releases.shpreview

Auth

Authentication and authorization service

2.189.0 (2026-04-23)

Features
  • add PKCE support for /resend (#2401) (2af904a)
  • improve parallelization in github workflows and Makefile (#2436) (9d0c4b3)
  • passkeys: add CAPTCHA to options endpoint for authentication (#2416) (c7b58be)
  • support live reloading of individual rate limits (#2469) (d03d796)
Bug Fixes
  • ensure identities are returned in a consistent order across DB engines (#2465) (e49a3e5)
  • ensure SSO providers tests are order-independent (#2466) (983ade6)
  • exempt PKCE recovery sessions from require-current-password check (#2502) (7f88985)
  • indexworker: skip index creation on OrioleDB (#2481) (dd56ae9)
  • passkeys: modify the passkeys request and response shapes (#2475) (2d8f2b6)
  • prevent reuse of flow state (#2483) (88dcb2d)
  • return JSON response for unmatched routes instead of plain text (#2457) (7337e21)

Checksums

SHA1

auth-v2.189.0-arm64.tar.gz:

9bb215f5f58d8d7427fb624fb8fef9c88ed087e3

auth-v2.189.0-darwin-arm64.tar.gz:

61376c3b1acdaecd9d905d6a4451ca253f283e15

auth-v2.189.0-x86.tar.gz:

3d9c625505b504b9cddc2bec429a37000846f84d

auth-v2.189.0-arm64.tar.xz:

28dd64d897f49e681d19bd13ff1ff08291556ce5
SHA256

auth-v2.189.0-arm64.tar.gz:

7019493550fec34332dcdbb7ab39cb489def5a9e78e3491f43710496bef9e41f

auth-v2.189.0-darwin-arm64.tar.gz:

26fbe679486cf8e3bd3e3f5e7acb8009a7be0b0b8db5eb08281b7447a27babdf

auth-v2.189.0-x86.tar.gz:

5d077774a7e0614d39d17e67b31dc4e39895af9b20fd42a282c97b8f4d4b1db4

auth-v2.189.0-arm64.tar.xz:

0d2d6c0cdb9e4d2cf0b485327c9a3e403a8029a3434446320a2c24c97e461589

2.188.1 (2026-03-19)

Bug Fixes

Checksums

SHA1

auth-v2.188.1-arm64.tar.gz:

236e8c7bb93e1246b3ff31dbda0fbebe6c3114ca

auth-v2.188.1-darwin-arm64.tar.gz:

df7eb10789e0ca6aae3418e8d3f33cd8621f5c24

auth-v2.188.1-x86.tar.gz:

b7a6d2c3cb32358710db919f1178569ec19590f0

auth-v2.188.1-arm64.tar.xz:

43518b6d5e97ed63eed292deac7ad3263d2c975b
SHA256

auth-v2.188.1-arm64.tar.gz:

5663dafa80423cf975367a13cf292936d955016441e40b1c9768e2ea67056d8d

auth-v2.188.1-darwin-arm64.tar.gz:

aeadc0226ceab5f5d525311887667521047589dc7d1a407488c7ae08fa060892

auth-v2.188.1-x86.tar.gz:

f3472263b480d2192f34ab2e38687c1a42072617c4967ebc4fdc4087fd3bec77

auth-v2.188.1-arm64.tar.xz:

e128f529e1380e50e7d8508748d6d3df2473f05ccdbc3ffa5c7019ac82157d38

2.188.0 (2026-03-17)

Features
  • cache OIDC discovery documents for providers (#2389) (40d07b5)
  • enable custom providers by default (#2427) (291cdad)
  • modernize IsNotFoundError handler to support errors.Is (#2392) (ab7c9f9)
  • oauth-server: allow updating token_endpoint_auth_method for OAuth clients (#2391) (1280dc1)
  • passkeys: add admin endpoints to list and delete passkeys (f109550)
  • passkeys: add audit, metering, webauthn primitives (039b569)
  • passkeys: add configuration, error codes, and schemas (0a5eb95)
  • passkeys: add discoverable credential auth flow (#2411) (1bc68ea)
  • passkeys: add management endpoints (#2413) (5b3218e)
  • passkeys: add rate limiter on the /options endpoint for authentication (#2422) (30b3aeb)
  • passkeys: derive friendly name from AAGUID (#2415) (e00ff1a)
  • passkeys: progressive enrollment flow (61ae2aa)
Bug Fixes
  • add MaxBytesReader middleware to limit request body size to 1MB (#2402) (6f0b2eb)
  • bump Go to v1.25.8 (#2412) (a2e357f)
  • passkeys: construct configuration env var correctly (dba676e)
  • passkeys: enforce passkey cap during registration verify (9868df6)
  • passkeys: return 204 when deleting a passkey (7d90fb8)
  • passkeys: sign_count should be uint32 (e509e3a)

2.187.0 (2026-02-23)

Features
Bug Fixes
  • case-insensitive Bearer token scheme matching (#2387) (36d712d)
  • correctly parse JWT ValidMethods from env by enabling split_words (#2334) (a6076bc)
  • flaky index worker test (#2366) (961a7e6)
  • hooks: propagate error objects from hook calls (#2380) (3ca1e88)
  • session upgrade percentage should be based on session, not request (#2371) (510e68b)

Checksums

SHA1

auth-v2.187.0-arm64.tar.gz:

1827fa48fc1ce4cba78b869b4c0edc9c0677edf4

auth-v2.187.0-x86.tar.gz:

375cb086f6adc17f445bbb5ea4e1a6c5e7a726ba

auth-v2.187.0-arm64.tar.xz:

3f5845e317e79e90d07f73a1c658edf4a65250b7
SHA256

auth-v2.187.0-arm64.tar.gz:

d19c7b6a94544ecabe5276c0de50f2f1871fc2029ba3fa2cd92702a0108971c2

auth-v2.187.0-x86.tar.gz:

5f7d53cc9f4219c245d3f953bfcfdc874754f4ee0c2a413cfb436b2d4d59760a

auth-v2.187.0-arm64.tar.xz:

8d6a5325488caf05d5d07032f47537429942b46c3dab6eae1b4e21c88556e50f

2.186.0 (2026-01-28)

Features
Bug Fixes

Checksums

SHA1

auth-v2.186.0-arm64.tar.gz:

94cd063227e01dcc71811aa63ecdd996d0c0419c

auth-v2.186.0-x86.tar.gz:

8528d7b324e161496bafcec6edcf70ae58d108e9

auth-v2.186.0-arm64.tar.xz:

64d85ed460b5ec01359a997b8f07e1ba71781cc8
SHA256

auth-v2.186.0-arm64.tar.gz:

61aa53ea5e2d7e4f50f2b10312c1e6b73e4767b753815239956082fdcc623270

auth-v2.186.0-x86.tar.gz:

2683b9549e922d0644621129fdabd7edb8b78c35274e133e61a3280ad9675161

auth-v2.186.0-arm64.tar.xz:

0404eef4bc6845652c9672fa375882af69e4464818f9ab1249d6826c0572b863

2.185.0 (2026-01-12)

Bug Fixes

Checksums

SHA1

auth-v2.185.0-arm64.tar.gz:

a5e7d5329b7ef7042185ad10b5cc8e3c12b520e4

auth-v2.185.0-x86.tar.gz:

78ef92bbbae9d24e142feb9249d6b8f57dca282f

auth-v2.185.0-arm64.tar.xz:

0e3e5dd33dc97ee38be31b8eae00c698915f6514
SHA256

auth-v2.185.0-arm64.tar.gz:

e7562ee28a0b06065e007e4a988d067f70354ac8ba172635dde9ffb73e7aedaf

auth-v2.185.0-x86.tar.gz:

17480f9fbe0edd7b8819aa7422815ed1428aaf97a26fcbb0ff128cbcf93ca874

auth-v2.185.0-arm64.tar.xz:

14d7149533a28f8d2764aa3fc95f4e3762c1e3e9ac738070798050b4e6271c0a

2.184.0 (2025-12-08)

Features
  • increment refresh token counter by 2 for mfa verify (#2284) (2a38668)
  • load template cache at startup for fault tolerance (#2261) (511c3a4)
  • oauth: add support for X/Twitter v2 provider (#2275) (7f36eb0)

Checksums

SHA1

auth-v2.184.0-arm64.tar.gz:

8da1a0cdbf55e016a5e6dfe8949491eb54fa0fce

auth-v2.184.0-x86.tar.gz:

32388d8e5e4889b89246553222adc96164ae0403

auth-v2.184.0-arm64.tar.xz:

4c3adeaa2286be7c4dadb054dd4f3a4cdee3d9f5
SHA256

auth-v2.184.0-arm64.tar.gz:

7b93d0bb8c8ec93c294fd4f2b4445f9f4929246faaf5ea81d005ca052b98c076

auth-v2.184.0-x86.tar.gz:

8d6d2fa811ca65b4e084bd0f4d6a6eee6d74e24958890ec0f0d7cf5670a4acb1

auth-v2.184.0-arm64.tar.xz:

0a16704529473d9e7d25fd152b513904d665a81cb1bdf31420b5baf3df90da0b

2.183.0 (2025-11-20)

Features
  • async, concurrent index creation for users table (#2239) (a1146bf)
  • indexworker: use auth_trgm extension if available (#2263) (05daa43)
  • oauthserver: add OpenID Connect support (#2250) (162788f)
  • oauthserver: update oauth grant list & authorization details response structure (#2247) (137ea92)
  • oauthserver: use NewOAuthServerAuthorizationParams & configurable ttl for authorization (#2254) (61632f8)
Bug Fixes
  • indexworker: detect which schema pg_trgm exists in (#2260) (4be12b3)
  • look for refresh token on mfa verification only in v1 (#2249) (2906b24)
  • mfa verify now works with refresh token algorithm v2 (#2246) (4e8275f)
  • social-auth: default to current_user:read for Figma provider (#2195) (f409d11)

Checksums

SHA1

auth-v2.183.0-arm64.tar.gz:

1e779a0d83bcc1610e112f1b6c071a41656f633d

auth-v2.183.0-x86.tar.gz:

7d423b34749c3417b04e83dce7e182ee18b6b42b

auth-v2.183.0-arm64.tar.xz:

8376bdd81cf1df6f981214daafbc20bd671b9cb4
SHA256

auth-v2.183.0-arm64.tar.gz:

798251e0676e502fc8627bf72ece1700a273bae7c7210911e9b82a08baa02243

auth-v2.183.0-x86.tar.gz:

9da36c45b8403b7691adc0d6a2982cdee8500de7688f5797808af1becc6a6d11

auth-v2.183.0-arm64.tar.xz:

b20030471a291d73c7825670a3d73558bd62580588e7949c52185aeaaed05f9a

2.182.1 (2025-11-05)

Bug Fixes

Checksums

SHA1

auth-v2.182.1-arm64.tar.gz:

38a12109ad62df32460d88e4c7b2a475b88e7865

auth-v2.182.1-x86.tar.gz:

0cba43837f291f39cfd6a31007473284a6ab269c

auth-v2.182.1-arm64.tar.xz:

fe864a004eee2ed8c61f9aa9a7fcafb019146fc1
SHA256

auth-v2.182.1-arm64.tar.gz:

119e1c6e67a293ddc2d017be48e69fd7a0bd47ef90f56c5d272c941dd53d56bf

auth-v2.182.1-x86.tar.gz:

5eb877578cdfdb298326e0155d276646b1d7b1c74264f252b5f4c44245787be3

auth-v2.182.1-arm64.tar.xz:

ada62d393566b4bd28f5d9fc80e2b7c3e7a421cfce5db26fe3ca35c7d631750a

2.182.0 (2025-11-05)

Features
  • oauthserver: add authorization list and revoke endpoints (#2232) (cc640b2)
Bug Fixes
  • hostname can be empty with redirect urls (#2241) (f5a4cba)

Checksums

SHA1

auth-v2.182.0-arm64.tar.gz:

6d00d21ede8215e1a4e9186de4b61e2b0588f8f0

auth-v2.182.0-x86.tar.gz:

828351795ff4ab28972070957ce3d71cb58cd7fe

auth-v2.182.0-arm64.tar.xz:

4def983fb9149806ffd23ff6c52877ac7edf920c
SHA256

auth-v2.182.0-arm64.tar.gz:

98121a734527fbb7eefe3e66e953ce0a94181734e1f3e86004af824bc22d4a28

auth-v2.182.0-x86.tar.gz:

2894ebff4362493a57c7f98c576b152dfa3b1ac577363e59f2b7eb8261eece51

auth-v2.182.0-arm64.tar.xz:

71e16b77e340a7ae67560a386e168f20f5f74a11a84b8ba6fbbd650bc37f459c

2.181.0 (2025-10-31)

Features
  • add .well-known/openid-configuration (#2197) (9a8d0df)
  • add auth_migration annotation for the migrations (#2234) (b276d0b)
  • add advisor to notify you when to double the max connection pool (#2167) (a72f5d9)
  • add after-user-created hook (#2169) (bd80df8)
  • add support for account changes notifications in email send hook (#2192) (6b382ae)
  • email address changed notification (#2181) (047f851)
  • identity linked/unlinked notifications (#2185) (7d46936)
  • introduce v2 refresh token algorithm (#2216) (dea5b8e)
  • MFA factor enrollment notifications (#2183) (53db712)
  • notify users when their phone number has changed (#2184) (21f3070)
  • oauthserver: add OAuth client admin update endpoint (#2231) (6296a5a)
  • properly handle redirect url fragments and unusual hostnames (#2200) (aa0ac5b)
  • store latest challenge/attestation data (#2179) (01ebce1)
  • support percentage based db limits with reload support (#2177) (1731466)
  • webauthn support schema changes, update openapi.yaml (#2163) (68cb8d2)
Bug Fixes
  • gosec incorrectly warns about accessing signature[64] (#2222) (bca6626)
  • openapi: add missing OAuth client registration fields (#2227) (cf39a8a)

Checksums

SHA1

auth-v2.181.0-arm64.tar.gz:

11dc4af6824e2d4304142454505645bd12b295ec

auth-v2.181.0-x86.tar.gz:

3a22b123f628a7d12248db0f5049e913ade50023

auth-v2.181.0-arm64.tar.xz:

74283dfd64d0a4af4f32799749b23766ba6cb6ff
SHA256

auth-v2.181.0-arm64.tar.gz:

7a52c3b6d9e48e62806193a8d19ffe8a6d36701b18cbc1e6249c81b676ad4d05

auth-v2.181.0-x86.tar.gz:

4dfed901e5028247fe06c5f9f316602faf5c5335c79ffad7898fec7ce8a66e22

auth-v2.181.0-arm64.tar.xz:

af084f87e6539780faea0f38ddf6bdf0563552d1445b4da0541cae44988ae943

2.180.0 (2025-09-23)

Features
  • add OAuth client type (#2152) (b118f1f)
  • add phone to sms webhook payload (#2160) (d475ac1)
  • background template reloading p1 - baseline decomposition (#2148) (746c937)
  • config reloading with fsnotify, poller fallback, and signals (#2161) (c77d512)
  • enhance issuer URL validation in OAuth server metadata (#2164) (a9424d2)
  • implement OAuth2 authorization endpoint (#2107) (5318552)
  • oauth2: add /oauth/token endpoint (#2159) (a89a0b0)
  • oauth2: add admin endpoint to regenerate OAuth client secrets (#2170) (0bd1c28)
  • oauth2: return redirect_uri on GET authorization (#2175) (b0a0c3e)
  • oauth2: use id field as the public client_id (#2154) (86b7de4)
  • openapi: add OAuth 2.1 server endpoints and clarify OAuth modes (#2165) (1f804a2)
  • password changed email notification (#2176) (fe0fd04)
  • support transfer_sub in apple id tokens (#2162) (8a71006)
Bug Fixes
  • ensure request context exists in API db operations (#2171) (060a992)
  • makefile: remove invalid @ symbol from shell commands (#2168) (e6afe45)
  • oauth2: switch to Origin header for request validation (#2174) (42bc9ab)

Checksums

SHA1

auth-v2.180.0-arm64.tar.gz:

386c1fb6be075004091b2fbd8662dc9dcdc7af04

auth-v2.180.0-x86.tar.gz:

1107775e0d3a9112e427dbffecd1208f0d4f4d37

auth-v2.180.0-arm64.tar.xz:

91bdb239c6494138e90629d81bb9346c02422158
SHA256

auth-v2.180.0-arm64.tar.gz:

856da71aa898fec3cb1ce9555b4459e3b1e14d38699fb78e1e3122b22d2e5dc2

auth-v2.180.0-x86.tar.gz:

3fe064281f5cf7bda94251a3bd9e87a690d081381d9ea93b1491163735209e2e

auth-v2.180.0-arm64.tar.xz:

80a86acc343b7ff3cd25d9283f4ec495129afaae0672b42b26912c914e6c02a1

2.179.0 (2025-08-28)

Features
  • add oauth2 client support (#2098) (8fae015)
  • experimental own linking domains per provider (#2119) (747bf3b)
  • fetch email from snapchat oauth provider if available for consistency (#2110) (7507822)
  • implement link identity with oidc / native sign in (#2108) (5f0ec87)
  • implements email-less accounts with oauth (#2105) (9a61dae)
  • introduce request-scoped background tasks & async mail sending (#2126) (2c8ea61)
  • refactor mailer client wiring and add validation wrapper (#2130) (68c40a6)
  • support multiple aud for the external providers (#2117) (ca5792e)
  • use slices.Contains instead of for loops (#2111) (9f22682)
Bug Fixes

Checksums

SHA1

auth-v2.179.0-arm64.tar.gz:

e985fce00b2720b747e6a04420910015c4967121

auth-v2.179.0-x86.tar.gz:

f8612a5c0a28249b0f90656029a0a1116b3e52e6

auth-v2.179.0-arm64.tar.xz:

547aec7909b50ad07f778a55edb5c998f67146b6
SHA256

auth-v2.179.0-arm64.tar.gz:

248d99663d1564676134031b89d3086ffdf7ca7c7929dd37544f13c00506af41

auth-v2.179.0-x86.tar.gz:

4f86145f548d76dfa3be0fcc5ecfb1f6cd14d875f38c8ae054451e70f5961f6e

auth-v2.179.0-arm64.tar.xz:

cfa5819f845f62987e57540b8c718fbbc34c0cb7b9f2c6b10d74243e9d42c5f4

2.178.0 (2025-08-05)

Features
  • add sign in with ethereum (#2069) (079b242)
  • add support for managing SSO providers by resource_id (#2081) (5ca4489)
  • log all audit events separately to prevent missing events (#2086) (3b666f5)
  • skip nonce check for Facebook Limited Login auth (#2082) (f1b15ff)
  • support ledger solana offchain message signing (#2093) (4c94443)

Checksums

SHA1

auth-v2.178.0-arm64.tar.gz:

56c5cf913eebf701ab5805e529375483933a0476

auth-v2.178.0-x86.tar.gz:

b91bd3a8f3ba8bac3bc977b3abbf2387996d9202

auth-v2.178.0.supafast-arm64.tar.gz:

0a7b4f4220e09c696f8b903064a33f0dfe3a887d
SHA256

auth-v2.178.0-arm64.tar.gz:

f1078731841608bbbe73a06c86ea69062f83b09d6a8d0d8c9dc8ec992d6dea85

auth-v2.178.0-x86.tar.gz:

a5cd450518e84f588bf88ffe737d98080e4e07288826f1b57025f8fb57722c66

auth-v2.178.0.supafast-arm64.tar.gz:

c8dfb004f08453777c23d7c7e171ed31e4e2ea1ee398718b5828302a680a0a8a

2.177.0 (2025-07-05)

Features
  • add option to disable writing to audit_log_entries (#2073) (80758dd)
  • add snapchat provider (#2071) (fca8ea4)
  • enhance login analytics (#2078) (1aed4a2)
  • fallback to jwt secret if alg is HS256 and the kid is not recognized (#2072) (8fa99bd)
  • ignore aud claim from admin jwt (service_role never had one) (#2070) (57eddcb)
Bug Fixes
  • add missing provider info to signedup audit logs (#2061) (c6e0cbe)
  • auditlog: keep writing to logs even postgres is disabled (#2076) (b89bc32)
  • do not log fatal when http server successfully closes (#2065) (1f7de6c)
  • invites should send another email when user exists (#2058) (96469bd)
  • use appleid.apple.com as default issuer (#2068) (963a781)
  • use split_words config option for AuditLog (#2075) (7ecb234)

Checksums

SHA1

auth-v2.177.0-arm64.tar.gz:

664a26237618c4bfb1e33e4f03a540c3cef3e3c8

auth-v2.177.0-x86.tar.gz:

cc8fa098915641e53291d7e69225c9ed01f39a58

auth-v2.177.0.supafast-arm64.tar.gz:

5da78275acf17255c4356f80df550c7d857cd077
SHA256

auth-v2.177.0-arm64.tar.gz:

ad1bb7de7857f0351d4422d9840fc239f610a4ba53696a3675473ca2ee2cc073

auth-v2.177.0-x86.tar.gz:

fa48b1c1df11576c87b23e7f189ac6f01cd95265244eed7ff8a4e647858a0428

auth-v2.177.0.supafast-arm64.tar.gz:

1659313bfa93e13807a55169e6e86bdadae12ad9197b0ea803f60d2ab8228c1b

2.176.1 (2025-06-11)

Bug Fixes
  • new odic.Provider for apple with insecure issuer url context (#2055) (23d69f1)
  • skip apple oidc issuer check (#2053) (1c6f18e)

Checksums

SHA1

auth-v2.176.1-arm64.tar.gz:

3b392d2e332d5b5114e571c0d62ab9f827fd5b76

auth-v2.176.1-x86.tar.gz:

022b87e4c75a8a544e4b157dde3c2e6217d01016

auth-v2.176.1.supafast-arm64.tar.gz:

ae88d1d18ef1863fc9514ae4a060850be4729470
SHA256

auth-v2.176.1-arm64.tar.gz:

0d827396ffd2cfed63568c62bffc6110d1a4805ebaee19c05bd3f0fafd3e97f8

auth-v2.176.1-x86.tar.gz:

492c14d460268861bf435dd9c1fe2d1b45810de32755e84a80b6e384d660b08c

auth-v2.176.1.supafast-arm64.tar.gz:

92b61923f9def60a1a6fd326e3e79dd21db74ba47873da229bf562edd8ea7c8b

2.176.0 (2025-06-11)

Features
  • Add custom claims from Keycloak user token (#1917) (1365aaa)
Bug Fixes
  • accept ID tokens from all account.apple.com and appleid.apple.com (#2050) (82aa167)

Checksums

SHA1

auth-v2.176.0-arm64.tar.gz:

a682c8cac80f30e51ec5dabe8642464e407d2581

auth-v2.176.0-x86.tar.gz:

c4bf289fa649c7aa6a61085223921c84605778b0

auth-v2.176.0.supafast-arm64.tar.gz:

020d9c63fc1a6e30e5262d278f37b44227f02b2d
SHA256

auth-v2.176.0-arm64.tar.gz:

51233557bb9b1a780a5a686ecbb3e25103298690c2481519f45568ca262eee3d

auth-v2.176.0-x86.tar.gz:

2c50edd5d95b836d2a80eb7d081f61eca8c6956dd418f3ebba039f0b1643cecc

auth-v2.176.0.supafast-arm64.tar.gz:

812bd8006547bda6593b0baa8cbc01d6e504edb904385a0548319f5482128f8b

2.175.0 (2025-06-03)

Features
  • hooks round 5 (Option 2) - add before-user-created hook (#2034) (b53f6b0)
Bug Fixes
  • email-sendhook - bug in email change verification (#2044) (be20654)

Checksums

SHA1

auth-v2.175.0-arm64.tar.gz:

4e2a41e08936195daf443c60201691c1bd991709

auth-v2.175.0-x86.tar.gz:

545801626542d602af83cf7b8e74e1067cc6534d

auth-v2.175.0.supafast-arm64.tar.gz:

1d9680f44fbdfd09147b6882c68bcd9c82a22fce
SHA256

auth-v2.175.0-arm64.tar.gz:

742c20280e094411496110676a29e9a32d32c47a4a7032d4042c1fcdff88e94a

auth-v2.175.0-x86.tar.gz:

37b73b750b3b82015b9c1cfa7bbe7422dc681e5a7290e855150edf6d83413bc7

auth-v2.175.0.supafast-arm64.tar.gz:

67295f3e79247bf0e6eb1742466a8afc5836f645de00f55bcbc8b4f45b7c0deb

2.174.0 (2025-05-23)

Features
  • hooks round 2 - remove indirection and simplify error handling (#2025) (26e23f0)
  • hooks round 4 - update tests to use require package (#2030) (aaf93df)
Bug Fixes
  • amr claim should contain provider_id for sso method (#2033) (33741e1)