Gustavo Valverde
010bd65811
chore: resolve 10246 main-to-next sync conflicts
2026-06-26 13:54:08 +01:00
Gustavo Valverde and GitHub
3a035e968e
fix(two-factor): add account-level verification lockout ( #10240 )
2026-06-26 13:40:00 +01:00
Gustavo Valverde and GitHub
7c126dcd1a
fix(scim): scope write-path operations and honor the active attribute ( #10242 )
2026-06-26 12:29:00 +00:00
Gustavo Valverde and GitHub
8bd43d9d83
fix(core): refuse redirects on server-side OAuth requests ( #10241 )
2026-06-26 12:28:17 +00:00
Gustavo Valverde and GitHub
c06a56d83a
fix: revoke unproven credentials on magic-link/email-OTP sign-in ( #10239 )
2026-06-26 13:20:07 +01:00
ea06c5a71f
feat(drizzle-adapter): support Drizzle Relations v2 ( #9489 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-26 11:01:48 +00:00
Gustavo Valverde
4bcda56649
chore: resolve 10178 main-to-next sync conflicts
...
Merges origin/main into origin/next for the replacement sync PR and records the hand-resolved package metadata, changelog, OAuth/social provider, admin, SIWE, SCIM, SSO, username, rate-limiter, and next-owned MCP/OIDC provider conflicts.
2026-06-26 06:33:24 +01:00
b5bec193a5
fix(oauth): apply user input rules to provider profiles ( #10196 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 04:06:54 +00:00
90d509e0b9
fix(adapter): fail closed on update misses ( #10180 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:39 +00:00
816d7f9252
fix(one-tap): apply configured Google hosted domain (hd) on the callback ( #10197 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:20 +00:00
Gustavo Valverde and GitHub
5838df2f41
feat(oauth-provider): add refresh token reuse interval ( #10145 )
2026-06-26 03:49:27 +00:00
fa1e036ae7
fix(sso): validate SAML response binding against the Service Provider ( #10226 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:43 +00:00
fcabaaffcb
fix(sso): require DNS proof for every domain listed on a provider ( #10227 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:49:15 +00:00
Gustavo Valverde and GitHub
1bc370aef5
fix(siwe): reject sign-in when the provided email already belongs to another account ( #10228 )
2026-06-26 02:21:45 +00:00
Taesu and GitHub
5f86c3bed7
docs: restore lubiah community adapter ( #10230 )
2026-06-25 13:44:27 -07:00
Maxwell and GitHub
82cbbd6f1d
docs: add missing disable-implicit-linking docs ( #10218 )
2026-06-25 10:59:14 +00:00
5953157acf
fix: harden forwarded client IP resolution ( #10203 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-25 04:55:10 +00:00
Taesu and GitHub
e7c8066cf1
docs: refine warning guidance across plugin docs ( #10185 )
2026-06-21 22:39:30 -07:00
moonevm and GitHub
6e5f7e656b
docs: fix the code block format on the Stripe plugin page ( #10181 )
2026-06-21 02:31:43 -07:00
bdda5162f9
docs: remove extra spaces in documentation ( #10174 )
...
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-20 22:48:59 -07:00
Gustavo Valverde and GitHub
6ddb5554c0
chore(deps)!: upgrade dependencies to latest ( #10170 )
2026-06-20 10:15:37 -07:00
Gustavo Valverde
3b170f2f40
chore: sync main to next
2026-06-20 09:15:00 -07:00
Roman Sirokov and GitHub
58549652dd
docs: fix open in markdown url ( #10162 )
2026-06-20 02:06:21 +00:00
Gustavo Valverde and GitHub
e3125e872d
feat(oauth-provider): honor requested UserInfo claims via a claim registry ( #10156 )
2026-06-19 18:08:35 -07:00
Gustavo Valverde and GitHub
dd42701af4
fix(oauth-provider): allow nonce-bound offline access without PKCE ( #10153 )
2026-06-19 11:18:05 -07:00
Gustavo Valverde and GitHub
d368217efc
fix(oauth-provider): keep OIDC scope claims on UserInfo ( #10152 )
2026-06-19 10:55:51 -07:00
Gustavo Valverde and GitHub
a8200b297c
feat(oauth-provider): allow confidential DCR clients without PKCE ( #10146 )
2026-06-19 06:29:08 -07:00
Gustavo Valverde and GitHub
1f8b0282de
fix(oauth-provider): preserve dcr client key metadata ( #10144 )
2026-06-18 22:46:03 -07:00
Gustavo Valverde and GitHub
335cda702e
feat(oauth-provider)!: make id-token claim authority explicit ( #10140 )
2026-06-18 14:25:12 -07:00
Gustavo Valverde and GitHub
3a79aff58e
feat(google): add includeGrantedScopes option ( #10129 )
2026-06-18 08:31:10 -07:00
Gustavo Valverde and GitHub
97903c9cca
fix(oauth): preserve account.scope across re-auth and refresh ( #10128 )
2026-06-18 08:17:27 -07:00
Gustavo Valverde and GitHub
27f06181c7
revert(oauth): remove granted scopes architecture ( #10123 )
2026-06-17 22:27:20 -07:00
Gustavo Valverde and GitHub
de8394de20
fix(cimd): route client_id SSRF checks through the shared host classifier ( #10126 )
2026-06-17 18:29:06 -07:00
3d04fababb
feat(generic-oauth): forward refreshTokenParams to token endpoint ( #9948 )
...
Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-17 21:03:56 +00:00
Khairul Haziq and GitHub
fb11c98930
fix(docs): add missing mode config to Drizzle bigint codegen ( #10114 )
2026-06-17 22:55:41 +10:00
Gustavo Valverde and GitHub
27b5d80227
fix(generic-oauth): bind id token nonce in redirect flow ( #10095 )
2026-06-16 21:20:07 +00:00
3965752b5a
fix(i18n): i18n en fallback and i18n documentation ( #9872 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2026-06-16 20:51:48 +00:00
Gustavo Valverde
849f6e8aca
chore: sync main to next
2026-06-15 18:30:49 -07:00
Gustavo Valverde and GitHub
1e69725027
docs: clarify stateless Cognito token refresh ( #10092 )
2026-06-15 17:06:35 -07:00
2c8f925c48
docs: generate blog cover images from post titles ( #10032 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
2026-06-15 09:28:45 -07:00
Gustavo Valverde and GitHub
36f345b1bc
revert: fix: allow headerless get session checks ( #10053 ) ( #10074 )
2026-06-15 00:10:22 -07:00
Gustavo Valverde and GitHub
4475f4a39b
fix(sso): reject OIDC endpoint redirects portably ( #10072 )
2026-06-15 06:56:55 +00:00
Gustavo Valverde and GitHub
6d97c4754c
fix(oauth-provider): challenge invalid userinfo tokens ( #10068 )
2026-06-15 06:27:28 +00:00
Tushar and GitHub
d009daedc7
fix: allow headerless get session checks ( #10053 )
2026-06-15 06:14:34 +00:00
Gustavo Valverde and GitHub
3ef3cfecfa
fix(oauth-provider)!: bind client authentication to the issuing grant ( #10063 )
2026-06-14 20:46:40 -07:00
Gustavo Valverde and GitHub
aedcb974f0
feat(oauth-provider): add DPoP support ( #10039 )
2026-06-14 18:28:21 -07:00
Gustavo Valverde and GitHub
0143d69195
feat(oauth-provider): support protected dynamic client registration ( #10037 )
2026-06-14 15:00:17 -07:00
Gustavo Valverde and GitHub
050ef2dfcf
feat(oauth-provider): add extension surface ( #10030 )
2026-06-14 11:37:28 -07:00
Gustavo Valverde and GitHub
2fd3d58500
feat(oauth-provider): consistent and audience-scoped token introspection ( #10045 )
2026-06-13 12:58:25 -07:00
Maxwell and GitHub
581f8271fb
fix(last-login-method): include domain when clearing cross-subdomain cookies ( #9319 )
2026-06-13 11:52:33 +00:00
Gustavo Valverde
moonevmandGitHub
Roman SirokovandGitHub
Khairul HaziqandGitHub
TusharandGitHub