chore: release v0.3.1

[github-actions]

🤖 New release

• rustauth-oauth: 0.3.0 -> 0.3.1
• rustauth-social-providers: 0.3.0 -> 0.3.1
• rustauth-core: 0.3.0 -> 0.3.1
• rustauth-tokio-postgres: 0.3.0 -> 0.3.1
• rustauth-deadpool-postgres: 0.3.0 -> 0.3.1
• rustauth-diesel: 0.3.0 -> 0.3.1
• rustauth-fred: 0.3.0 -> 0.3.1
• rustauth-i18n: 0.3.0 -> 0.3.1
• rustauth-plugins: 0.3.0 -> 0.3.1
• rustauth-oauth-provider: 0.3.0 -> 0.3.1
• rustauth-oidc: 0.3.0 -> 0.3.1
• rustauth-passkey: 0.3.0 -> 0.3.1
• rustauth-redis: 0.3.0 -> 0.3.1
• rustauth-saml: 0.3.0 -> 0.3.1
• rustauth-scim: 0.3.0 -> 0.3.1
• rustauth-sqlx: 0.3.0 -> 0.3.1
• rustauth-sso: 0.3.0 -> 0.3.1
• rustauth-stripe: 0.3.0 -> 0.3.1
• rustauth-telemetry: 0.3.0 -> 0.3.1
• rustauth: 0.3.0 -> 0.3.1
• rustauth-actix-web: 0.3.0 -> 0.3.1
• rustauth-axum: 0.3.0 -> 0.3.1
• rustauth-cli: 0.3.0 -> 0.3.1

Changelog

rustauth-oauth

0.2.0 - 2026-06-14

Initial public working release.

Added

• OAuth2Client with authorization-code, refresh, client-credentials, and device flows.
• PKCE, guarded outbound HTTP (blocks private/loopback IPs by default), and JWT/JWKS verification helpers.
• ClientSecret and flow builder APIs for social and generic OAuth integrations.

rustauth-social-providers

0.2.0 - 2026-06-14

Initial public working release.

Added

• Built-in social OAuth providers (GitHub, Google, Discord, Slack, Apple, and more).
• SocialProviderConfig, SocialProviderConfigBuilder, ProviderId, and ProviderIdentity.
• providers::* for app setup and advanced::* for low-level OAuth types.

rustauth-core

0.3.1 - 2026-07-02

Fixed

• (core) validate social oauth callback aliases (#197)

rustauth-tokio-postgres

0.2.0 - 2026-06-14

Initial public working release.

Added

• Minimal tokio-postgres database adapter for apps that own a Client.
• Bundled TokioPostgresStores and migration planning for Postgres.

rustauth-deadpool-postgres

0.2.0 - 2026-06-14

Initial public working release.

Added

• Pooled Postgres adapter via deadpool-postgres (recommended for production).
• Bundled DeadpoolPostgresStores and shared migration planning with rustauth-tokio-postgres.

rustauth-diesel

0.3.0 - 2026-06-15

Added

• Production Postgres DbAdapter (diesel-postgres) with full CRUD, joins,
  transactions, schema migrations, plugin migrations, and SQL-backed rate limits.
• Production MySQL DbAdapter (diesel-mysql) with full CRUD, joins,
  transactions, schema migrations, plugin migrations, and SQL-backed rate limits.
• DieselPostgresStores / DieselPostgresStoresBuilder bundle.
• DieselMysqlStores / DieselMysqlStoresBuilder bundle.
• Dynamic DieselPostgresRow and DieselMysqlRow (QueryableByName) for shared SQL runner integration.
• Port of rustauth-sqlx Postgres and MySQL adapter integration tests.

rustauth-fred

0.3.1 - 2026-07-02

Fixed

• break plugins/fred dev-dep cycle and repair post-0.3.0 CI

rustauth-i18n

0.2.0 - 2026-06-14

Initial public working release.

Added

• Internationalization plugin with I18nOptions, locale resolution, and async get_locale callbacks.
• Localized auth error and response shaping for AuthRouter::handle_async.

rustauth-plugins

0.3.1 - 2026-07-02

Changed

• [codex] Add verified Generic OIDC profile extraction (#186)

Fixed

• break plugins/fred dev-dep cycle and repair post-0.3.0 CI
• (plugins) restrict email OTP verification endpoints
• (plugins) reject unverified generic oauth id tokens (#179)
• fix generic oauth fail-closed http client (#180)
• fix phone otp storage (#182)
• reject protected admin user updates (#185)
• (organization) authorize invitation team assignment
• (organization) authorize add-member team assignment
• (admin) reject reserved create-user data fields (#199)
• (phone-number) require password before sign-in OTP (#202)

Changed

• Email OTP verification create/get endpoints are now marked server-only, so public route
  dispatch returns 404 while server-side handlers can still create and recover OTP values.

rustauth-oauth-provider

0.3.1 - 2026-07-02

Fixed

• fix oauth client reference id update (#181)
• (oauth) enforce skip-consent boundary
• (oauth) prevent public client downgrade
• (oauth) bind introspection and revocation to clients

rustauth-oidc

0.2.0 - 2026-06-14

Initial public working release.

Added

• OIDC relying-party helpers for external enterprise IdPs (Okta, Entra ID, Auth0, Keycloak, …).
• Discovery document validation, token endpoint authentication selection, and ID token verification.

rustauth-passkey

0.3.1 - 2026-07-02

Fixed

• (passkey) bind verification to challenge config

rustauth-redis

0.2.0 - 2026-06-14

Initial public working release.

Added

• Redis/Valkey rate-limit and secondary storage via redis-rs.
• TLS support behind optional rustls and native-tls features.
• Atomic GETDEL for secondary-storage take operations.

rustauth-saml

0.3.1 - 2026-07-02

Fixed

• (sso) cap SAML SLO message inflation (#184)

rustauth-scim

0.3.1 - 2026-07-02

Fixed

• fix scim filter complexity limits (#177)
• (scim) deny empty required role allow-list

rustauth-sqlx

0.2.0 - 2026-06-14

Initial public working release.

Added

• SQLx-backed adapters for SQLite, Postgres, and MySQL.
• Bundled SqlxStores and apply_to_options for recommended app wiring.
• SQL-backed standalone rate-limit store and dialect-specific migration planning.
• Feature flags per dialect (sqlite, postgres, mysql); default = [].

rustauth-sso

0.3.1 - 2026-07-02

Changed

• Harden SSO provider trust (#183)

Fixed

• fail closed when OIDC HTTP client build fails (#176)
• (sso) cap SAML SLO message inflation (#184)
• (sso) harden saml acs idp-initiated responses
• (sso) require org admin for provider registration (#196)
• (sso) enforce saml assertion signature policy (#200)
• (sso) require signed SAML SLO logout requests (#201)

rustauth-stripe

0.3.1 - 2026-07-02

Fixed

• (stripe) validate success redirect

rustauth-telemetry

0.2.0 - 2026-06-14

Initial public working release.

Added

• Optional anonymous telemetry: get_telemetry_auth_config, TelemetryPublisher, and CLI event payloads.
• Redacted config snapshots and opt-in RUSTAUTH_TELEMETRY environment controls.
• Feature-gated HTTP transport (http feature).

rustauth

0.3.1 - 2026-07-02

Changed

• Harden SSO provider trust (#183)
• [codex] Add verified Generic OIDC profile extraction (#186)
• (release) add release-plz automation

Fixed

• (stripe) validate success redirect
• fail closed when OIDC HTTP client build fails (#176)
• (sso) harden saml acs idp-initiated responses
• (sso) require org admin for provider registration (#196)
• (sso) enforce saml assertion signature policy (#200)
• (sso) require signed SAML SLO logout requests (#201)
• fix scim filter complexity limits (#177)
• (scim) deny empty required role allow-list
• (sso) cap SAML SLO message inflation (#184)
• (plugins) restrict email OTP verification endpoints
• (plugins) reject unverified generic oauth id tokens (#179)
• fix generic oauth fail-closed http client (#180)
• fix phone otp storage (#182)
• reject protected admin user updates (#185)
• (organization) authorize invitation team assignment
• (organization) authorize add-member team assignment
• (admin) reject reserved create-user data fields (#199)
• (phone-number) require password before sign-in OTP (#202)
• (passkey) bind verification to challenge config
• fix oauth client reference id update (#181)
• (oauth) enforce skip-consent boundary
• (oauth) prevent public client downgrade
• (oauth) bind introspection and revocation to clients
• break plugins/fred dev-dep cycle and repair post-0.3.0 CI
• (core) validate social oauth callback aliases (#197)

Changed

Official plugins (rustauth-plugins)

• Email OTP verification create/get endpoints are now server-only routes, preventing public
  HTTP dispatch while preserving server-side OTP generation and retrieval flows.
• Generic OAuth now supports explicit verified OIDC ID-token profile extraction with
  JWKS, issuer, audience, expiration, subject, nonce, algorithm, and authorized-party checks.

rustauth-actix-web

0.3.0 - 2026-06-15

Added

• RustAuthActixWebExt for mounting auth routes into Actix Web (mount_at_base_path,
  mount_routes, handle).
• RustAuthActixWebOptions for per-mount configuration.
• Parity integration tests against the Axum adapter contract.

rustauth-axum

0.2.0 - 2026-06-14

Initial public working release.

Added

• RustAuthAxumExt for mounting auth routes into Axum (mount_at_base_path, into_router,
  into_routes, handle).
• RustAuthAxumOptions for per-mount configuration.

rustauth-cli

0.3.0 - 2026-06-15

Added

• rustauth init --framework actix-web snippet and workspace detection for Actix Web projects.

Changed

• Breaking: rustauth init requires --framework axum or --framework actix-web.
• Breaking: database.adapter is required in rustauth.toml and for rustauth init (via
  --adapter or workspace detection). The previous implicit default (sqlx) was removed.

---

This PR was generated with release-plz.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
rustauth-docs-site	Ignored	Preview	Jul 2, 2026 8:19am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2019150609

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate the release from the current main

This 0.3.1 bump is based on parent 2f5088e, but main already contains 8f61b4d (fix(sso): prevent provider update org reassignment (#198)) before its release commit. If these crates are published from this tree, the 0.3.1 release will omit that SSO fix and its release notes entry, so please rebase/regenerate the release before publishing.

Useful? React with 👍 / 👎.