v0.3.0

0.3.0 (2026-10-25)

Added

• recovery sessions and account notice delivery, with parity hardening (6e8750f)
• recovery sessions and account notice delivery, with parity hardening (09acec5), closes #11

Fixed

• cap cookie lifetimes at 400 days and require an http or https AuthServerURL (09acec5)
• console: keep the API's framing and content-type headers (94f9af8), closes #10
• expire the JWKS cache, back off failed fetches and cap the key set size (09acec5)
• refuse placeholder cookie and service secrets outside insecure local mode (09acec5)
• refuse upstream redirects and keep upstream URLs out of logs (09acec5)
• require exp, clear cookies on a rejected logout and never pick tokens into a body (09acec5)

Documentation

• link the governance document and license pledge (fa4a70f)
• link the governance document and license pledge (73f03a1)

v0.2.1

0.2.1 (2026-10-18)

Fixed

• forward the pre-auth token on magic link verify and serve the confirm route (#7) (37511f2)

Documentation

• name the app-side service token SEAMLESS_SERVICE_TOKEN (#5) (86fc6c3)

v0.2.0

0.2.0 (2026-10-08)

Added

• serve the admin console through ConsoleHandler (#3) (fa3fd66)