2.0.1

What's Changed

• fix: parameterize CQL/N1QL queries to prevent injection by @lakhansamani in #500
• Fix/validate redirect uri by @lakhansamani in #502
• fix: prevent OAuth account pre-hijacking via unverified email linking by @lakhansamani in #503

Full Changelog: 2.0.0...2.0.1

2.0.0

What's Changed

• 📝 docs(self hosting): Add deployment link for Alibaba Cloud by @LYH-RAIN in #464
• fix: consistent ClientID assignment, close #470 by @localnerve in #472
• v2 optimise performance + security by @lakhansamani in #466
• chore: fix mail verification by @lakhansamani in #475
• fix: use JWTPublicKey for ECDSA token parsing by @lakhansamani in #487
• test: add missing test coverage for admin queries and edge cases by @lakhansamani in #498
• fix: respect isStrongPasswordDisabled in password validator by @lakhansamani in #488
• fix: use crypto/rand for OTP generation by @lakhansamani in #489
• fix: use constant-time comparison for admin secret by @lakhansamani in #490
• fix: add revoked user check to VerifyEmail and VerifyOTP by @lakhansamani in #491
• fix: correct boolean condition for password change in UpdateProfile by @lakhansamani in #493
• fix: add OTP expiration check in ResetPassword by @lakhansamani in #494
• fix: use zero-length slice with capacity for EmailTemplates by @lakhansamani in #496
• fix: validate roles in VerifyEmail HTTP handler by @lakhansamani in #497
• fix: correct verification request expiry logic in Login by @lakhansamani in #492
• fix: check verificationRequest.Identifier for login method in VerifyEmail by @lakhansamani in #495
• fix: OAuth2/OIDC standards compliance for HTTP handlers by @lakhansamani in #499

New Contributors

• @LYH-RAIN made their first contribution in #464
• @localnerve made their first contribution in #472

Full Changelog: 1.4.4...2.0.0

2.0.0-rc.6

What's Changed

• fix: use JWTPublicKey for ECDSA token parsing by @lakhansamani in #487
• test: add missing test coverage for admin queries and edge cases by @lakhansamani in #498
• fix: respect isStrongPasswordDisabled in password validator by @lakhansamani in #488
• fix: use crypto/rand for OTP generation by @lakhansamani in #489
• fix: use constant-time comparison for admin secret by @lakhansamani in #490
• fix: add revoked user check to VerifyEmail and VerifyOTP by @lakhansamani in #491
• fix: correct boolean condition for password change in UpdateProfile by @lakhansamani in #493
• fix: add OTP expiration check in ResetPassword by @lakhansamani in #494
• fix: use zero-length slice with capacity for EmailTemplates by @lakhansamani in #496
• fix: validate roles in VerifyEmail HTTP handler by @lakhansamani in #497
• fix: correct verification request expiry logic in Login by @lakhansamani in #492
• fix: check verificationRequest.Identifier for login method in VerifyEmail by @lakhansamani in #495

Full Changelog: 2.0.0-rc.5...2.0.0-rc.6

2.0.0-rc.5

Full Changelog: 2.0.0-rc.4...2.0.0-rc.5

• Fix default root args

2.0.0-rc.4

• Fix JWT token signing method

2.0.0-rc.3

What's Changed

• chore: fix mail verification by @lakhansamani in #475

Full Changelog: 2.0.0-rc.2...2.0.0-rc.3

2.0.0-rc.2

Full Changelog: 2.0.0-rc.1...2.0.0-rc.2

2.0.0-rc.1

What's Changed

• 📝 docs(self hosting): Add deployment link for Alibaba Cloud by @LYH-RAIN in #464
• fix: consistent ClientID assignment, close #470 by @localnerve in #472
• v2 optimise performance + security by @lakhansamani in #466

New Contributors

• @LYH-RAIN made their first contribution in #464
• @localnerve made their first contribution in #472

Full Changelog: 1.4.4...2.0.0-rc.1

1.4.4

What's Changed

• chore: remove refs to deprecated io/ioutil by @testwill in #455
• Apple outh fix by @bete7512 in #459
• fix: email login if email not verified by @lakhansamani in #460

New Contributors

• @bete7512 made their first contribution in #459

Full Changelog: 1.4.3...1.4.4

1.4.3

Full Changelog: 1.4.2...1.4.3

• Fix state for login state