baukit 0.7.0

baukit v0.7.0

One release train for the Rust crates, TypeScript packages, and templates.

Rust crates

baukit-auth

Added

• Add OidcVerifier::verify_id_token(token, expected_nonce) to require the
  login request's nonce on an ID token. Missing, malformed, and mismatched
  nonces return VerificationError::WrongNonce.
• Add constant_time_eq for secret bytes, using subtle 2.6.1. Unequal lengths
  return false; equal-length inputs do not stop at a differing byte. API token
  digest verification now uses this helper instead of a handwritten loop.

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

• Generic OIDC access tokens with several audiences must carry a string azp.
  Client restrictions remain opt-in through with_allowed_clients, which
  requires azp from that list on every access token. Single-audience tokens
  keep their existing claim-mapping behavior without an allowlist.

• ID-token verification requires an explicit with_client_id and that client
  in aud. Several audiences require azp equal to the client, and any present
  azp must equal it. The API audience does not set the ID-token client. Clerk
  and WorkOS keep their access-token provider checks.

Fixed

• Select aws-lc-rs for sqlx TLS so rustls has one crypto provider. Products
  must use sqlx tls-rustls-aws-lc-rs instead of tls-rustls, including dev
  dependencies, and disable the ring default in testcontainers and
  testcontainers-modules.

baukit-config

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-core

Changed

• Update the UUID dependency baseline to 1.27. Keep Rust 1.95 as the MSRV.

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-credential-vault

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-egress

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-erasure

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

• Log inline failure classes without subjects and test the token acquisition timeout.

• Add transactional product erasure, keyed subject fences, durable identity deletion, and a Keycloak admin adapter.

baukit-events

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-http

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-integrations

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-jobs

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

Fixed

• Select aws-lc-rs for sqlx TLS so rustls has one crypto provider. Products
  must use sqlx tls-rustls-aws-lc-rs instead of tls-rustls, including dev
  dependencies, and disable the ring default in testcontainers and
  testcontainers-modules.

baukit-openapi

Changed

• Update the schema validation baseline to jsonschema 0.58.5.

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

Fixed

• Correction to the 0.6.0 entry: utoipa 6 does change generated documents.
  It omits empty response descriptions, although OpenAPI 3.1 requires that
  field, and reorders Option<T> alternatives from [null, $ref] to
  [$ref, null]. Products must regenerate their committed schemas.
• Add fill_missing_response_descriptions to fill empty descriptions with
  the HTTP reason phrase. Default, range, unknown status codes, and reusable
  responses without a status use "Response". Paths, callbacks, webhooks, and
  reusable components are covered. OpenApiMetadata::apply_to and
  serialize_schema apply it by default and preserve product descriptions.

baukit-ops

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-push

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

Fixed

• Select aws-lc-rs for sqlx TLS so rustls has one crypto provider. Products
  must use sqlx tls-rustls-aws-lc-rs instead of tls-rustls, including dev
  dependencies, and disable the ring default in testcontainers and
  testcontainers-modules.

baukit-ratelimit

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-runtime

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-sync

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

Fixed

• Select aws-lc-rs for sqlx TLS so rustls has one crypto provider. Products
  must use sqlx tls-rustls-aws-lc-rs instead of tls-rustls, including dev
  dependencies, and disable the ring default in testcontainers and
  testcontainers-modules.

baukit-telemetry

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

baukit-test

• Update the Redis and Sentinel fixture images to 8.10.2-alpine, matching generated products. PostgreSQL remains on 18.6-alpine.

Changed

• Use caret requirements for third-party Rust dependencies so products can take compatible
  updates. Keep Baukit crate versions exact.

Added

• Add a scripted identity account deleter and endpoint erasure conformance checks.
• Add authorization-code and client-credentials grants to MockOidcServer.
  issue_authorization_code replaces an interactive authorize endpoint in
  tests. Codes require an S256 PKCE proof, bind the client and redirect URI,
  expire after five minutes, and can be exchanged once. Code exchange returns
  an access/refresh session. register_client_credentials registers a client
  for HTTP Basic or form authentication and issues access tokens without
  refresh tokens. Invalid grants and credentials return OAuth errors.

Fixed

• Wait for replica synchronization before exposing a Sentinel fixture, and
  compare the full master address when waiting for failover. The failover
  test now checks recovery on one store call after Sentinel publishes the
  promotion, without retrying the assertion.
• Disable the ring default in both testcontainers and testcontainers-modules
  and select aws-lc-rs. Products must do the same for their container test
  dependencies and use sqlx tls-rustls-aws-lc-rs. This keeps rustls client
  and server builders from panicking when they select a crypto provider.

Changed

• Pin the default PostgreSQL image to 18.6-alpine. The image override test
  uses 18.6-alpine3.23, so all PostgreSQL fixture tests run on 18.6.
• Check the versioned data directory, enabled checksums, SCRAM password
  encryption, and SQLx migrations against PostgreSQL 18.6.

TypeScript packages

a11y-core

Minor Changes

• Release the coordinated baukit 0.7.0 train.

analytics-core

Minor Changes

• Release the coordinated baukit 0.7.0 train.

analytics-posthog-native

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/analytics-core@0.7.0

analytics-posthog-web

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/analytics-core@0.7.0

api-runtime

Minor Changes

• Release the coordinated baukit 0.7.0 train.

auth-native

Minor Changes

• Release the coordinated baukit 0.7.0 train.

auth-node

Minor Changes

• Release the coordinated baukit 0.7.0 train.

auth-web

Minor Changes

• Release the coordinated baukit 0.7.0 train.

data-contracts-dexie

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/data-contracts@0.7.0

data-contracts-expo-sqlite

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/data-contracts@0.7.0

data-contracts

Minor Changes

• Release the coordinated baukit 0.7.0 train.

events

Minor Changes

• Release the coordinated baukit 0.7.0 train.

integrations-client

Minor Changes

• Release the coordinated baukit 0.7.0 train.

localization-core

Minor Changes

• Release the coordinated baukit 0.7.0 train.

navigation

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/a11y-core@0.7.0
  • @baukit/ui-tokens@0.7.0

notifications-core

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/localization-core@0.7.0

notifications-expo

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Patch Changes

• Updated dependencies
  • @baukit/notifications-core@0.7.0

preferences-core

Minor Changes

• Release the coordinated baukit 0.7.0 train.

pwa-web

Minor Changes

• Release the coordinated baukit 0.7.0 train.

sync-client

Minor Changes

• Release the coordinated baukit 0.7.0 train.

ui-tokens

Minor Changes

• Release the coordinated baukit 0.7.0 train.

Commits

• chore: prepare baukit v0.7.0 (33be8d2)
• fix(ci): prepare Android projects before restoring Gradle caches (07cfc15)
• fix(release): include all modules in the release train (caa5c72)
• chore(deps): refresh dependencies for the 0.7 release (3f8cf47)
• test(erasure): isolate inline timeout log capture (e974e97)
• fix(cli): distinguish missing product constants in doctor (1a6870a)
• fix(cli): resolve Makefile variables in doctor port checks (a303ed6)
• fix(cli): validate generated product constants in doctor (985a697)
• fix(mobile): use valid SecureStore keys for OIDC sessions (648c9db)
• fix(templates): bound product names and load TypeScript constants (b612df5)
• refactor(mcp): use plain product constant exports (5827463)
• fix(templates): format generated code for long product names (b665036)
• fix(deps): allow compatible Rust dependency updates (7b2a9a6)
• fix(platform): keep PostHog on its supported PostgreSQL 14.1 (f5fd377)
• docs(postgres): clarify historical test image notes (8ec0553)
• fix(platform): pin the CNPG PostgreSQL default image (2b55c74)
• fix(test): keep PostgreSQL override coverage on Alpine (455327d)
• fix(postgres): standardize PostgreSQL 18.6 defaults (329d694)
• feat(templates): link profile deletion from the navigation profile (63c786e)
• fix(templates): re-render web pages when the navigation changes the URL (585a3d6)
• fix(templates): clarify unsent deletion failures (390e6dd)
• fix(templates): poll pending profile deletion automatically (1958425)
• fix(erasure): clear durable keys after committed receipts (b248fb1)
• fix(templates): localize the mobile erasure route header (9ab064b)
• fix(templates): avoid claiming a rejected erasure never committed (1acdf16)
• feat(templates): add confirmed profile and sign-in account deletion (48e2544)
• feat(erasure): add durable profile deletion client and pending outcomes (f29b455)
• fix(navigation): use muted fills for active leaves (9075a81)
• fix(navigation): preserve workspace dependency resolutions (eee6bbf)
• feat(navigation): add shared collapsible app navigation (0157313)
• fix(templates): wire erasure dependencies and fence routes (6a44dd6)
• fix(erasure): log inline deletion failures (5a69baa)
• feat(templates): erase profiles and Keycloak accounts (8bbe545)
• feat(erasure): add durable identity account deletion (0538653)
• test(cli): refresh snapshots for the sqlx rustls provider (2b16f6b)
• fix(auth): keep access token client restrictions opt-in (c962ca1)
• fix(test): wait for a synchronized Sentinel promotion (833a173)
• fix(scripts): match OpenAPI composition members by identity (54989c7)
• fix(openapi): fill missing response descriptions (103988d)
• feat(test): support PKCE and client credentials grants (dd4c1dc)
• fix(auth): validate OIDC nonce and authorized clients (2c92524)
• fix(tls): keep container modules on aws-lc-rs (e1a5c5f)
• wip(rust): compile a single rustls crypto provider (ebef119)
• fix(platform): update service pins and use corepack for releases (8933094)
• fix(tooling): correct doctor checks and generated templates (ef17635)