9.0.0

⚠️ Breaking changes

• Config file handlers (import): path traversal is now a hard error. A file reference that resolves outside the config directory now aborts the import with an error instead of logging a deprecation warning (the warning shipped in 8.43.0 and 8.44.0). This applies to every file-backed field in both directory and YAML formats: action code, rule/hook script, database customScripts, client custom_login_page, connection/email-template/branding body, prompt partials, and flow/form bodies. Move any out-of-tree references (../ relative paths or absolute paths) inside your config directory. Blocked references fail with Path traversal blocked: "<input>" resolves to "<resolved>" which is outside the config directory "<root>". before any Management API call. a0deploy export is unaffected. [#1498]
• AUTH0_DOMAIN environment variable: must now be a bare host. The node-auth0 v7 upgrade validates the domain more strictly and rejects values that include a scheme or a trailing slash (for example https://tenant.auth0.com/); use a bare host such as tenant.us.auth0.com. This Management-API-only release also moves token acquisition to the SDK's managed auth, which auto-refreshes tokens during long-running import/export runs while preserving the previous fail-fast behavior on bad credentials. See the node-auth0 v7 migration guide. [#1491]

Added

• Add handlers for MFA advanced factor configuration (phone/email OTP and Guardian settings). [#1497]
• Add support for the post-credential-validation action trigger. [#1494]
• Add anonymous sessions support to tenant, clients, and resource servers. [#1496]
• Support enforce_permission_ceiling and enforce_self_assignment_restriction on my_organization_configuration (EA). [#1495]
• Support tenants without the riskAssessment and guardianPolicies entitlement by handling insufficient_entitlement 403 responses gracefully instead of failing the run. [#1493]

Fixed

• Surface the real API error on tokenExchangeProfiles 403 responses. [#1492]
• Honor kid and other credential fields on private_key_jwt/mTLS credential creation. [#1489]
• Apply AUTH0_INCLUDED_CONNECTIONS on export. [#1442]
• Prevent client grant loss and duplication in directory-format exports. [#1473]