2.4.0-rc.17

Follows 2.4.0-rc.16 with one security fix that missed that build.

Email verification: one decision core, and empty-subject tokens refused (#755)

The GraphQL and REST verify-email paths had drifted apart twice, each time because the same decision was implemented in two places. The second drift is the one users hit: a verification click that landed on the MFA setup screen returned before email_verified_at was ever written, so the account stayed permanently "not verified" — most visibly, passkey login refused it outright.

Both paths now route through a single ConsumeEmailVerificationToken, which owns token lookup, JWT validation, purpose binding, subject handling, user lookup and the revoked check. The verified write happens before any caller gate, which is the ordering the drift got wrong.

It also refuses a verification token with an empty subject. JWT claim validation passed on an empty sub, so such a token resolved to no principal rather than failing.

Why this was not in rc.16

The fix was reviewed and merged as #752, but into security/2.4.0-audit-part-2 four minutes after that branch had already merged to main. GitHub showed it merged while its content sat in a dead end — its merge commit was never an ancestor of main. Re-targeted as #755.

Everything from rc.16 still applies

rc.16 carried the full 22-finding pre-release security audit and the breaking changes that come with it. If you are upgrading from rc.15 or earlier, read the rc.16 notes first — in particular:

• --enable-email-verification with no SMTP now fails at boot
• _delete_user / DeleteUser take id, not email
• delegated FGA against a model with no type agent is denied
• wildcard CORS no longer sends Allow-Credentials

Note that rc.15 was tagged but its build was cancelled, so no rc.15 image was ever published.

Matching SDK releases

SDK	Version
authorizer-js	4.0.0-rc.0 (npm rc tag)
authorizer-react	2.2.0-rc.7 (npm rc tag)
authorizer-go	v2.2.0-rc.5
authorizer-py	0.3.0rc4
authorizer-proto-go	v0.2.0-rc.1
authorizer-proto	0.2.0rc1

Upgrading

Read the email verification contract before upgrading if you use Microsoft login.