Supabase Auth Changelog File — Supabase

Changelog

2.195.0 (2026-07-30)

Features

gate SCIM router behind an experimental feature flag (#2639) (0fde049)

Bug Fixes

accept offline_access OAuth scope for MCP refresh clients (#2630) (059b86c)
auditlogs: add missing events to docs (3e5d493)
auditlogs: remove unused mfa code audit log events (2909344)
auditlogs: remove unused recovery codes audit log events (d4ca02a)
persist last_sign_in_at on v2 refresh token issuance (#2655) (fc654b0)
reject AT from banned users (#2642) (b6878c2)
update google.golang.org/grpc to v1.82.1 (#2651) (4a596c0)

2.194.0 (2026-07-27)

Features

add cursor-based pagination for admin users list (#2633) (76e2aac)
add optional override for custom provider redirect URIs (#2641) (67c55c0)

Bug Fixes

consolidate error logs into single log entry (#2635) (47b3d94)
deps: bump otel versions for vulncheck (#2648) (4c2d691)
upgrade to x/text@v0.39.0 GO-2026-5970 (#2636) (66421c6)

2.193.1 (2026-07-16)

Bug Fixes

build darwin-arm64 release binaries with GOOS=darwin (#2618) (318b4d1)
ensure legacy refresh token revoked (#2624) (8748000)
oauth: prevent authorization-code replay race at /oauth/token (#2612) (bdbf01e)
siwe: return false instead of panicking on malformed signatures (#2625) (c3005a4)

2.193.0 (2026-07-07)

Features

linking: add experimental provider linking-domain groups (#2604) (c4f6964)

Bug Fixes

downgrade session AAL after admin deletion of factor (#2607) (4d1d660)
mfa: use AMR method (not factor type) when downgrading sessions to AAL1 (#2615) (dfe62d0)

2.192.0 (2026-06-29)

Features

custom-oauth: add per-provider custom_claims_allowlist (#2576) (acecb06)

Bug Fixes

tests: rely on error codes for hooks tests to work across PG backends (ee91c5f)
vulncheck: ignore GO-2026-5004 (pgx/v4, not reachable) (#2602) (f1cc16f)

2.191.0 (2026-06-17)

Features

add RS256 signing keys backed by AWS KMS (#2571) (983f59a)
saml: support zero-downtime SP key rotation (#2575) (5b95ff8)

2.190.0 (2026-06-11)

Features

add -failfast to make test command (#2553) (bec1dd0)
conf: add JSON config file support (#2540) (e63fef9)
create tools directory for deterministic builds (#2522) (52cf3d9)
custom-oidc: support non-standard discovery URLs (#2573) (3dacc64)
fix the vulncheck-filter to parse the text format instead (#2525) (4136d49)
fork github.com/joho/godotenv into internal/conf/envparse (#2521) (cda62a9)

Bug Fixes

Azure issuer validation (#2560) (a39858b)
catch cancelation errors in bg workers & servers (#2530) (77f5918)
check session state for admin tokens (#2555) (c5969ed)
config: warn on invalid WebAuthn config instead of erroring (#2545) (ca0b154)
custom-oidc: strip trailing slashes from issuer (#2570) (169ad67)
Dockerfile: ensure forks exists on fs before make deps (#2567) (01f136d)
mailer: include SiteURL in notification template data (#2532) (dc015da)
oauth-server: serialize concurrent authorize/consent with row-level lock (#2512) (c816cfe)
passkeys: delete webauthn creds when user is soft-deleted (#2564) (7e1c060)
passkeys: enforce AAL checks on passkey registration and deletion (#2565) (7e6f2e4)
source WebAuthn RP config from env vars (#2490) (63949ca)
when version is empty set to 0.0.0 (#2531) (a3b7c8c)

2.189.0 (2026-04-23)

Features

add PKCE support for /resend (#2401) (2af904a)
improve parallelization in github workflows and Makefile (#2436) (9d0c4b3)
passkeys: add CAPTCHA to options endpoint for authentication (#2416) (c7b58be)
support live reloading of individual rate limits (#2469) (d03d796)

Bug Fixes

ensure identities are returned in a consistent order across DB engines (#2465) (e49a3e5)
ensure SSO providers tests are order-independent (#2466) (983ade6)
exempt PKCE recovery sessions from require-current-password check (#2502) (7f88985)
indexworker: skip index creation on OrioleDB (#2481) (dd56ae9)
passkeys: modify the passkeys request and response shapes (#2475) (2d8f2b6)
prevent reuse of flow state (#2483) (88dcb2d)
return JSON response for unmatched routes instead of plain text (#2457) (7337e21)

2.188.1 (2026-03-19)

Bug Fixes

remove make all from release workflow (#2433) (036e723)

2.188.0 (2026-03-17)

Features

cache OIDC discovery documents for providers (#2389) (40d07b5)
enable custom providers by default (#2427) (291cdad)
modernize IsNotFoundError handler to support errors.Is (#2392) (ab7c9f9)
oauth-server: allow updating token_endpoint_auth_method for OAuth clients (#2391) (1280dc1)
passkeys: add admin endpoints to list and delete passkeys (f109550)
passkeys: add audit, metering, webauthn primitives (039b569)
passkeys: add configuration, error codes, and schemas (0a5eb95)
passkeys: add discoverable credential auth flow (#2411) (1bc68ea)
passkeys: add management endpoints (#2413) (5b3218e)
passkeys: add rate limiter on the /options endpoint for authentication (#2422) (30b3aeb)
passkeys: derive friendly name from AAGUID (#2415) (e00ff1a)
passkeys: progressive enrollment flow (61ae2aa)

Bug Fixes

add MaxBytesReader middleware to limit request body size to 1MB (#2402) (6f0b2eb)
bump Go to v1.25.8 (#2412) (a2e357f)
passkeys: construct configuration env var correctly (dba676e)
passkeys: enforce passkey cap during registration verify (9868df6)
passkeys: return 204 when deleting a passkey (7d90fb8)
passkeys: sign_count should be uint32 (e509e3a)

2.187.0 (2026-02-23)

Features

add metadata field to all hooks (#2365) (c675749)
check current password on change (#2364) (33b87ae)
indexworker: add max users threshold for rollout (#2374) (a2066c6)
metrics: added a gauge with version information (#2375) (911ad0b)
support custom oauth & oidc providers (#2357) (53021f6)

Bug Fixes

case-insensitive Bearer token scheme matching (#2387) (36d712d)
correctly parse JWT ValidMethods from env by enabling split_words (#2334) (a6076bc)
flaky index worker test (#2366) (961a7e6)
hooks: propagate error objects from hook calls (#2380) (3ca1e88)
session upgrade percentage should be based on session, not request (#2371) (510e68b)

2.186.0 (2026-01-28)

Features

Add email send operation metrics (#2311) (0096575)
add Supabase Auth identifier to OAuth redirect URLs (#2299) (2d3dbc6)
log sb-auth-user-id, sb-auth-session-id, ... on sign in not just refresh token (#2342) (a486ada)
oauth-server: store and enforce token_endpoint_auth_method (#2300) (bcd6cd5)
replace JWT OAuth state with flow_state.id UUID (#2331) (645654d)
upgrade existing sessions to v2 refresh tokens though config value (#2356) (6fb0e8a)

Bug Fixes

reloader unittest races on writeWg (#2352) (088b714)
update migration version (#2343) (61ef4db)

2.185.0 (2026-01-12)

Features

Add Sb-Forwarded-For header and IP-based rate limiting (#2295) (e8f679b)
allow amr claim to be array of strings or objects (#2274) (607da43)
reset main branch to 2.185.0 (#2325) (b9d0500)
Treat rate limit header value as comma-separated list (#2282) (5f2e279)

Bug Fixes

additional provider and issuer checks (#2326) (cb79a74)
check each type independently (#2290) (d9de0af)
fix the wrong error return value (#1950) (e2dfb5d)
indexworker: remove pg_trgm extension (#2301) (c553b10)
oauth-server: allow custom URI schemes in client redirect URIs (#2298) (ea72f57)
tighten email validation rules (#2304) (33bb372)

2.184.0 (2025-12-08)

Features

increment refresh token counter by 2 for mfa verify (#2284) (2a38668)
load template cache at startup for fault tolerance (#2261) (511c3a4)
oauth: add support for X/Twitter v2 provider (#2275) (7f36eb0)

2.183.0 (2025-11-20)

Features

async, concurrent index creation for users table (#2239) (a1146bf)
indexworker: use auth_trgm extension if available (#2263) (05daa43)
oauthserver: add OpenID Connect support (#2250) (162788f)
oauthserver: update oauth grant list & authorization details response structure (#2247) (137ea92)
oauthserver: use NewOAuthServerAuthorizationParams & configurable ttl for authorization (#2254) (61632f8)

Bug Fixes

indexworker: detect which schema pg_trgm exists in (#2260) (4be12b3)
look for refresh token on mfa verification only in v1 (#2249) (2906b24)
mfa verify now works with refresh token algorithm v2 (#2246) (4e8275f)
social-auth: default to current_user:read for Figma provider (#2195) (f409d11)

2.182.1 (2025-11-05)

Bug Fixes

japanese dot example fix (#2243) (3a5f4b2)

2.182.0 (2025-11-05)

Features

oauthserver: add authorization list and revoke endpoints (#2232) (cc640b2)

Bug Fixes

hostname can be empty with redirect urls (#2241) (f5a4cba)

2.181.0 (2025-10-31)

Features

add .well-known/openid-configuration (#2197) (9a8d0df)
add auth_migration annotation for the migrations (#2234) (b276d0b)
add advisor to notify you when to double the max connection pool (#2167) (a72f5d9)
add after-user-created hook (#2169) (bd80df8)
add support for account changes notifications in email send hook (#2192) (6b382ae)
email address changed notification (#2181) (047f851)
identity linked/unlinked notifications (#2185) (7d46936)
introduce v2 refresh token algorithm (#2216) (dea5b8e)
MFA factor enrollment notifications (#2183) (53db712)
notify users when their phone number has changed (#2184) (21f3070)
oauthserver: add OAuth client admin update endpoint (#2231) (6296a5a)
properly handle redirect url fragments and unusual hostnames (#2200) (aa0ac5b)
store latest challenge/attestation data (#2179) (01ebce1)
support percentage based db limits with reload support (#2177) (1731466)
webauthn support schema changes, update openapi.yaml (#2163) (68cb8d2)

Bug Fixes

gosec incorrectly warns about accessing signature[64] (#2222) (bca6626)
openapi: add missing OAuth client registration fields (#2227) (cf39a8a)

2.180.0 (2025-09-23)

Features

add OAuth client type (#2152) (b118f1f)
add phone to sms webhook payload (#2160) (d475ac1)
background template reloading p1 - baseline decomposition (#2148) (746c937)
config reloading with fsnotify, poller fallback, and signals (#2161) (c77d512)
enhance issuer URL validation in OAuth server metadata (#2164) (a9424d2)
implement OAuth2 authorization endpoint (#2107) (5318552)
oauth2: add /oauth/token endpoint (#2159) (a89a0b0)
oauth2: add admin endpoint to regenerate OAuth client secrets (#2170) (0bd1c28)
oauth2: return redirect_uri on GET authorization (#2175) (b0a0c3e)
oauth2: use id field as the public client_id (#2154) (86b7de4)
openapi: add OAuth 2.1 server endpoints and clarify OAuth modes (#2165) (1f804a2)
password changed email notification (#2176) (fe0fd04)
support transfer_sub in apple id tokens (#2162) (8a71006)

Bug Fixes

ensure request context exists in API db operations (#2171) (060a992)
makefile: remove invalid @ symbol from shell commands (#2168) (e6afe45)
oauth2: switch to Origin header for request validation (#2174) (42bc9ab)

2.179.0 (2025-08-28)

Features

add oauth2 client support (#2098) (8fae015)
experimental own linking domains per provider (#2119) (747bf3b)
fetch email from snapchat oauth provider if available for consistency (#2110) (7507822)
implement link identity with oidc / native sign in (#2108) (5f0ec87)
implements email-less accounts with oauth (#2105) (9a61dae)
introduce request-scoped background tasks & async mail sending (#2126) (2c8ea61)
refactor mailer client wiring and add validation wrapper (#2130) (68c40a6)
support multiple aud for the external providers (#2117) (ca5792e)
use slices.Contains instead of for loops (#2111) (9f22682)

Bug Fixes

add id-token permission to ci (#2143) (79209c0)
add missing param (#2125) (c0b75f6)
change s3 artifact upload role (#2145) (767e371)
remove requirement of empty content-type on 204 (#2128) (ecc97e0)
run release-please again (#2144) (2560f14)
stripped binary now includes version (#2147) (609f169)
update copyright year in LICENSE (#2142) (67fe0b0)

2.178.0 (2025-08-05)

Features

add sign in with ethereum (#2069) (079b242)
add support for managing SSO providers by resource_id (#2081) (5ca4489)
log all audit events separately to prevent missing events (#2086) (3b666f5)
skip nonce check for Facebook Limited Login auth (#2082) (f1b15ff)
support ledger solana offchain message signing (#2093) (4c94443)

2.177.0 (2025-07-05)

Features

add option to disable writing to audit_log_entries (#2073) (80758dd)
add snapchat provider (#2071) (fca8ea4)
enhance login analytics (#2078) (1aed4a2)
fallback to jwt secret if alg is HS256 and the kid is not recognized (#2072) (8fa99bd)
ignore aud claim from admin jwt (service_role never had one) (#2070) (57eddcb)

Bug Fixes

add missing provider info to signedup audit logs (#2061) (c6e0cbe)
auditlog: keep writing to logs even postgres is disabled (#2076) (b89bc32)
do not log fatal when http server successfully closes (#2065) (1f7de6c)
invites should send another email when user exists (#2058) (96469bd)
use appleid.apple.com as default issuer (#2068) (963a781)
use split_words config option for AuditLog (#2075) (7ecb234)

2.176.1 (2025-06-11)

Bug Fixes

new odic.Provider for apple with insecure issuer url context (#2055) (23d69f1)
skip apple oidc issuer check (#2053) (1c6f18e)

2.176.0 (2025-06-11)

Features

Add custom claims from Keycloak user token (#1917) (1365aaa)

Bug Fixes

accept ID tokens from all account.apple.com and appleid.apple.com (#2050) (82aa167)

2.175.0 (2025-06-03)

Features

hooks round 5 (Option 2) - add before-user-created hook (#2034) (b53f6b0)

Changelog

2.195.0 (2026-07-30)

Features

gate SCIM router behind an experimental feature flag (#2639) (0fde049)

Bug Fixes

accept offline_access OAuth scope for MCP refresh clients (#2630) (059b86c)
auditlogs: add missing events to docs (3e5d493)
auditlogs: remove unused mfa code audit log events (2909344)
auditlogs: remove unused recovery codes audit log events (d4ca02a)
persist last_sign_in_at on v2 refresh token issuance (#2655) (fc654b0)
reject AT from banned users (#2642) (b6878c2)
update google.golang.org/grpc to v1.82.1 (#2651) (4a596c0)

2.194.0 (2026-07-27)

Features

add cursor-based pagination for admin users list (#2633) (76e2aac)
add optional override for custom provider redirect URIs (#2641) (67c55c0)

Bug Fixes

consolidate error logs into single log entry (#2635) (47b3d94)
deps: bump otel versions for vulncheck (#2648) (4c2d691)
upgrade to x/text@v0.39.0 GO-2026-5970 (#2636) (66421c6)

2.193.1 (2026-07-16)

Bug Fixes

build darwin-arm64 release binaries with GOOS=darwin (#2618) (318b4d1)
ensure legacy refresh token revoked (#2624) (8748000)
oauth: prevent authorization-code replay race at /oauth/token (#2612) (bdbf01e)
siwe: return false instead of panicking on malformed signatures (#2625) (c3005a4)

2.193.0 (2026-07-07)

Features

linking: add experimental provider linking-domain groups (#2604) (c4f6964)

Bug Fixes

downgrade session AAL after admin deletion of factor (#2607) (4d1d660)
mfa: use AMR method (not factor type) when downgrading sessions to AAL1 (#2615) (dfe62d0)

2.192.0 (2026-06-29)

Features

custom-oauth: add per-provider custom_claims_allowlist (#2576) (acecb06)

Bug Fixes

tests: rely on error codes for hooks tests to work across PG backends (ee91c5f)
vulncheck: ignore GO-2026-5004 (pgx/v4, not reachable) (#2602) (f1cc16f)

2.191.0 (2026-06-17)

Features

add RS256 signing keys backed by AWS KMS (#2571) (983f59a)
saml: support zero-downtime SP key rotation (#2575) (5b95ff8)

2.190.0 (2026-06-11)

Features

add -failfast to make test command (#2553) (bec1dd0)
conf: add JSON config file support (#2540) (e63fef9)
create tools directory for deterministic builds (#2522) (52cf3d9)
custom-oidc: support non-standard discovery URLs (#2573) (3dacc64)
fix the vulncheck-filter to parse the text format instead (#2525) (4136d49)
fork github.com/joho/godotenv into internal/conf/envparse (#2521) (cda62a9)

Bug Fixes

Azure issuer validation (#2560) (a39858b)
catch cancelation errors in bg workers & servers (#2530) (77f5918)
check session state for admin tokens (#2555) (c5969ed)
config: warn on invalid WebAuthn config instead of erroring (#2545) (ca0b154)
custom-oidc: strip trailing slashes from issuer (#2570) (169ad67)
Dockerfile: ensure forks exists on fs before make deps (#2567) (01f136d)
mailer: include SiteURL in notification template data (#2532) (dc015da)
oauth-server: serialize concurrent authorize/consent with row-level lock (#2512) (c816cfe)
passkeys: delete webauthn creds when user is soft-deleted (#2564) (7e1c060)
passkeys: enforce AAL checks on passkey registration and deletion (#2565) (7e6f2e4)
source WebAuthn RP config from env vars (#2490) (63949ca)
when version is empty set to 0.0.0 (#2531) (a3b7c8c)

2.189.0 (2026-04-23)

Features

add PKCE support for /resend (#2401) (2af904a)
improve parallelization in github workflows and Makefile (#2436) (9d0c4b3)
passkeys: add CAPTCHA to options endpoint for authentication (#2416) (c7b58be)
support live reloading of individual rate limits (#2469) (d03d796)

Bug Fixes

ensure identities are returned in a consistent order across DB engines (#2465) (e49a3e5)
ensure SSO providers tests are order-independent (#2466) (983ade6)
exempt PKCE recovery sessions from require-current-password check (#2502) (7f88985)
indexworker: skip index creation on OrioleDB (#2481) (dd56ae9)
passkeys: modify the passkeys request and response shapes (#2475) (2d8f2b6)
prevent reuse of flow state (#2483) (88dcb2d)
return JSON response for unmatched routes instead of plain text (#2457) (7337e21)

2.188.1 (2026-03-19)

Bug Fixes

remove make all from release workflow (#2433) (036e723)

2.188.0 (2026-03-17)

Features

cache OIDC discovery documents for providers (#2389) (40d07b5)
enable custom providers by default (#2427) (291cdad)
modernize IsNotFoundError handler to support errors.Is (#2392) (ab7c9f9)
oauth-server: allow updating token_endpoint_auth_method for OAuth clients (#2391) (1280dc1)
passkeys: add admin endpoints to list and delete passkeys (f109550)
passkeys: add audit, metering, webauthn primitives (039b569)
passkeys: add configuration, error codes, and schemas (0a5eb95)
passkeys: add discoverable credential auth flow (#2411) (1bc68ea)
passkeys: add management endpoints (#2413) (5b3218e)
passkeys: add rate limiter on the /options endpoint for authentication (#2422) (30b3aeb)
passkeys: derive friendly name from AAGUID (#2415) (e00ff1a)
passkeys: progressive enrollment flow (61ae2aa)

Bug Fixes

add MaxBytesReader middleware to limit request body size to 1MB (#2402) (6f0b2eb)
bump Go to v1.25.8 (#2412) (a2e357f)
passkeys: construct configuration env var correctly (dba676e)
passkeys: enforce passkey cap during registration verify (9868df6)
passkeys: return 204 when deleting a passkey (7d90fb8)
passkeys: sign_count should be uint32 (e509e3a)

2.187.0 (2026-02-23)

Features

add metadata field to all hooks (#2365) (c675749)
check current password on change (#2364) (33b87ae)
indexworker: add max users threshold for rollout (#2374) (a2066c6)
metrics: added a gauge with version information (#2375) (911ad0b)
support custom oauth & oidc providers (#2357) (53021f6)

Bug Fixes

case-insensitive Bearer token scheme matching (#2387) (36d712d)
correctly parse JWT ValidMethods from env by enabling split_words (#2334) (a6076bc)
flaky index worker test (#2366) (961a7e6)
hooks: propagate error objects from hook calls (#2380) (3ca1e88)
session upgrade percentage should be based on session, not request (#2371) (510e68b)

2.186.0 (2026-01-28)

Features

Add email send operation metrics (#2311) (0096575)
add Supabase Auth identifier to OAuth redirect URLs (#2299) (2d3dbc6)
log sb-auth-user-id, sb-auth-session-id, ... on sign in not just refresh token (#2342) (a486ada)
oauth-server: store and enforce token_endpoint_auth_method (#2300) (bcd6cd5)
replace JWT OAuth state with flow_state.id UUID (#2331) (645654d)
upgrade existing sessions to v2 refresh tokens though config value (#2356) (6fb0e8a)

Bug Fixes

reloader unittest races on writeWg (#2352) (088b714)
update migration version (#2343) (61ef4db)

2.185.0 (2026-01-12)

Features

Add Sb-Forwarded-For header and IP-based rate limiting (#2295) (e8f679b)
allow amr claim to be array of strings or objects (#2274) (607da43)
reset main branch to 2.185.0 (#2325) (b9d0500)
Treat rate limit header value as comma-separated list (#2282) (5f2e279)

Bug Fixes

additional provider and issuer checks (#2326) (cb79a74)
check each type independently (#2290) (d9de0af)
fix the wrong error return value (#1950) (e2dfb5d)
indexworker: remove pg_trgm extension (#2301) (c553b10)
oauth-server: allow custom URI schemes in client redirect URIs (#2298) (ea72f57)
tighten email validation rules (#2304) (33bb372)

2.184.0 (2025-12-08)

Features

increment refresh token counter by 2 for mfa verify (#2284) (2a38668)
load template cache at startup for fault tolerance (#2261) (511c3a4)
oauth: add support for X/Twitter v2 provider (#2275) (7f36eb0)

2.183.0 (2025-11-20)

Features

async, concurrent index creation for users table (#2239) (a1146bf)
indexworker: use auth_trgm extension if available (#2263) (05daa43)
oauthserver: add OpenID Connect support (#2250) (162788f)
oauthserver: update oauth grant list & authorization details response structure (#2247) (137ea92)
oauthserver: use NewOAuthServerAuthorizationParams & configurable ttl for authorization (#2254) (61632f8)

Bug Fixes

indexworker: detect which schema pg_trgm exists in (#2260) (4be12b3)
look for refresh token on mfa verification only in v1 (#2249) (2906b24)
mfa verify now works with refresh token algorithm v2 (#2246) (4e8275f)
social-auth: default to current_user:read for Figma provider (#2195) (f409d11)

2.182.1 (2025-11-05)

Bug Fixes

japanese dot example fix (#2243) (3a5f4b2)

2.182.0 (2025-11-05)

Features

oauthserver: add authorization list and revoke endpoints (#2232) (cc640b2)

Bug Fixes

hostname can be empty with redirect urls (#2241) (f5a4cba)

2.181.0 (2025-10-31)

Features

add .well-known/openid-configuration (#2197) (9a8d0df)
add auth_migration annotation for the migrations (#2234) (b276d0b)
add advisor to notify you when to double the max connection pool (#2167) (a72f5d9)
add after-user-created hook (#2169) (bd80df8)
add support for account changes notifications in email send hook (#2192) (6b382ae)
email address changed notification (#2181) (047f851)
identity linked/unlinked notifications (#2185) (7d46936)
introduce v2 refresh token algorithm (#2216) (dea5b8e)
MFA factor enrollment notifications (#2183) (53db712)
notify users when their phone number has changed (#2184) (21f3070)
oauthserver: add OAuth client admin update endpoint (#2231) (6296a5a)
properly handle redirect url fragments and unusual hostnames (#2200) (aa0ac5b)
store latest challenge/attestation data (#2179) (01ebce1)
support percentage based db limits with reload support (#2177) (1731466)
webauthn support schema changes, update openapi.yaml (#2163) (68cb8d2)

Bug Fixes

gosec incorrectly warns about accessing signature[64] (#2222) (bca6626)
openapi: add missing OAuth client registration fields (#2227) (cf39a8a)

2.180.0 (2025-09-23)

Features

add OAuth client type (#2152) (b118f1f)
add phone to sms webhook payload (#2160) (d475ac1)
background template reloading p1 - baseline decomposition (#2148) (746c937)
config reloading with fsnotify, poller fallback, and signals (#2161) (c77d512)
enhance issuer URL validation in OAuth server metadata (#2164) (a9424d2)
implement OAuth2 authorization endpoint (#2107) (5318552)
oauth2: add /oauth/token endpoint (#2159) (a89a0b0)
oauth2: add admin endpoint to regenerate OAuth client secrets (#2170) (0bd1c28)
oauth2: return redirect_uri on GET authorization (#2175) (b0a0c3e)
oauth2: use id field as the public client_id (#2154) (86b7de4)
openapi: add OAuth 2.1 server endpoints and clarify OAuth modes (#2165) (1f804a2)
password changed email notification (#2176) (fe0fd04)
support transfer_sub in apple id tokens (#2162) (8a71006)

Bug Fixes

ensure request context exists in API db operations (#2171) (060a992)
makefile: remove invalid @ symbol from shell commands (#2168) (e6afe45)
oauth2: switch to Origin header for request validation (#2174) (42bc9ab)

2.179.0 (2025-08-28)

Features

add oauth2 client support (#2098) (8fae015)
experimental own linking domains per provider (#2119) (747bf3b)
fetch email from snapchat oauth provider if available for consistency (#2110) (7507822)
implement link identity with oidc / native sign in (#2108) (5f0ec87)
implements email-less accounts with oauth (#2105) (9a61dae)
introduce request-scoped background tasks & async mail sending (#2126) (2c8ea61)
refactor mailer client wiring and add validation wrapper (#2130) (68c40a6)
support multiple aud for the external providers (#2117) (ca5792e)
use slices.Contains instead of for loops (#2111) (9f22682)

Bug Fixes

add id-token permission to ci (#2143) (79209c0)
add missing param (#2125) (c0b75f6)
change s3 artifact upload role (#2145) (767e371)
remove requirement of empty content-type on 204 (#2128) (ecc97e0)
run release-please again (#2144) (2560f14)
stripped binary now includes version (#2147) (609f169)
update copyright year in LICENSE (#2142) (67fe0b0)

2.178.0 (2025-08-05)

Features

add sign in with ethereum (#2069) (079b242)
add support for managing SSO providers by resource_id (#2081) (5ca4489)
log all audit events separately to prevent missing events (#2086) (3b666f5)
skip nonce check for Facebook Limited Login auth (#2082) (f1b15ff)
support ledger solana offchain message signing (#2093) (4c94443)

2.177.0 (2025-07-05)

Features

add option to disable writing to audit_log_entries (#2073) (80758dd)
add snapchat provider (#2071) (fca8ea4)
enhance login analytics (#2078) (1aed4a2)
fallback to jwt secret if alg is HS256 and the kid is not recognized (#2072) (8fa99bd)
ignore aud claim from admin jwt (service_role never had one) (#2070) (57eddcb)

Bug Fixes

add missing provider info to signedup audit logs (#2061) (c6e0cbe)
auditlog: keep writing to logs even postgres is disabled (#2076) (b89bc32)
do not log fatal when http server successfully closes (#2065) (1f7de6c)
invites should send another email when user exists (#2058) (96469bd)
use appleid.apple.com as default issuer (#2068) (963a781)
use split_words config option for AuditLog (#2075) (7ecb234)

2.176.1 (2025-06-11)

Bug Fixes

new odic.Provider for apple with insecure issuer url context (#2055) (23d69f1)
skip apple oidc issuer check (#2053) (1c6f18e)

2.176.0 (2025-06-11)

Features

Add custom claims from Keycloak user token (#1917) (1365aaa)

Bug Fixes

accept ID tokens from all account.apple.com and appleid.apple.com (#2050) (82aa167)

2.175.0 (2025-06-03)

Features

hooks round 5 (Option 2) - add before-user-created hook (#2034) (b53f6b0)