Skip to content

v1.13.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jun 03:15
· 721 commits to main since this release
v1.13.0
3c0a31b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • feat(oauth): Facebook, X (Twitter), and Discord sign-in alongside the existing GitHub/Google. A provider's button appears only when both its *_CLIENT_ID and *_CLIENT_SECRET are configured.
  • feat(oauth): PKCE (S256) added to the authorization-code flow — required by X, transparent for the other providers.

Operator notes

  • New optional secrets — set via wrangler secret put (leave unset to hide a provider): FACEBOOK_CLIENT_ID/FACEBOOK_CLIENT_SECRET, TWITTER_CLIENT_ID/TWITTER_CLIENT_SECRET, DISCORD_CLIENT_ID/DISCORD_CLIENT_SECRET.
  • Callback URLs use the internal provider id. Note X uses twitter: /api/v1/auth/twitter/callback (the rest match their display name).
  • X returns no email, so X users can't be auto-promoted via ADMIN_EMAILS — promote them from the admin Users page instead.
  • Instagram is intentionally unsupported (Meta retired the Instagram Basic Display API).

No migrations, no breaking changes — upgrading without setting the new secrets leaves behavior unchanged.

Full Changelog: v1.12.0...v1.13.0

Assets 5
Loading