentation ( #9798 )
2026-06-04 20:46:46 +09:00
17130ec6ef
docs: mention minimal import option in installation guide ( #9891 )
...
Co-authored-by: Parship Chowdhury <parshipchowdhury@gmail.com >
2026-06-03 21:37:23 +00:00
Taesu and GitHub
695753106d
docs: update community adapters ( #9881 )
2026-06-03 09:11:14 +00:00
Gustavo Valverde and GitHub
2d9781a83d
fix(organization): split invitation verification gates ( #9877 )
2026-06-02 16:45:44 -04:00
Taesu and GitHub
840a56a8ce
docs(organization): document clearing logo with null ( #9858 )
2026-06-01 06:12:01 +00:00
Gustavo Valverde and GitHub
b4b086722c
fix(oauth-provider)!: bind RFC 8707 resource indicators to the authorization grant ( #9836 )
2026-05-31 14:14:50 +01:00
Gustavo Valverde and GitHub
a8ea86e25e
fix(scim)!: always bind personal SCIM connections to their creator ( #9840 )
2026-05-31 12:53:18 +00:00
Gustavo Valverde
065f5ad72d
chore: sync main to next
...
Brings the v1.6.13 stable fixes into next: redirect_uri scheme validation in oidc-provider and mcp (#9838 ), clientPrivileges enforcement on dynamic client registration (#9837 ), null organization logo support (#9842 ), the consumeOne non-numeric deleteMany guard (#9831 ), and the db-adapter guide alignment (#9830 ).
Conflicts were limited to release version bumps and CHANGELOG entries; resolved by keeping next's 1.7.0-beta.3 line. The ten changesets consumed by the v1.6.13 release are accepted as deleted, and no external dependencies changed.
2026-05-31 13:02:15 +01:00
Taesu and GitHub
df9e8b2951
docs: align db adapter guide with adapter contract ( #9830 )
2026-05-31 09:01:50 +00:00
Gustavo Valverde
be653ab90d
docs(two-factor): merge enforcement-scope clarification into OTP rewrite ( #9607 )
...
Layers main's #9607 clarification onto next's #9057 OTP-enablement rewrite.
The "Sign In with 2FA" section now states that 2FA sign-in enforcement
applies to the credential endpoints (/sign-in/email, /sign-in/username,
/sign-in/phone-number) and that passwordless flows are not gated by default,
with guidance to add custom hook handling to require it. The passwordless
callout and the allowPasswordless option note that the flag does not change
which sign-in methods are challenged. main's edit to the removed
skipVerificationOnEnable bullet is dropped, since next deleted that option.
(cherry picked from commit 6156cef51329e1c38544aa06eb5072d8a06ece7a)
2026-05-31 00:10:36 +01:00
Gustavo Valverde
ef4fb0ff95
chore: merge main into next ( #9533 )
...
Sync main (through #9821/#9820/#9822/#9768) into next. Conflicting
package.json files keep next's version and intentional divergences (for
example the cli's c12 v4) while taking main's dependency updates, including
the samlify 2.13.1 and fast-xml-parser security bumps; the lockfile is
regenerated from the reconciled set. The 13 source/doc/test conflicts take
next's refactored architecture as the baseline; main's colliding fixes are
re-applied on top in the following per-domain commits.
Clean main fixes land via this merge, including the auto-restored
account-takeover defenses #9578 and #9577 .
2026-05-31 00:10:16 +01:00
Gustavo Valverde and GitHub
e8696388bf
docs(oauth-provider): align metadata routing guidance ( #9768 )
2026-05-30 22:32:09 +01:00
23d7cbfa79
fix(oauth): apply updateUserInfoOnLink in OAuth callback link flow ( #8758 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 19:48:38 +01:00
d3919dc1a5
feat(account): support server-side accountInfo calls without session headers ( #9813 )
...
Co-authored-by: Nathan Colosimo <nathancolosimo@gmail.com >
2026-05-30 12:45:40 +01:00
5f282bd382
fix(account): default storeStateStrategy to "database" when using secondaryStorage ( #9591 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-30 11:05:28 +01:00
Taesu and GitHub
e131d3ac5b
fix(api-key): verify non-default keys when configId is omitted ( #9794 )
2026-05-30 03:14:57 +00:00
Gustavo Valverde and GitHub
c5b9f93498
fix(generic-oauth): add accessTokenExpiresIn for providers that omit expires_in ( #9799 )
2026-05-29 20:49:59 +00:00
17cd433c66
fix(oauth-proxy): missing state-cookie skip for oauth-proxy ( #9385 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-05-29 15:06:34 +00:00
093115e162
docs(oauth): added Roblox provider and alphabetized "providers without email" table ( #9786 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
2026-05-29 03:16:35 +00:00
Gustavo Valverde
Gautam ManchandaniandGitHub
TaesuandGitHub
Damien MasperoandGitHub
Eric LuceandGitHub
Prakash KumarandGitHub
Bereket EngidaandGitHub
Paola Estefanía de CamposandGitHub
Suliman AbdulrazzaqandGitHub
DeckerandGitHub
