Migration season: flexible passwords, zero-downtime SCIM, and a safer surface

Password policy, finally flexible

The headline this week belongs to Auth0's Flexible Password Policy, now generally available. This replaces Auth0's legacy password configuration with a single options.password_options object that grants granular control over composition rules, password history, dictionary checks, and profile-data validation. The operational detail that matters: as of July 2026, any new database connection created without an explicit password configuration defaults to this policy, while existing connections remain untouched. The enforcement is strict — a PATCH to the connections endpoint that mixes password_options with legacy password fields now returns 400 invalid_body. Teams that have been putting off migrating their password config should treat this as the signal to plan the cutover, since the legacy path is now frozen in place for new connections.

SCIM migrations without the midnight panic

WorkOS delivered the most operationally interesting release of the week with SCIM Bridge, a proxy that dual-writes requests from an existing SCIM connection to WorkOS. The entire migration story is built around de-risking: you can backfill data per connection, monitor the dual-write health, and roll back before you commit to cutover. For teams running home-grown SCIM, this removes the classic all-or-nothing switchover. WorkOS also quietly improved the invitation flow — accepted invitations now count as email verification for new users who accept within ten minutes of the invite being sent, trimming a redundant friction point from onboarding. The email_verification_succeeded event still fires, so downstream automation stays consistent.

Better Auth tightens the device grant

Better Auth continued its march toward the 1.7.0 release with two release candidates that reshape the OAuth device grant. The v1.7.0-rc.5 refactor moves device grant ownership from the standalone deviceCodeGrant() plugin into a new oauthDeviceAuthorization() that works alongside oauthProvider() or mcp(). This is a breaking change — the schema has changed (the resource column becomes oauthClientId and resources), pending device codes now expire, and the silenceWarnings option is gone. The follow-up v1.7.0-rc.6 completed the RP-Initiated Logout flow with form-encoded POST support, explicit confirmation pages, and strict redirect URI validation. The stable-line v1.6.28 and v1.6.29 releases backported a Suspense retry fix that prevents duplicate session requests, plus a meaningful security tightening: automatic email-domain organization assignment now requires both a verified provider domain and a verified user email, closing a vector where social sign-in could grant access through a claimed domain.

Clerk's OAuth and native polish

Clerk shipped a broad set of fixes across its SDKs. The most impactful is the native OAuth transport fix — previously, intermediate OAuth callback steps (MFA, password reset, sign-in-to-sign-up transfer) would navigate the app window rather than staying inside the modal component's own router, causing "Redirect url mismatch" failures on production instances. The fix keeps all intermediate steps contained and always sends the registered transport callback URL as the completion redirect. On the Expo side, the Android SSO race fix disables the native module's foreground client refresh — which could mint a duplicate client during browser SSO completion and cause 401 authentication_invalid right after sign-in — since the JavaScript layer now owns client state. Expo also gained custom pages for UserProfileView and UserButton, and the iOS SDK added trusted device sign-in. The Next.js SDK added runtime migration errors for the removed <SignedIn>, <SignedOut>, and <Protect> components, which will save many a developer from silent breakage. Several dependency-update releases rippled through the ecosystem (React, Vue, Express, Hono, and more); routine but worth knowing they exist.