better-release[bot] and GitHub
6f17bb3ebd
chore: release v1.6.3 ( #9081 )
2026-04-14 12:04:31 +01:00
Gustavo Valverde
b7850f90a4
fix: address merge follow-ups from PR #9172 review
...
- packages/oauth-provider/src/types/zod.ts: make `state` optional in
`verificationValueSchema`. Main's PR #9118 hardened authorization code
validation with a required `state`, but CIMD (next, PR #9159 ) doesn't send
state in test flows. Per OAuth 2.0 §4.1.1 state is RECOMMENDED, not
REQUIRED. Fixes CIMD token exchange (`401 !== 200`) in ci test and smoke.
- docs/content/docs/plugins/sso.mdx: replace remaining `/sso/saml2/callback/`
references with `/sso/saml2/sp/acs/` to match the endpoint rename from
next's PR #9117 . The merge took main verbatim here, regressing docs that
next had already updated.
2026-04-14 11:54:29 +01:00
Gustavo Valverde
3fbab44068
chore: sync main to next
...
Resolves conflicts in PR #9115 which the release bot cannot auto-merge.
Conflict resolutions:
- .github/workflows/release.yml: take main's hardened grep fallback (92256a2d0#9144 )
- packages/oauth-provider/src/token.ts: keep next's at_hash sequencing (#9079 ),
add main's customTokenResponseFields spread and credential helper rename (#9118 )
- packages/oauth-provider/src/token.test.ts: keep both new describe blocks
(at_hash in id tokens from next, customTokenResponseFields from main)
Semantic fixes on auto-merged files where git silently dropped main's changes
around next's discriminated-response refactor:
- two-factor/index.ts: restore skipVerificationOnEnable handling in the totp
enablement path
- two-factor/types.ts: restore the skipVerificationOnEnable type field
- two-factor/two-factor.test.ts: narrow the discriminated enable response via
method === "totp" guard
2026-04-14 11:30:13 +01:00
9a6d4759cd
fix(client): prevent isMounted race condition causing many rps ( #9078 )
...
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-14 09:36:59 +00:00
Gustavo Valverde and GitHub
390a03190c
fix(stripe): prevent prototype pollution via user-supplied metadata ( #9164 )
2026-04-14 08:05:31 +00:00
Gustavo Valverde and GitHub
5142e9cec5
fix(auth): harden dynamic baseURL resolution ( #9131 )
2026-04-14 08:01:13 +00:00
Gustavo Valverde and GitHub
92256a2d0d
chore: minor review followups on recent main commits ( #9163 )
2026-04-14 07:22:10 +00:00
Taesu and GitHub
513dabb132
fix: resolve dynamic baseURL for direct auth.api calls ( #9113 )
2026-04-14 06:16:53 +00:00
Jaden Stanton and GitHub
2514c3d970
docs: correct wording for invocable endpoints in integration guides ( #9160 )
2026-04-14 05:59:29 +00:00
Sean Filimon and GitHub
a1f619969d
docs: update Convex Labs link in documentation ( #9161 )
2026-04-14 05:55:27 +00:00
cd8313ba00
feat(cimd): add Client ID Metadata Document plugin ( #9159 )
...
Co-authored-by: Dylan Vanmali <dylanvanmali@yahoo.com >
2026-04-13 20:52:34 +00:00
Taesu and GitHub
8dcb98873e
docs: update not-found page ( #9158 )
2026-04-13 19:54:32 +00:00
Gustavo Valverde and GitHub
c7d22539ec
refactor(generic-oauth)!: rewrite as first-class social provider with RFC compliance ( #9069 )
2026-04-13 12:02:16 +00:00
Taesu and GitHub
6c946a3e0c
docs(sso): extract inline fields to named exports ( #9144 )
2026-04-13 03:01:29 +00:00
Taesu and GitHub
daf7ab7aaa
docs: fix fk references in schema tables to match actual plugin schemas ( #9143 )
2026-04-13 02:37:17 +00:00
Taesu and GitHub
a6f31972ca
docs(landing): polish sentinel section ( #9142 )
2026-04-13 01:19:15 +00:00
ed2c18df31
chore(deps): bump next from 16.2.2 to 16.2.3 in /docs ( #9112 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-12 08:47:53 +00:00
Taesu and GitHub
a6e9b94318
docs: improve enterprise contact form ( #9128 )
2026-04-12 08:30:35 +00:00
504ea253ac
chore(deps-dev): bump @sveltejs/kit from 2.53.3 to 2.57.1 ( #9109 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-12 08:24:12 +00:00
Gustavo Valverde and GitHub
e2e25a4954
fix(oauth-provider): graceful DCR override for unauthenticated confidential clients ( #9123 )
2026-04-11 15:25:06 +00:00
f8758975ae
fix(two-factor): updated backup codes respect storeBackupCodes option ( #7231 )
...
Co-authored-by: Gustavo Valverde <g.valverde02@gmail.com >
2026-04-11 13:19:46 +00:00
Gustavo Valverde and GitHub
484ce6a262
fix(two-factor): enforce 2FA on all sign-in paths ( #9122 )
2026-04-11 12:33:58 +00:00
Gustavo Valverde and GitHub
960304354a
fix(sso): upgrade samlify to 2.12.0 with XPath injection and XXE fixes ( #9121 )
2026-04-11 10:46:50 +00:00
Gustavo Valverde and GitHub
6f2948e87b
feat(oauth-provider): compute at_hash in id tokens per OIDC Core §3.1.3.6 ( #9079 )
2026-04-11 10:29:20 +00:00
Gustavo Valverde and GitHub
b70f025bfa
refactor(sso)!: remove callbackUrl, consolidate ACS endpoint, fix SLO ( #9117 )
2026-04-11 10:03:56 +00:00
Gustavo Valverde and GitHub
314e06f0fd
feat(oauth-provider): add customTokenResponseFields and harden authorization code validation ( #9118 )
2026-04-11 09:54:48 +00:00
Gustavo Valverde
9fd0192d0e
fix(ci): fix grep -c fallback producing invalid integer in release validation
...
grep -coP outputs "0" to stdout on no matches but exits 1, causing
the || echo 0 fallback to append a second "0". The resulting "0\n0"
value fails the -lt integer comparison. Use || true instead since
grep -c already outputs the correct count.
2026-04-11 07:53:07 +01:00
better-release[bot] and GitHub
c8cf0f7c1a
chore: release v1.7.0-beta.0 ( #9073 )
2026-04-10 21:29:25 +01:00
Gustavo Valverde and GitHub
bee0df595d
chore: sync main to next
...
chore: sync main to next
2026-04-10 21:16:58 +01:00
Gustavo Valverde
2e0ad30369
fix(ci): fix grep -c fallback producing invalid integer in release validation
...
grep -coP outputs "0" to stdout on no matches but exits 1, causing
the || echo 0 fallback to append a second "0". The resulting "0\n0"
value fails the -lt integer comparison. Use || true instead since
grep -c already outputs the correct count.
2026-04-10 21:10:10 +01:00
Gustavo Valverde
ca5d303607
fix(sso): guard toLowerCase against falsy email and use safe redirect
...
- Add empty string fallback before .toLowerCase() to prevent TypeError
when both mapped email attribute and extract.nameID are falsy
- Use validated samlRedirectUrl instead of raw callbackUrl in error
redirect to maintain open-redirect and loop-protection guarantees
2026-04-10 21:06:47 +01:00
Taesu and GitHub
f32099449e
chore: fix typecheck command in CLAUDE.md ( #9110 )
2026-04-10 19:43:07 +00:00
Gustavo Valverde
97fca6a1cf
refactor(sso): adopt saml-pipeline and port security fixes
...
Use main's saml-pipeline.ts for SAML response processing, replacing
~1000 lines of duplicated inline code in sso.ts. Port the four
security fixes from #9055 into the pipeline:
- Fix InResponseTo field path (extract.response?.inResponseTo)
- Add Audience Restriction validation
- Fix SessionIndex stored as string, not object
- Fix allowIdpInitiated default to false
Delegate to validateInResponseTo/validateAudience from
response-validation.ts instead of reimplementing inline.
Graft private_key_jwt (RFC 7523) support from #8836 onto main's
pipeline-based sso.ts.
2026-04-10 20:25:41 +01:00
Gustavo Valverde
28ccc8cda9
chore: resolve main-to-next sync conflicts
...
Conflicts resolved:
- docs/content/docs/plugins/2fa.mdx: kept next's OTP feature, applied main's exported const pattern
- docs/content/docs/plugins/oauth-provider.mdx: kept main's formatting, added back private_key_jwt docs
- docs/content/docs/plugins/sso.mdx: kept next's version with private_key_jwt and SAML options
- packages/sso/src/routes/sso.ts: kept next's version (has security fixes and private_key_jwt)
2026-04-10 19:11:05 +01:00
Taesu and GitHub
4673c6d83c
fix(cli): handle extends and mid-path wildcards in tsconfig paths ( #9032 )
2026-04-10 16:26:53 +00:00
Gustavo Valverde and GitHub
52c47517a2
fix(sso): unify SAML response processing and fix bugs ( #9097 )
2026-04-10 15:00:26 +00:00
Gustavo Valverde and GitHub
7fb4a55b65
fix(ci): rename release PR with actual version ( #9066 )
2026-04-10 14:58:56 +00:00
Gustavo Valverde and GitHub
544f1c63c9
feat(two-factor)!: add OTP enablement and discriminated response ( #9057 )
2026-04-10 14:23:20 +00:00
c5066fe5d6
fix(stripe): omit quantity for metered prices in checkout and upgrades ( #8926 )
...
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
2026-04-10 12:55:44 +00:00
684154d3d1
chore: replace z.union with z.xor for permission schemas in admin plugin ( #8982 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: Taesu <bytaesu@gmail.com >
Co-authored-by: Taesu <166604494+bytaesu@users.noreply.github.com >
2026-04-10 12:47:23 +00:00
Gustavo Valverde and GitHub
93d3871bd2
feat(oauth): add private_key_jwt client authentication (RFC 7523) ( #8836 )
2026-04-10 08:22:05 +00:00
5f84335815
feat(stripe): support Stripe SDK v21 and v22 ( #9084 )
...
Co-authored-by: leonardo2204 <1509421+leonardo2204@users.noreply.github.com >
Co-authored-by: better-release[bot] <273320539+better-release[bot]@users.noreply.github.com>
2026-04-10 06:19:34 +00:00
Tony and GitHub
d141a3b190
docs: fix PostgreSQL Prisma native type typo ( #9090 )
2026-04-10 05:21:45 +00:00
Taesu and GitHub
099ee48c41
chore(docs): format markdown including mdx files ( #9085 )
2026-04-10 05:09:33 +00:00
f6428d02fc
fix(open-api): correct get-session nullable schema for OAS 3.1 ( #8389 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com >
2026-04-09 20:44:35 +00:00
6ce30cf138
fix: incorrect operationId in password reset callback endpoint ( #9072 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 20:13:06 +00:00
41679fa817
docs: add database table names ( #9062 )
...
Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com >
2026-04-09 19:17:40 +00:00
Gustavo Valverde and GitHub
a2fbe079f8
refactor(ci): simplify release notes to one-line entries ( #9067 )
2026-04-09 18:24:25 +00:00
Gustavo Valverde and GitHub
83ed1fe360
fix(ci): prevent label explosion on PRs targeting the next branch ( #9071 )
2026-04-09 18:15:14 +00:00
Gustavo Valverde and GitHub
b790144a2e
fix(sso)!: harden SAML response validation (InResponseTo, Audience, SessionIndex) ( #9055 )
2026-04-09 17:30:01 +00:00
better-release[bot]andGitHub
Gustavo Valverde
TaesuandGitHub
Jaden StantonandGitHub
Sean FilimonandGitHub
TonyandGitHub
