Gustavo Valverde and GitHub
fcb03390fe
chore(release): prepare 1.7 RC channel ( #10255 )
2026-06-26 22:59:20 +01:00
Gustavo Valverde and GitHub
dfecb481fa
feat(scim)!: isolate provider connections by organization ( #10249 )
2026-06-26 22:38:00 +01:00
better-release[bot] and GitHub
ba52913eed
chore: release v1.7.0-beta.10 ( #10173 )
2026-06-26 17:59:41 +01:00
Gustavo Valverde and GitHub
754453d875
chore: sync main to next
...
chore: sync main to next
2026-06-26 15:39:33 +01:00
Gustavo Valverde
a2c407456f
fix(auth): await account promotion before lock release
2026-06-26 15:17:02 +01:00
Gustavo Valverde
f1c3232bd6
fix(auth): harden unproven account cleanup
2026-06-26 14:34:23 +01:00
Gustavo Valverde
3ea364d5f6
fix(two-factor): guard account lock writes
2026-06-26 14:20:29 +01:00
Gustavo Valverde
5d0d32f294
fix(auth): address sync review feedback
2026-06-26 14:17:36 +01:00
Gustavo Valverde
2fa9fbb0eb
fix(two-factor): preserve OTP-only verification during sync
2026-06-26 14:08:24 +01:00
Gustavo Valverde
010bd65811
chore: resolve 10246 main-to-next sync conflicts
2026-06-26 13:54:08 +01:00
better-release[bot] and GitHub
a90d061de7
chore: release v1.6.22 ( #10245 )
2026-06-26 13:43:23 +01:00
Gustavo Valverde and GitHub
3a035e968e
fix(two-factor): add account-level verification lockout ( #10240 )
2026-06-26 13:40:00 +01:00
Gustavo Valverde and GitHub
7c126dcd1a
fix(scim): scope write-path operations and honor the active attribute ( #10242 )
2026-06-26 12:29:00 +00:00
Gustavo Valverde and GitHub
8bd43d9d83
fix(core): refuse redirects on server-side OAuth requests ( #10241 )
2026-06-26 12:28:17 +00:00
Gustavo Valverde and GitHub
c06a56d83a
fix: revoke unproven credentials on magic-link/email-OTP sign-in ( #10239 )
2026-06-26 13:20:07 +01:00
ea06c5a71f
feat(drizzle-adapter): support Drizzle Relations v2 ( #9489 )
...
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-06-26 11:01:48 +00:00
Gustavo Valverde and GitHub
50d15280b1
chore: sync main to next
...
chore: sync main to next
2026-06-26 08:44:45 +01:00
Gustavo Valverde
7cae0f2a77
fix: keep siwe reservation fallback best-effort
2026-06-26 08:26:53 +01:00
Gustavo Valverde
f291e5ba74
fix: address sync review fallout
2026-06-26 08:09:34 +01:00
Gustavo Valverde
d46b8bee4f
fix: tighten remaining sync review fixes
2026-06-26 07:45:19 +01:00
Gustavo Valverde
cc1aed88d3
fix: address sync review feedback
2026-06-26 07:42:55 +01:00
Gustavo Valverde
4bcda56649
chore: resolve 10178 main-to-next sync conflicts
...
Merges origin/main into origin/next for the replacement sync PR and records the hand-resolved package metadata, changelog, OAuth/social provider, admin, SIWE, SCIM, SSO, username, rate-limiter, and next-owned MCP/OIDC provider conflicts.
2026-06-26 06:33:24 +01:00
better-release[bot] and GitHub
414169d95a
chore: release v1.6.21 ( #10184 )
2026-06-26 05:52:50 +01:00
f52e1ab50b
fix(device-authorization): make schema option optional under Zod v4 ( #9939 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-06-26 05:48:15 +01:00
Gustavo Valverde and GitHub
f395c30e95
ci(release): skip pre-commit hooks for the release bot commit ( #10233 )
2026-06-26 05:33:13 +01:00
882cf9e592
fix(admin): use authoritative session reads for authorization ( #10187 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 04:09:16 +00:00
b5bec193a5
fix(oauth): apply user input rules to provider profiles ( #10196 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 04:06:54 +00:00
Taesu and GitHub
471f81c1ab
refactor: centralize request IP resolver in core ( #10216 )
2026-06-26 05:05:00 +01:00
90d509e0b9
fix(adapter): fail closed on update misses ( #10180 )
...
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:39 +00:00
816d7f9252
fix(one-tap): apply configured Google hosted domain (hd) on the callback ( #10197 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:56:20 +00:00
Gustavo Valverde and GitHub
5838df2f41
feat(oauth-provider): add refresh token reuse interval ( #10145 )
2026-06-26 03:49:27 +00:00
fa1e036ae7
fix(sso): validate SAML response binding against the Service Provider ( #10226 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:43 +00:00
7a7a7b311a
fix(sso): delete linked account rows when an SSO provider is deleted ( #10224 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 03:07:21 +00:00
fcabaaffcb
fix(sso): require DNS proof for every domain listed on a provider ( #10227 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:49:15 +00:00
1a8b7ccc83
fix(sso): restrict SAML SLO POST form action to http(s) schemes ( #10225 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-06-26 02:27:12 +00:00
Gustavo Valverde and GitHub
1bc370aef5
fix(siwe): reject sign-in when the provided email already belongs to another account ( #10228 )
2026-06-26 02:21:45 +00:00
Taesu and GitHub
5f86c3bed7
docs: restore lubiah community adapter ( #10230 )
2026-06-25 13:44:27 -07:00
Taesu and GitHub
29fbcb5732
Merge commit from fork
...
Organization subscription actions re-derived the reference id in the handler
instead of consuming the value the middleware resolved, so an action could run
against a different organization than the one resolved for the request. The
middleware now resolves the reference id once and exposes it on the context, and
the handlers read it from there.
2026-06-25 11:21:12 -07:00
Maxwell and GitHub
82cbbd6f1d
docs: add missing disable-implicit-linking docs ( #10218 )
2026-06-25 10:59:14 +00:00
Gustavo Valverde and GitHub
ae647b4abe
fix(two-factor): cap verification attempts on TOTP and backup codes ( #10210 )
2026-06-25 06:49:09 +00:00
5953157acf
fix: harden forwarded client IP resolution ( #10203 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-25 04:55:10 +00:00
Taesu and GitHub
5af69e4b50
test: cover base path leading-prefix enforcement ( #10211 )
2026-06-25 00:51:21 +00:00
Taesu and GitHub
e0762a127c
chore: bump better-call to 1.3.7 ( #10212 )
2026-06-25 00:30:07 +00:00
452bd03f74
fix(cli): increase generated BETTER_AUTH_SECRET length from 16 to 32 … ( #10186 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-24 21:52:53 +00:00
Taesu and GitHub
88409b0078
fix(oauth-proxy): reject profile callbacks with missing or expired OAuth state ( #10183 )
2026-06-24 19:41:43 +00:00
b046f9ec11
fix: apply rate limits before plugin requests ( #10191 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-06-24 11:51:11 +00:00
Rachit mittal and GitHub
570267cd5e
fix: honor disableMigration on plugin schema tables ( #10198 )
2026-06-24 00:19:25 +00:00
Taesu and GitHub
239bcc836c
fix(paypal): bind userinfo subject to verified id token subject ( #10192 )
2026-06-23 00:23:56 +00:00
Taesu and GitHub
e7c8066cf1
docs: refine warning guidance across plugin docs ( #10185 )
2026-06-21 22:39:30 -07:00
Taesu and GitHub
461ca6fd24
fix(username): only store valid displayUsername fallbacks as usernames ( #10182 )
2026-06-22 05:16:44 +00:00
Gustavo ValverdeandGitHub
better-release[bot]andGitHub
Rachit mittalandGitHub