v5.12.0

github-actions released this 25 Aug 10:48

· 25 commits to main since this release

6fa1bee

Minor Changes

c7039b9: Widget speaks eight more languages: Estonian, Latvian, Lithuanian, Czech, Slovak, Hungarian,
Romanian and Nynorsk.

The set was Nordics + Western Europe + Polish, which left conspicuous holes: the Baltics, where a
Nordic-first product's customers already operate as one region, and Central Europe, where Polish was
in but its neighbours were not. Twenty-one locales now ship: en nb nn da sv fi is et lv lt de fr es it pt nl pl cs sk hu ro.

Nynorsk is the odd one out and the cheapest: it was previously aliased away — nn, nno and nn-NO
all resolved to Bokmål. It now has its own strings, so nn gets Nynorsk while no, nob and nor
stay on Bokmål. Norwegian public bodies are obliged to serve both written standards, which makes this
closer to a requirement than a nicety for public-sector deals.

Locales are statically imported, so every visitor downloads every language. Measured cost of the
eight: +4.4 KB gzipped on the widget bundle (174.1 → 178.6 KB), about 0.55 KB per language.

FALLBACK_LOCALES in @getmunin/agent-runtime mirrors the widget list and moves with it, so the
runtime's canned greeting and handover notice speak the new languages too rather than silently
dropping to English. The chat-widget guide documents data-munin-locale for the first time — the
attribute has existed since the widget shipped, was described in skill://conv/setup-chat-widget,
and was missing from the human-facing optional-attributes list.

Translation notes worth a native reviewer's eye before this reaches production traffic: register is
informal for Estonian and Nynorsk, polite for Latvian, Lithuanian, Czech, Slovak, Hungarian and
Romanian, matching how support desks in each market actually address customers. Where a template
interpolates an agent's name into a case-inflecting language, the copy uses a colon form
(Kõne: {who}, Hovor: {who}, Hívás: {who}) rather than a preposition that would demand a
declined name. The Romanian month abbreviation {n} l and the Estonian {n} k are the two terse
relative-time strings most likely to want a second opinion.
1836666: Upgrade better-auth to 1.7.1 and clear the open dependency advisories.

@better-auth/oauth-provider before 1.7.0-beta.4 could issue access tokens for
unauthorized audiences via unbound resource indicators (GHSA-p2fr-6hmx-4528).
Munin's /mcp gates on scope, so a token minted for one resource being accepted
at another is directly on-threat — this is the advisory that mattered, and the
only one reachable outside the build.

1.7 pays for that fix with schema. Two migrations:
- 0079_better_auth_account_issuer — accounts are now keyed by
  (issuer, account_id) rather than (provider_id, account_id). issuer is
  NOT NULL upstream, so existing rows are backfilled with the synthetic issuers
  better-auth derives for providers that have none of their own:
  local:credential for internal credentials, local:oauth:<providerId> for
  Google and GitHub. JWKS rows gain alg and crv.
- 0080_better_auth_resource_indicators — the resource-indicator storage the
  fix runs on: an oauth_resource registry, an oauth_client_resource grant
  table, an oauth_client_assertion replay guard, and the columns the provider
  now persists on clients, access tokens and consents. Entirely additive; every
  column is nullable or defaulted, so no backfill.
Both are idempotent, and both were smoke-tested against a database already at
the preceding migration with representative rows, not a fresh one.

Two behaviour changes worth knowing about, both upstream tightening rather than
anything Munin chose:
- Dynamic client registration returns 201 Created, per RFC 7591 §3.2.1. It
  previously returned 200.
- A client that registers a loopback redirect URI (http://localhost:…) is now
  rejected unless it declares application_type: "native". OIDC defaults an
  omitted application_type to web, and web clients must use https on a
  non-loopback host. Hosted connectors are unaffected — they redirect over
  https — but a local MCP client that registers http://localhost:… without
  declaring itself native will now be turned away at registration.
Also refreshes the stale brace-expansion override floors, pins nanoid past
GHSA-2v37-7h3g-55p8 and @hono/node-server past GHSA-frvp-7c67-39w9, and
deduplicates @better-auth/utils to 0.5.0. That last one works around an
upstream contradiction: @better-auth/core@1.7.1 peer-pins both
better-call@1.4.0 and @better-auth/utils@0.4.2, but better-call@1.4.0
itself depends on @better-auth/utils@^0.5.0. Left alone, pnpm installs three
copies of @better-auth/core, and the duplicate type identities make the
oauth-provider plugin fail to typecheck against BetterAuthPlugin.

Patch Changes

d1ad5a5: Restore the spaces that vanished after inline <code>/<em>/<strong> in the guide prose.

Seven guides rendered joined-up words — "Open _Choose tools_on the connection's menu", "must not
take an email or customerIdargument", "**All spoofable.**Anyone can send mail". The space was in
the source; Next's bundled SWC dropped it. A multi-line JSX text run whose text contains an HTML
entity (’, ", <, …) loses its leading space during the entity decode — the
trailing space survives, a single-line run survives, and the same source compiled with upstream
@swc/core keeps it, so this only shows up in a Next build. It reproduces on both 16.2.12 (OSS
apps/web) and 16.2.6 (cloud marketing), and there is nothing in the source to hint at it: the
paragraph looks correct.

Each of the 18 affected boundaries now carries an explicit {' '}, which compiles to its own string
child and is immune to the bug. Verified by compiling every .tsx in the repo with Next's SWC and
asserting no element child is followed by a text child that starts mid-word, and by diffing the
rendered text of the touched files against the same files compiled with an unaffected SWC. Only
packages/docs-pages/src/guides/ was affected; nothing under apps/web hit the pattern.

One neighbouring defect fixed along the way, this one genuinely in the source: in the chat-widget
guide, <code>"dark"</code> ended a line and pins the panel began the next, so ordinary JSX
line-joining left no space at all.

Also gives a docs-attrs definition list breathing room before a following paragraph. On the
custom-MCP-server guide the "Provenance describes the turn happening right now" paragraph butted
straight against the self_reported row, reading as a fourth definition rather than prose.

Published packages

@getmunin/analytics-tracker@5.12.0
@getmunin/chat-widget@5.12.0
@getmunin/agent-host@5.12.0
@getmunin/agent-runtime@5.12.0
@getmunin/backend-core@5.12.0
@getmunin/core@5.12.0
@getmunin/dashboard-pages@5.12.0
@getmunin/db@5.12.0
@getmunin/docs-pages@5.12.0
@getmunin/emails@5.12.0
@getmunin/inspector-app@5.12.0
@getmunin/mcp-toolkit@5.12.0
@getmunin/sdk@5.12.0
@getmunin/types@5.12.0
@getmunin/ui@5.12.0

Assets 2