Skip to content

v0.19.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 12:38
v0.19.1
1a6fdc6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Hub 0.19.1 is a dependency patch on top of v0.19.0: the @authup/* libraries move to 1.0.0-beta.71, and the tooling and runtime dependencies get their minor and patch updates. No hub source changed, and the Authup server floor stays 1.0.0-beta.70.

👀 Highlights

🔒 The server render no longer puts the internal Authup address into the page

client-ui can dial Authup at one address during the server render (NUXT_AUTHUP_URL, for example an in-cluster service) and show another one to the browser (NUXT_PUBLIC_AUTHUP_URL). Up to v0.19.0, @authup/client-web-nuxt used the private address as its base URL during the server render, so a deployment with two different URLs rendered the internal Authup address into the page. Since beta.71 the public URL is the base on both sides, and the private one is only used to send requests.

NUXT_PUBLIC_AUTHUP_URL=https://auth.example.org      # every URL in the rendered page
NUXT_AUTHUP_URL=http://authup.flame.svc:3000         # only dialed by the server render

Note

NUXT_AUTHUP_URL is now documented. It defaults to AUTHUP_URL at build time, so deployments that set only NUXT_PUBLIC_AUTHUP_URL are not affected.

📖 Frontend: environment variables

🔁 A refused token refresh settles instead of hanging

When Authup answers a refresh with an OAuth2 token error (invalid_grant, invalid_client, ...), the client-ui session hook now rejects it and lets the session end, instead of retrying the refresh and hanging. Hub's own error responses carry no OAuth2 error field, so a hub 401 still triggers a refresh as before. The backend services were never affected: their token creators run without the refresh hook.

⬆️ Upgrading

npm install @privateaim/core-http-kit@^0.19.1   # and any other @privateaim/* package you use

For the services and client-ui, deploy the 0.19.1 image. No migration, configuration or Authup provisioning change is needed. If you are coming from v0.18.x, follow the upgrade order in the v0.19.0 release notes first.

Tip

If you consume @privateaim/client-vue and also install @vueuse/core yourself: hub's packages now use @vueuse/core 15, while @vuecs/* and @ilingo/* still require 14. Both copies install side by side without a conflict.

👉 Changelog

Full diff: v0.19.0...v0.19.1

Bug Fixes

  • deps: bump @authup/* to 1.0.0-beta.71 (#1976) (ee40202)
  • deps: bump minorandpatch group and dev majors except typescript (#1977) (17d5922)
Assets 2
Loading