--- collection: auth-identity collection_name: Auth & Identity week_start: 2026-08-10 title: Migration season: flexible passwords, zero-downtime SCIM, and a safer surface release_count: 72 generated: 2026-08-17 canonical: https://releases.sh/collections/auth-identity/digest/2026-08-10 --- # Migration season: flexible passwords, zero-downtime SCIM, and a safer surface Auth0's Flexible Password Policy went GA, WorkOS shipped a zero-downtime SCIM migration bridge, and Better Auth continued hardening its OAuth device grant. Clerk rounded out the week with a cluster of OAuth flow and native SDK fixes. ### Password policy, finally flexible The headline this week belongs to [Auth0's Flexible Password Policy](/release/rel_hBXWhrnLZuOeFuPJiSqlg-auth0-flexible-password-policy-generally-available-new-connections-default-to-it), now generally available. This replaces Auth0's legacy password configuration with a single `options.password_options` object that grants granular control over composition rules, password history, dictionary checks, and profile-data validation. The operational detail that matters: as of July 2026, any new database connection created without an explicit password configuration defaults to this policy, while existing connections remain untouched. The enforcement is strict — a `PATCH` to the connections endpoint that mixes `password_options` with legacy password fields now returns `400 invalid_body`. Teams that have been putting off migrating their password config should treat this as the signal to plan the cutover, since the legacy path is now frozen in place for new connections. ### SCIM migrations without the midnight panic WorkOS delivered the most operationally interesting release of the week with [SCIM Bridge](/release/rel_cXYYMbE9ijde-o28RZ29L-workos-scim-bridge-migrates-scim-connections-with-zero-downtime), a proxy that dual-writes requests from an existing SCIM connection to WorkOS. The entire migration story is built around de-risking: you can backfill data per connection, monitor the dual-write health, and roll back before you commit to cutover. For teams running home-grown SCIM, this removes the classic all-or-nothing switchover. WorkOS also quietly improved the invitation flow — [accepted invitations now count as email verification](/release/rel_-wP5bs1bxSXbDBzLwB6tZ-workos-accepted-invitations-now-count-as-email-verification) for new users who accept within ten minutes of the invite being sent, trimming a redundant friction point from onboarding. The `email_verification_succeeded` event still fires, so downstream automation stays consistent. ### Better Auth tightens the device grant Better Auth continued its march toward the 1.7.0 release with two release candidates that reshape the OAuth device grant. The [v1.7.0-rc.5 refactor](/release/rel_0YcmIke78FJmzvWtn3ivr-better-auth-v1-7-0-rc-5-refactors-oauth-device-grant-ownership) moves device grant ownership from the standalone `deviceCodeGrant()` plugin into a new `oauthDeviceAuthorization()` that works alongside `oauthProvider()` or `mcp()`. This is a breaking change — the schema has changed (the `resource` column becomes `oauthClientId` and `resources`), pending device codes now expire, and the `silenceWarnings` option is gone. The follow-up [v1.7.0-rc.6](/release/rel_4BCCYScPgaCLutYpvcqND-better-auth-v1-7-0-rc-6-fixes-oauth-rp-initiated-logout-and-suspense-remount) completed the RP-Initiated Logout flow with form-encoded POST support, explicit confirmation pages, and strict redirect URI validation. The stable-line [v1.6.28](/release/rel_vAhYAlRCZ-o-2woxzBrNo-better-auth-v1-6-28-fixes-duplicate-session-requests-and-typescript-plugin-types) and [v1.6.29](/release/rel_OZ8cnvBjobmkT7ORQz5AD-better-auth-v1-6-29-fixes-sso-domain-verification-and-speeds-up-session-deletion) releases backported a Suspense retry fix that prevents duplicate session requests, plus a meaningful security tightening: automatic email-domain organization assignment now requires both a verified provider domain and a verified user email, closing a vector where social sign-in could grant access through a claimed domain. ### Clerk's OAuth and native polish Clerk shipped a broad set of fixes across its SDKs. The most impactful is the [native OAuth transport fix](/release/rel_IL4Qw0Wq59UDafdbBJsjX-clerk-js-sdk-6-28-1-fixes-native-oauth-redirect-url-mismatches-in-modal-flows) — previously, intermediate OAuth callback steps (MFA, password reset, sign-in-to-sign-up transfer) would navigate the app window rather than staying inside the modal component's own router, causing "Redirect url mismatch" failures on production instances. The fix keeps all intermediate steps contained and always sends the registered transport callback URL as the completion redirect. On the Expo side, [the Android SSO race fix](/release/rel_mMTi0J_QVLeD2WZUhF6c6-clerk-expo-fixes-android-sso-401-error-from-foreground-client-refresh-race) disables the native module's foreground client refresh — which could mint a duplicate client during browser SSO completion and cause `401 authentication_invalid` right after sign-in — since the JavaScript layer now owns client state. Expo also gained [custom pages for `UserProfileView` and `UserButton`](/release/rel_a_Ujj4UV_n5L75Q-3AK7k-clerk-expo-v4-3-0-adds-custom-pages-to-user-profile-view-and-button), and the [iOS SDK added trusted device sign-in](/release/rel_MV5Ru7UNgkcmI3UksB9ms-clerk-ios-sdk-1-3-9-adds-trusted-device-sign-in). The Next.js SDK added [runtime migration errors](/release/rel_YEo-fNO3NlAVu9Ypa2XWi-clerk-next-js-sdk-7-7-5-adds-runtime-errors-for-removed-auth-components) for the removed ``, ``, and `` components, which will save many a developer from silent breakage. Several dependency-update releases rippled through the ecosystem (React, Vue, Express, Hono, and more); routine but worth knowing they exist. ## Releases covered ### Auth0 - [Auth0 Flexible Password Policy generally available; new connections default to it](https://releases.sh/release/rel_hBXWhrnLZuOeFuPJiSqlg-flexible-password-policy-ga-new-connections-default-to-it) ### Better Auth - [better-auth v1.7.0-rc.5 refactors OAuth device grant ownership](https://releases.sh/release/rel_0YcmIke78FJmzvWtn3ivr-device-grant-ownership-refactored-schema-migration-required) - [Better Auth v1.7.0-rc.6 fixes OAuth RP-Initiated Logout and Suspense remount race](https://releases.sh/release/rel_4BCCYScPgaCLutYpvcqND-rp-initiated-logout-completed-suspense-remounts-fixed) - [better-auth v1.6.28 fixes duplicate session requests and TypeScript plugin types](https://releases.sh/release/rel_vAhYAlRCZ-o-2woxzBrNo-session-dedup-on-suspense-retries-plugin-types-restored) - [Better Auth v1.6.29 fixes SSO domain verification and speeds up session deletion](https://releases.sh/release/rel_OZ8cnvBjobmkT7ORQz5AD-sso-domain-assignment-hardened-session-deletes-parallelized) ### Clerk - [Clerk JS SDK 6.28.1 fixes native OAuth redirect url mismatches in modal flows](https://releases.sh/release/rel_IL4Qw0Wq59UDafdbBJsjX-native-oauth-calls-complete-inside-modal-redirect-url-mismatch-fixed) - [Clerk Expo fixes Android SSO 401 error from foreground client refresh race](https://releases.sh/release/rel_mMTi0J_QVLeD2WZUhF6c6-android-sso-401-error-fixed-native-sdk-bump) - [Clerk Expo v4.3.0 adds custom pages to user profile view and button](https://releases.sh/release/rel_a_Ujj4UV_n5L75Q-3AK7k-custom-user-profile-pages-added-to-userprofileview-userbutton) - [Clerk iOS SDK 1.3.9 adds trusted device sign-in](https://releases.sh/release/rel_MV5Ru7UNgkcmI3UksB9ms-trusted-device-sign-in-added) - [Clerk Next.js SDK 7.7.5 adds runtime errors for removed auth components](https://releases.sh/release/rel_YEo-fNO3NlAVu9Ypa2XWi-runtime-errors-on-removed-signedin-protect-components) ### WorkOS - [WorkOS SCIM Bridge migrates SCIM connections with zero downtime](https://releases.sh/release/rel_cXYYMbE9ijde-o28RZ29L-scim-connections-migrate-with-zero-downtime-bridge) - [WorkOS: accepted invitations now count as email verification](https://releases.sh/release/rel_-wP5bs1bxSXbDBzLwB6tZ-accepted-invitations-verify-email-automatically)