v10.2.1

Fixed

• fix(packaging): add exports map so default import works under Vite/Vitest #1655 (MatthewHarrigan)

v10.2.0

Added

• feat(captcha): allow for passing appearance to options #1630 (travisrcory)

v10.1.0

Added

• fix(captcha): prevent injection of malicious payloads in challenge.image #1652 (amitsingh05667)

v10.0.0

This fixes the release failure (#1631).
Fixed

• Security fix: Resolve CVE-2026-42280

Breaking change

Affected	Details
Apps using RS256	No breaking change
Apps using HS256	parseHash() now returns an invalid_token error instead of silently succeeding. Must switch to RS256 in the Auth0 Dashboard: Applications → your app → Settings → Advanced Settings → OAuth → JsonWebToken Signature Algorithm → RS256

v9.32.0

Fixed

• Fix: update @auth0/component-cdn-uploader to version 2.5.0 #1613 (amitsingh05667)

v9.31.0

Added

• feat: add Custom Token Exchange support #1604 (gyaneshgouraw-okta)

v9.30.1

Fixed

• fix: randomString function to handle invalid length #1583 (amitsingh05667)

v9.30.0

Added

• feat: Improve error handling when login fails after signup #1552 (amitsingh05667)
• fix: convert mock files to ES module exports #1563 (amitsingh05667)

v9.29.1

Added

• fix: add null check for challenge in captcha rendering #1541 (amitsingh05667)

v9.29.0

Added

• docs(core): fix missing captcha param in signup method jsdoc #1471 #1522 (amitsingh05667)
• feat: add Claude Code PR Review workflow #1517 (amitsingh05667)
• Add a Refresh Token example using MRRT #1499 (ivan-vazquez)
• Add a Refresh Token example #1488 (ivan-vazquez)