Pull requests

• fix(auth): hide whether an email address is registered when it is changed

  #2889·SLMassari opened Oct 26, 2026·

  ·
  1

• chore: clear existing password on recover

  #2887·staaldraad opened Oct 26, 2026Member·

  ·
  2

• fix(db): run refresh token cleanup after rotation revokes tokens

  #2886·Tyagiquamar opened Oct 26, 2026·

  ·

• fix: add timeout and size limit to SAML metadata fetch

  #2885·Dextheking1 opened Oct 23, 2026·

  ·

• docs: Add SECURITY.md

  documentation
  #2884·idawson-sb opened Oct 22, 2026·

  ·

• fix: check tx.Reload error correctly in verifyGet

  #2880·AleksaMCode opened Oct 19, 2026·

  ·

• fix(password): count min length by runes, not bytes

  #2879·charconstpointer opened Oct 19, 2026·

  ·

• fix(oauth): restrict OAuth client access tokens on account-management…

  #2878·Denx00 opened Oct 18, 2026·

  ·
  1

  1

• feat(saml): allow overriding the SP ACS URL and entity id

  #2875·Gugic opened Oct 15, 2026·

  ·

• docs: fix openapi response for DELETE /admin/users/{userId}

  #2874·claude[bot] opened Oct 14, 2026Bot·

  ·
  1

• fix(mfa): allow TOTP enrollment for users without an email

  #2873·emiliosandoval4 opened Oct 14, 2026·

  ·
  1

• fix(oauthserver): accept loopback redirect URIs on any port

  #2871·just-some-random-pal opened Oct 13, 2026·

  ·
  1

  1

• fix(oauth-server): inherit approving session's AAL in OAuth tokens

  #2869·rudrakshsisodia opened Oct 13, 2026·

  ·
  1

  1

• fix: Update user password on each valid signup attempt

  #2868·hinatamasaki-supabase opened Oct 13, 2026·

  ·
  6

• feat: optional allow list check for loopback redirect URLs

  #2867·satishweb opened Oct 13, 2026·

  ·
  2

• docs: align admin OpenAPI contracts with server behavior

  #2866·haranishi opened Oct 11, 2026·

  ·
  1

  1

• fix(verify): preserve custom scheme in PKCE redirects

  #2865·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix(oauth): map refresh grant errors to RFC 6749 invalid_grant

  #2864·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix(mfa): preserve OAuth 2.1 client sessions during AAL step-up (closes #2801)

  #2863·61465 opened Oct 10, 2026·

  ·
  1

• feat: configurable CAPTCHA verification URL

  #2862·yvlocorp opened Oct 8, 2026·

  ·

• fix: require an aal2 access token to unenroll a verified MFA factor

  #2861·emfataliev opened Oct 8, 2026·

  ·
  2

• fix: drop unique constraint on mfa_factors.last_challenged_at

  #2860·yvlocorp opened Oct 7, 2026·

  ·
  1

• docs: rewrite the contributing guide as discussion-first and add an AI policy

  #2856·annabkr opened Oct 6, 2026Contributor·2/2·

  ·
  1

• docs: move the local setup guide from CONTRIBUTING.md to DEVELOPMENT.md

  #2855·annabkr opened Oct 6, 2026Contributor·1/2·

  ·

• fix(hooks): run pg-functions hooks in a transaction when the caller has none

  #2853·aerotech-vadb opened Oct 6, 2026·

  ·
  1