1.8.0

What's Changed

• Security fix. See the security advisory for details.

Behaviour changes

• Email sync needs confirmation. With Update email address from provider enabled, a provider email that differs from the forum account's no longer replaces it straight away. A confirmation link is sent to the new address, and the email only changes once it's followed. A notice goes to the current address too. Only addresses the provider confirms are verified can start a change.
• Providers from other extensions no longer sync email until they implement getProviderVerifiedEmail(). Login and registration through them work as before. A warning naming the provider is written to the forum log, at most once a day.
• GitHub now trusts only the account's primary, verified email, not the public profile email.
• Google now also trusts verified addresses on personal Google accounts (not only Gmail and Workspace), so those users can sign in to and link an existing account.
• Discord and LinkedIn: the verified flag must be exactly true.
• Unconfirmed email already in use: instead of a sign-up form that could only fail, the Log In form opens and explains how to link the provider after logging in.

For provider authors

Implement getProviderVerifiedEmail(), and only call provideTrustedEmail() for a verified address. See Email trust in the README.

What's Changed

• test: expand 1.x test coverage by @imorland in #119

Full Changelog: 1.7.4...1.8.0