v0.99.15

[0.99.15] — 2026-03-04

Bug Fixes

• core: Move circuit breaker provider lookups from compile time to runtime
• core: Use consistent short labels for OAuth buttons on signup page
• core: Resolve flaky booking LiveView tests caused by config pollution
• core: Add update_subscription_status/3 callback to SubscriptionManager behaviour
• core: Fix reset-password token URI matching and update OAuth tests to use session
• core: Add is_verified flag to OAuth email-linking test
• core: Fill empty English translations for cancel/reschedule meeting strings
• core: Unwrap {state, timestamp} tuple in OAuth state session test
• core: Correct OAuth provider callback specs and remove dead clauses
• core: Add top-level aliases and remove TODO tag in OAuth state modules
• core: Harden OAuth SSO security and validation
• core: Accept string email_verified claim and document IdP switching
• core: Add defensive fallbacks and fix email verification default
• core: Use constant-time comparison and TTL for OAuth state
• core: Move OAuth registration data from URL params to session

Features

• Add PASSWORD_AUTH_ENABLED flag to disable password-based auth