v4.2.2

4.2.2 (2026-10-09)

Bug Fixes

• require release asset for autoupdater (d26a9aa)

Miscellaneous Chores

• allow tmp files (for diagnosis) (166aaf8)
• update composer lock (90e62ff)
• update flake lock (7905b02)

v4.2.1

4.2.1 (2026-10-09)

Miscellaneous Chores

• bump firebase/php-jwt from 7.1.0 to 7.1.1 in the composer group (#81) (5c8ab8a)
• bump firebase/php-jwt from 7.1.1 to 7.2.0 in the composer group (#89) (b91f760)
• bump firebase/php-jwt from 7.2.0 to 7.2.1 in the composer group (#95) (e75b257)
• bump php-stubs/woocommerce-stubs in the composer group (#84) (a080ce7)
• bump php-stubs/woocommerce-stubs in the composer group (#91) (ebee140)
• bump php-stubs/wordpress-stubs (#108) (5d33a58)

jwt-auth-worker: v4.0.2

4.0.2 (2026-10-09)

Bug Fixes

• worker: answer HEAD probes of /authorize without opening a flow (#112) (60b3e71)

jwt-auth-worker: v4.0.1

4.0.1 (2026-10-09)

Bug Fixes

• ci: restore worker check (d2b3709)
• worker: keep a script's request from breaking an open sign-in (#110) (078a51e)

v4.2.0

4.2.0 (2026-09-16)

Features

• sign in with WordPress passwords in a development environment (d1743b3)
• sign in with WordPress passwords in a development environment (ab3b550)

Miscellaneous Chores

• bump php-stubs/woocommerce-stubs in the composer group (#71) (009eb46)
• bump php-stubs/wordpress-stubs in the composer group (#65) (8f2f1d0)
• bump szepeviktor/phpstan-wordpress in the composer group (#64) (5f6d46a)

v4.1.0

4.1.0 (2026-08-14)

Features

• add JWT_AUTH_EXCLUSIVE to remove the native password forms (b998da0)
• add JWT_AUTH_EXCLUSIVE to remove the native password forms (4d87929)

v4.0.0

4.0.0 (2026-08-14)

⚠ BREAKING CHANGES

• JWT_AUTH_DEFAULT_ROLE is no longer read. Sites that set it should copy the value into Settings > General > "New User Default Role" before updating; otherwise newly provisioned accounts take whatever that setting already says, which on most installs is subscriber. Existing users are unaffected — the role is only assigned at creation.
• POST /authorize now requires a flow field matching the flow cookie, and rejects a non-empty client_secret. Sign-ins already on screen across the deploy must be reloaded.

Features

• defer the new-user role to core's "New User Default Role" setting (95da39b)

Bug Fixes

• build: hand npmConfigHook the rewritten lockfile, not a built node_modules (d398e9d)
• close five findings from the security audit (c00c111)
• require a verified address to adopt an account, and cap PIN guessing per identity (c3d764d)
• woocommerce: stop the SSO button rendering twice on My Account (446fe20)

Miscellaneous Chores

• update deps (b8cf04d)

jwt-auth-worker: v4.0.0

4.0.0 (2026-08-14)

⚠ BREAKING CHANGES

• POST /authorize now requires a flow field matching the flow cookie, and rejects a non-empty client_secret. Sign-ins already on screen across the deploy must be reloaded.

Bug Fixes

• close five findings from the security audit (c00c111)
• require a verified address to adopt an account, and cap PIN guessing per identity (c3d764d)

v3.0.0

3.0.0 (2026-08-13)

⚠ BREAKING CHANGES

• WordPress ships "Anyone can register" unticked and earlier versions of the plugin ignored it, so a site relying on just-in-time provisioning must tick Settings > General > Membership before or immediately after updating, or new visitors will be turned away.

Features

• let a site stop creating accounts for new users (800b25f)

Miscellaneous Chores

• main: release jwt-auth-worker 1.0.2 (5bb2907)
• main: release jwt-auth-worker 1.0.2 (a3bf45e)

jwt-auth-worker: v3.0.0

3.0.0 (2026-08-13)

⚠ BREAKING CHANGES

• worker: the POST /authorize body field action is now step. Both sides ship together, so only sign-ins already on-screen across the deploy are affected; they recover by reloading.

Bug Fixes

• worker: stop a form field shadowing the form's own action URL (570c83a)