Skip to content

v0.1.0

Choose a tag to compare

View all tags
@EsTharian EsTharian released this 19 Oct 13:21
v0.1.0
bfd2ea3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

QAuth v0.1.0 closes the 0.1 line. It is still pre-1.0, and no release has had an external security audit yet; see SECURITY.md.

Security

This release fixes 66 security advisories: 1 critical, 13 high, 37 medium and 15 low.

  • 65 come from a private report by Anthropic's OSS Scanner.
  • One was found while fixing them.

Every release candidate, v0.1.0-rc.0 to v0.1.0-rc.3, is affected. Upgrade.

The list is in the CHANGELOG and on the advisories page. Each advisory names its fix commits and anything the fix does not cover.

Before you upgrade from v0.1.0-rc.3

  • Migrations 0021, 0022 and 0023 run on upgrade.
    • Migration 0023 suspends every client that is disabled when it runs.
    • An operator lifts a suspension with db:suspend-oauth-client --lift.
  • Authorization errors redirect automatically only to clients an operator provisioned: the system client, or a client from the seed manifest. Every other client gets the error on an issuer page.
  • REQUIRE_VERIFIED_ACCOUNT, the new name of REQUIRE_EMAIL_VERIFIED, now defaults to true.
  • email scope:
    • Access tokens carry email only when the email scope was granted.
    • /oauth/userinfo checks the token's audience.
  • Redirect URIs are limited to https, http to a loopback host, and reverse-domain private-use schemes.
  • Wallet sign-in never creates an account.
  • The CHANGELOG lists every breaking change and new setting.

Full Changelog: v0.1.0-rc.3...v0.1.0

Assets 2
Loading