What's Changed ci: only run publishing workflows in supertokens/supertokens-core by @porcellus in #1469 ci: embargo-build workflow for private security releases by @porcellus in #1473 ci: build the core image once and promote it by digest by @porcellus in #1472 ci: build the core image once and promote it by digest by @porcellus in #1470 ci: pass the ECR digest, not the image ref, to _image-promot…
What's Changed fix: move EE license sync off the FeatureFlag constructor to a jittered cron by @supertokens-agent-runner[bot] in #1431 feat: add opt-in admin connector with port-scoped route classification by @supertokens-agent-runner[bot] in #1433 feat: add admin-only global per-status-class request stats endpoint by @supertokens-agent-runner[bot] in #1435 fix: normalize supertokens_saas_load_onl…
Security SAML callback replay hardening (GHSA-3r7x-rhvc-fw28): the callback RelayState is now single-use, every assertion is consumed at most once (new saml_consumed_assertions table), and the response is bound to the login via InResponseTo and Destination/Recipient pinning — closing the SP- and IdP-initiated replay windows. SAML: a client can carry an optional ACS-URL allow-list (acsURLs). When s…
Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Enforces SAML callback replay protection and request binding (GHSA-3r7x-rhvc-fw28). SAML: a client can carry an optional ACS-URL allow-list (acsURLs). When set, the login's ACS URL (SP-initiated) and the response Destination/SubjectConfirmationData.Recipient (IdP-initiated) must be a member — extending D…
Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Enforces SAML callback replay protection and request binding (GHSA-3r7x-rhvc-fw28). SAML: a client can carry an optional ACS-URL allow-list (acsURLs). When set, the login's ACS URL (SP-initiated) and the response Destination/SubjectConfirmationData.Recipient (IdP-initiated) must be a member — extending D…
Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Enforces SAML callback replay protection and request binding (GHSA-3r7x-rhvc-fw28). SAML: a client can carry an optional ACS-URL allow-list (acsURLs). When set, the login's ACS URL (SP-initiated) and the response Destination/SubjectConfirmationData.Recipient (IdP-initiated) must be a member — extending D…
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2). Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc). Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Enforces dashboard session expiry at verification time (GHSA-w9fp-wv6g-pqv8). Enforces SAML callback replay protection and request binding (GHSA-…
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2). Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc). Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Enforces SAML callback replay protection and request binding (GHSA-3r7x-rhvc-fw28). SAML: a client can carry an optional ACS-URL allow-list (acsU…
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2). Enforces dashboard session expiry at verification time (GHSA-w9fp-wv6g-pqv8). Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc). Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Full Changelog: v11.2.3...v11.2.4
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2). Enforces dashboard session expiry at verification time (GHSA-w9fp-wv6g-pqv8). Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc). Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Full Changelog: v11.1.3...v11.1.4
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2). Enforces dashboard session expiry at verification time (GHSA-w9fp-wv6g-pqv8). Scopes WebAuthn sign-in to the requested tenant (GHSA-6v34-w48w-44rc). Serializes session creation with account unlink to close a session race (GHSA-2pc4-vw9j-454c). Full Changelog: v11.0.8...v11.0.9
Prevents an app-scoped API key from updating its parent connectionUriDomain (GHSA-4rf2-xqvf-8rcx). Full Changelog: v10.1.8...v10.1.9
Full Changelog: v6.0.23...v6.0.24
What's Changed feat: in-memory storage parity for the activity-log/rollup contract by @supertokens-agent-runner[bot] in #1380 feat: enforce audited-transaction entry point for domain transactions by @supertokens-agent-runner[bot] in #1382 feat: lifecycle event vocabulary and payload schema for the activity log by @supertokens-agent-runner[bot] in #1381 feat: activity_log retention as a connection-…
What's Changed fix: verify database schema at startup and fail loudly on missing tables/columns by @tamassoltesz in #1387 fix: Fix config updates for CUDs that have multiple tenants by @bcbogdan in #1384 fix: bulk import no longer borrows from the live connection pool by @tamassoltesz in #1385 test: reproduce duplicate access token signing keys on concurrent rotation by @mchoopani in #1389 feat: s…
What's Changed fix: mirror dashboard-search arm rewrite and domain-prefix semantics in in-memory storage by @supertokens-agent-runner[bot] in #1365 Full Changelog: v12.1.0...v12.1.1
What's Changed test: stress-test the 1M-user suite in MIGRATED migration mode too by @supertokens-agent-runner[bot] in #1352 feat: stateless session verification (CDI 5.5) by @supertokens-agent-runner[bot] in #1309 test: regenerate-token invariant tests (PLAN-002 unit 8) by @supertokens-agent-runner[bot] in #1310 feat: optional accessTokenValidity parameter on session create and refresh (CDI 5.5)…
What's Changed fix: saml hardening by @tamassoltesz in #1356 Full Changelog: v12.0.9...v12.0.10
What's Changed fix: hardening signature validation (backport to 11.4) by @tamassoltesz in #1357 Full Changelog: v11.4.6...v11.4.7
What's Changed ci: backport workflow by @tamassoltesz in #1317 ci: backport workflow by @tamassoltesz in #1318 fix: re-enable stress-test seeding assertions and allow manual dispatch by @supertokens-agent-runner[bot] in #1339 test: measure the scale-sensitive query paths in the 1M-user stress suite by @supertokens-agent-runner[bot] in #1340 test: surface pg_stat_statements in stress-test summary,…
What's Changed fix: hardening signature validation (backport to 11.3) by @tamassoltesz in #1358 Full Changelog: v11.3.6...v11.3.7
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 11.4) by @tamassoltesz in #1319 Full Changelog: v11.4.5...v11.4.6
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 11.3) by @tamassoltesz in #1320 Full Changelog: v11.3.5...v11.3.6
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 11.2) by @tamassoltesz in #1326 Full Changelog: v11.2.2...v11.2.3
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 11.1) by @tamassoltesz in #1321 Full Changelog: v11.1.2...v11.1.3
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 11.0) by @tamassoltesz in #1324 Full Changelog: v11.0.7...v11.0.8
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 10.1) by @tamassoltesz in #1325 Full Changelog: v10.1.7...v10.1.8
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 10.0) by @tamassoltesz in #1322 Full Changelog: v10.0.6...v10.0.7
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 9.3) by @tamassoltesz in #1327 Full Changelog: v9.3.3...v9.3.4
What's Changed fix: resolve api_keys and IP access config against the app's public tenant (backport to 9.2) by @tamassoltesz in #1323 Full Changelog: v9.2.5...v9.2.6