Skip to content

v5.13.1

Choose a tag to compare

@github-actions github-actions released this 25 Aug 20:31
· 20 commits to main since this release
7b40ed9

Patch Changes

  • 447b2b8: Restore OAuth authorization under better-auth 1.7. validAudiences no longer
    exists in @better-auth/oauth-provider@1.7, which replaced it with a
    DB-backed resource registry, so every authorize request carrying an RFC 8707
    resource was rejected with invalid_target: … is not configured — that is
    every MCP connector. The provider is now given resources to seed, and
    enforcePerClientResources: false so dynamically registered clients can reach
    them without an explicit link row. Migration 0082 adds the seven columns 1.7
    persists on oauth_refresh_token, which 0080 added to oauth_access_token
    but not here; without them the token endpoint answered 500 on both the
    authorization_code and refresh_token grants. Org-scoped resources
    (/mcp/o/<orgId>) are narrowed to their base resource in the authorize query
    as they already were in the token body, so they need no registry row and the
    org still pins through the code-challenge association.

  • 447b2b8: Restore OAuth authorization under better-auth 1.7. validAudiences no longer
    exists in @better-auth/oauth-provider@1.7, which replaced it with a
    DB-backed resource registry, so every authorize request carrying an RFC 8707
    resource was rejected with invalid_target: … is not configured — that is
    every MCP connector. The provider is now given resources to seed, and
    enforcePerClientResources: false so dynamically registered clients can reach
    them without an explicit link row. Migration 0082 adds the seven columns 1.7
    persists on oauth_refresh_token, which 0080 added to oauth_access_token
    but not here; without them the token endpoint answered 500 on both the
    authorization_code and refresh_token grants. Org-scoped resources
    (/mcp/o/<orgId>) are narrowed to their base resource in the authorize query
    as they already were in the token body, so they need no registry row and the
    org still pins through the code-challenge association.

    • @getmunin/types@5.13.1

Published packages

  • @getmunin/analytics-tracker@5.13.1
  • @getmunin/chat-widget@5.13.1
  • @getmunin/agent-host@5.13.1
  • @getmunin/agent-runtime@5.13.1
  • @getmunin/backend-core@5.13.1
  • @getmunin/core@5.13.1
  • @getmunin/dashboard-pages@5.13.1
  • @getmunin/db@5.13.1
  • @getmunin/docs-pages@5.13.1
  • @getmunin/emails@5.13.1
  • @getmunin/inspector-app@5.13.1
  • @getmunin/mcp-toolkit@5.13.1
  • @getmunin/sdk@5.13.1
  • @getmunin/types@5.13.1
  • @getmunin/ui@5.13.1