From 206e3cd87d72862bd69ad84edefea775723a233b Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 7 Sep 2026 23:03:39 -0400 Subject: [PATCH] chore: bump to auth API v0.10.0, dashboard v0.5.0, templates v0.12.0 Three auth API releases land together. v0.8.0 gives WebAuthn challenges their own store with an expiry and one-time use, so a registration and a login can be outstanding at once instead of clobbering each other, and adds AUTHENTICATOR_POLICY. v0.9.0 puts the lockout policy and the per-IP and per-identity limiters on TOTP step-up, which had none of the three, and stops running refresh tokens through bcrypt. v0.10.0 drops the sessions.refreshTokenHash column the previous release stopped writing. The scaffold's compose file is built from the pinned release's .env.example, so a new project picks up AUTHENTICATOR_POLICY along with SESSION_IDLE_TTL, MAX_CONCURRENT_SESSIONS and a commented TRUST_PROXY, and REFRESH_TOKEN_TTL moves from 1h to 1d. The dashboard bump keeps the standalone console (--admin=image and --admin=source) in step with the one the API image serves at /console: API v0.10.0 embeds dashboard v0.5.0 itself. Templates v0.12.0 moves the starters onto @seamless-auth/react 0.11.0, @seamless-auth/express 0.13.0 and @seamless-auth/fastify 0.4.0. All three are 0.x minors, so the caret ranges the starters carried could never have resolved to them. Its manifest contract is unchanged, so nothing in init moves with it. The conformance adapters follow the same SDKs the starters now install. --- .changeset/ecosystem-bump-september.md | 36 +++++++++++++++++++++++++ resources/coverage-badge.svg | 8 +++--- src/core/images.ts | 6 ++--- verify/adapter-app/package.json | 2 +- verify/adapter-fastify-app/package.json | 2 +- 5 files changed, 45 insertions(+), 9 deletions(-) create mode 100644 .changeset/ecosystem-bump-september.md diff --git a/.changeset/ecosystem-bump-september.md b/.changeset/ecosystem-bump-september.md new file mode 100644 index 0000000..e209775 --- /dev/null +++ b/.changeset/ecosystem-bump-september.md @@ -0,0 +1,36 @@ +--- +'seamless-cli': minor +--- + +Move the scaffold onto the current Seamless ecosystem: auth API `v0.10.0`, admin dashboard `v0.5.0`, +and seamless-templates `v0.12.0`. + +Three releases of auth API work land together. `v0.8.0` gives WebAuthn challenges their own store +with a five-minute expiry and one-time use, so a registration and a login can be outstanding at once +instead of clobbering each other, and it adds `AUTHENTICATOR_POLICY`, which decides attachment, user +verification, attestation, and whether a synced passkey may enrol. `v0.9.0` puts the lockout policy +and the per-IP and per-identity limiters on TOTP step-up, which had none of the three, and stops +running refresh tokens through bcrypt. `v0.10.0` drops the `sessions.refreshTokenHash` column the +previous release stopped writing. + +A scaffold's compose file is built from the pinned release's `.env.example`, so a new project picks up +`AUTHENTICATOR_POLICY` along with `SESSION_IDLE_TTL`, `MAX_CONCURRENT_SESSIONS` and a commented +`TRUST_PROXY`, and `REFRESH_TOKEN_TTL` moves from `1h` to `1d`. + +The admin dashboard bump keeps the standalone console (`--admin=image` and `--admin=source`) in step +with the one the API image now serves at `/console`, since `v0.10.0` embeds dashboard `v0.5.0` itself. +That release names the acting administrator separately from the subject in the events table, and +collects identity proofing before preparing a device replacement, which is what the API already +records and requires. + +Templates `v0.12.0` moves the starters onto `@seamless-auth/react` `0.11.0`, `@seamless-auth/express` +`0.13.0` and `@seamless-auth/fastify` `0.4.0`. All three are 0.x minors, so the caret ranges the +starters carried could never have resolved to them and a scaffolded project stayed on the older +versions however long ago they were pinned. It also carries per-application auth cookie names read +from `AUTH_COOKIE_PREFIX`, so two Seamless apps on one host stop overwriting each other's session. The +manifest contract is unchanged, so nothing in `init` moves with it. + +The conformance harness's adapters follow the same SDKs the starters now install: +`@seamless-auth/express` `^0.13.0` and `@seamless-auth/fastify` `^0.4.0`. Both stop repeating the +access and refresh tokens in the body of the response that sets them as `httpOnly` cookies, and both +forward a magic link's `redirectUri` to the API. diff --git a/resources/coverage-badge.svg b/resources/coverage-badge.svg index fdefd25..270ff0d 100644 --- a/resources/coverage-badge.svg +++ b/resources/coverage-badge.svg @@ -1,5 +1,5 @@ - - coverage: 99.3% + + coverage: 99.4% @@ -17,7 +17,7 @@ coverage coverage - 99.3% - 99.3% + 99.4% + 99.4% diff --git a/src/core/images.ts b/src/core/images.ts index c489542..c163572 100644 --- a/src/core/images.ts +++ b/src/core/images.ts @@ -3,11 +3,11 @@ // scaffolded with, and never has its data directory pulled out from under it. export const POSTGRES_IMAGE = "postgres:18"; -export const SEAMLESS_AUTH_API_VERSION = "v0.7.1"; +export const SEAMLESS_AUTH_API_VERSION = "v0.10.0"; export const SEAMLESS_AUTH_API_IMAGE = `ghcr.io/fells-code/seamless-auth-api:${SEAMLESS_AUTH_API_VERSION}`; -export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.4.0"; +export const SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION = "v0.5.0"; export const SEAMLESS_AUTH_ADMIN_DASHBOARD_IMAGE = `ghcr.io/fells-code/seamless-auth-admin-dashboard:${SEAMLESS_AUTH_ADMIN_DASHBOARD_VERSION}`; @@ -25,4 +25,4 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V // SEAMLESS_TEMPLATES_REF, or point at a local checkout with SEAMLESS_TEMPLATES_DIR. export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates"; -export const SEAMLESS_TEMPLATES_REF = "v0.9.0"; +export const SEAMLESS_TEMPLATES_REF = "v0.12.0"; diff --git a/verify/adapter-app/package.json b/verify/adapter-app/package.json index ca26159..735a907 100644 --- a/verify/adapter-app/package.json +++ b/verify/adapter-app/package.json @@ -5,7 +5,7 @@ "type": "module", "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/express with a capture transport.", "dependencies": { - "@seamless-auth/express": "^0.12.1", + "@seamless-auth/express": "^0.13.0", "cookie-parser": "^1.4.6", "cors": "^2.8.5", "express": "^5.1.0" diff --git a/verify/adapter-fastify-app/package.json b/verify/adapter-fastify-app/package.json index af358df..2203863 100644 --- a/verify/adapter-fastify-app/package.json +++ b/verify/adapter-fastify-app/package.json @@ -6,7 +6,7 @@ "description": "Minimal adopter backend for the conformance harness — real @seamless-auth/fastify with a capture transport.", "dependencies": { "@fastify/cors": "^11.0.1", - "@seamless-auth/fastify": "^0.3.1", + "@seamless-auth/fastify": "^0.4.0", "fastify": "^5.2.0" } }