Skip to content

Release v0.5.1

Choose a tag to compare

View all tags
@oranheim oranheim released this 01 Aug 10:43
· 95 commits to master since this release
v0.5.1
b9051b5

v0.5.1

Breaking Changes

  • Migrated from singleton pattern to dependency injection architecture
  • Replace singleton database connections with FastAPI dependency injection
  • Update OIDC endpoints to follow standard conventions (/oidc/userinfo)
  • All APIs now require proper FastAPI dependency context

Security Fixes

  • CVE-2024-47874: Update starlette to 0.47.2 (DoS via multipart/form-data, CVSS 8.7)
  • CVE-2025-54121: Update starlette to 0.47.2 (event loop blocking on large file uploads, CVSS 5.3)
  • Fix Cross-site Scripting (XSS) vulnerability in HTML parameter input rendering
  • Update fastapi to 0.116.1, uvicorn to 0.35.0, httpx to 0.28.1

Added

  • Redis integration for distributed caching, rate limiting, and sessions with automatic fallback to memory backends
  • Backend factory pattern with abstract interfaces for pluggable storage systems (src/authly/core/backend_factory.py)
  • Configuration-driven Redis feature toggles (src/authly/config/config.py)
  • Comprehensive PyPI release pipeline with automated publishing (.github/workflows/release-pypi.yml)
  • Full test suite execution (510 tests) with coverage reporting before release
  • Release validation with version consistency checks between git tags and pyproject.toml
  • Artifact attestation for enhanced security in release pipeline
  • OAuth 2.1 authorization code flow testing with PKCE support
  • Admin authentication and management API integration tests
  • Client and scope management testing via Admin API
  • Test orchestration with configurable test scopes (infrastructure, admin, clients, userauth, oauth, comprehensive)
  • Docker Compose configuration for isolated test environment setup
  • Git hooks with auto-fixing capabilities for ruff linting and formatting
  • AUTHLY_NO_AUTO_FIX environment variable to disable auto-fixing
  • Auto re-stage files after fixing linting and formatting issues
  • AdminAPIError exception class for structured error handling
  • Context-aware error messages for common API failures
  • OIDC conformance testing plan documentation
  • Codecov integration with coverage badges
  • GitHub Actions badges for full stack integration tests

Changed

  • Implement AuthlyResourceManager with mode-adaptive configuration (PRODUCTION, EMBEDDED, CLI, TESTING)
  • Migrate all API routers, services, and repositories to DI pattern
  • Integrate psycopg-toolkit Database with comprehensive lifecycle management
  • Update CI/CD for Python 3.11 compatibility (changed from 3.13)
  • Update serve command documentation with new options (--seed, --log-level, --access-log)
  • Update status command to use correct API response structure (statistics field)
  • Streamline full-stack-test-with-docker.yml with docker-build, full-stack-integration-test, and full-stack-summary jobs
  • Remove hardcoded UV version from GitHub Actions workflows to always use latest version
  • Replace interactive prompts with automatic formatting in git hooks

Fixed

  • Lint errors and formatting issues across codebase
  • GitHub Actions build-test-native.yml pipeline configuration
  • Build-test-with-docker.yml pipeline execution issues
  • Issue with async call in Authly CLI login command
  • Admin command invocations to use proper Click context and ctx.invoke()
  • Remove problematic asyncio.run() calls causing command execution errors
  • Add parameter validation for client creation (require redirect URI)
  • Map CLI parameters correctly to admin command expectations
  • Integration tests --stop-after option cleanup and remove redundant ADMIN_PASSWORD variable
  • Ruff configuration in pyproject.toml
  • TOML parsing error in pyproject.toml for Redis dependency groups configuration
  • Status code parameter added to all AdminAPIError exceptions
  • Integration tests updated to expect AdminAPIError instead of HTTPStatusError
  • Mock response objects in unit tests to include status_code attribute

Dependencies

  • Update starlette to 0.47.2
  • Update fastapi to 0.116.1
  • Update fastapi-testing to 0.3.1
  • Update uvicorn to 0.35.0
  • Update httpx to 0.28.1
  • Update fluent/fluentd Docker tag to v1.18
  • Update Python to 3.13.5 (development environments)
  • Update GitHub Actions to v6

Modern Architecture

  • AuthlyResourceManager with mode-adaptive configuration (PRODUCTION, EMBEDDED, CLI, TESTING)
  • Dependency injection pattern replacing singleton database connections
  • psycopg-toolkit Database integration with comprehensive lifecycle management
  • Mode-optimized configurations for different deployment contexts

🐛 Key Fixes

  • Resolved async call issues in Authly CLI login command
  • Fixed parameter validation for client creation
  • Corrected GitHub Actions pipeline configurations
  • Addressed Python linter issues throughout codebase
  • Fixed integration test cleanup and error handling
  • Fixed TOML parsing for Redis dependency groups configuration in pyproject.toml
Assets 2
Loading