All pull requests

Pull requests

• feat(openapi): document passkey endpoints and regenerate admin client

  #2827·fadymak opened Sep 22, 2026·

  ·
  2

• fix: accept base64url-encoded nonce in id_token grant

  #2822·sushrut1058 opened Sep 21, 2026·

  ·
  1

  1

• chore(master): release 2.198.0

  autorelease: pending
  #2817·supabase-releaser[bot] opened Sep 17, 2026·

  ·
  13

• fix(oidc): don't mutate shared config on Facebook id_token login

  #2816·suvvvv opened Sep 16, 2026·

  ·

• fix(models): guard nil web_authn_credential in WebAuthnCredentials

  #2815·suvvvv opened Sep 16, 2026·

  ·

• fix(models): guard nil authentication_method in IsAAL2Claim

  #2814·suvvvv opened Sep 16, 2026·

  ·

• fix: stop leaking raw internal errors to clients in RefreshTokenGrant

  #2813·Rakshit-gen opened Sep 15, 2026·

  ·
  1

  1

• fix: recognize real Postgres unique violations in IsUniqueConstraintViolatedError

  #2811·Rakshit-gen opened Sep 15, 2026·

  ·
  1

  1

• fix(discord): use correct default avatar for the new username system

  #2809·suvvvv opened Sep 15, 2026·

  ·

• fix(verify): harden OTP checks against nil sent-at and timing leaks

  #2808·suvvvv opened Sep 15, 2026·

  ·

• fix(linkedin): avoid panic when the email response has no elements

  #2807·suvvvv opened Sep 15, 2026·

  ·

• fix: reject banned users in the PKCE grant

  #2806·Dhvanit41 opened Sep 15, 2026·

  ·
  1

• fix(redirect): accept allow-listed deep links with underscore schemes

  #2805·suvvvv opened Sep 15, 2026·

  ·
  1

  12

• fix(models): guard identity email against non-string metadata

  #2804·suvvvv opened Sep 15, 2026·

  ·
  1

• fix: return verify-disabled error code when WebAuthn MFA verification is off

  #2803·Dhvanit41 opened Sep 15, 2026·

  ·
  1

• fix(models): exclude oauth client sessions from mfa step-up invalidation (#2801)

  #2802·melcheikh opened Sep 14, 2026·

  ·
  1

• Migrate pop RawQuery call sites to sqlc (proof of concept)

  #2799·hf opened Sep 11, 2026·

  ·
  8

• fix(provider): don't pin expected issuer for the Azure consumers endpoint

  #2796·breken-ai opened Sep 9, 2026·

  ·
  1

• fix: map concurrent MFA verify races to 4xx instead of 500

  #2791·hsusul opened Sep 7, 2026·

  ·
  1

• feat(otp): add support for test email OTPs

  #2790·itsybitsci opened Sep 7, 2026·

  ·
  1

• fix(api): guard against nil session pointer dereference in user update and recovery codes

  #2789·Tyagiquamar opened Sep 6, 2026·

  ·
  1

  2

• chore: run go mod tidy in CI

  #2785·xlgmokha opened Sep 3, 2026·

  ·

• chore: add golangci-lint to CI

  #2784·xlgmokha opened Sep 3, 2026·

  ·
  1

  

• feat(auth): support distinct redirect URIs for OAuth mix-up defense (…

  #2782·guptamilind0099 opened Sep 3, 2026·

  ·
  1

• fix(passkey): resolve Backup Eligible flag inconsistency on login (#2…

  #2779·guptamilind0099 opened Sep 2, 2026·

  ·
  1