All pull requests

Pull requests

• fix(oauthserver): accept loopback redirect URIs on any port

  #2871·just-some-random-pal opened Oct 13, 2026·

  ·
  1

• fix(oauth-server): inherit approving session's AAL in OAuth tokens

  #2869·rudrakshsisodia opened Oct 13, 2026·

  ·
  1

• fix: Update user password on each valid signup attempt

  #2868·hinatamasaki-supabase opened Oct 13, 2026·

  ·
  6

• feat: optional allow list check for loopback redirect URLs

  #2867·satishweb opened Oct 13, 2026·

  ·
  1

• docs: align admin OpenAPI contracts with server behavior

  #2866·haranishi opened Oct 11, 2026·

  ·
  1

  1

• fix(verify): preserve custom scheme in PKCE redirects

  #2865·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix(oauth): map refresh grant errors to RFC 6749 invalid_grant

  #2864·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix(mfa): preserve OAuth 2.1 client sessions during AAL step-up (closes #2801)

  #2863·61465 opened Oct 10, 2026·

  ·
  1

• feat: configurable CAPTCHA verification URL

  #2862·yvlocorp opened Oct 8, 2026·

  ·

• fix: require an aal2 access token to unenroll a verified MFA factor

  #2861·emfataliev opened Oct 8, 2026·

  ·
  2

• fix: drop unique constraint on mfa_factors.last_challenged_at

  #2860·yvlocorp opened Oct 7, 2026·

  ·
  1

• fix(deps): bump otel to v1.45.0 for vulncheck

  #2858·annabkr opened Oct 6, 2026Contributor·

  ·

• docs: rewrite the contributing guide as discussion-first and add an AI policy

  #2856·annabkr opened Oct 6, 2026Contributor·2/2·

  ·
  1

• docs: move the local setup guide from CONTRIBUTING.md to DEVELOPMENT.md

  #2855·annabkr opened Oct 6, 2026Contributor·1/2·

  ·

• fix(hooks): run pg-functions hooks in a transaction when the caller has none

  #2853·aerotech-vadb opened Oct 6, 2026·

  ·
  1

• fix(hooks): preserve identity unlink notification recipient

  #2851·ttulttul opened Oct 6, 2026·

  ·

• fix: report the new address when an email change is rejected as invalid

  #2848·vjymisal0 opened Oct 2, 2026·

  ·
  1

• fix(saml): don't report next key as configured when SAML is disabled

  #2846·claude[bot] opened Oct 1, 2026Bot·

  ·

• fix: verify phone change against the user holding the matching token

  #2845·sidgaikwad opened Sep 29, 2026·

  ·
  1

  2

• fix: use www.linkedin.com for LinkedIn OIDC authorization and token endpoints

  #2844·sidgaikwad opened Sep 29, 2026·

  ·
  1

• fix: accept code for PKCE token exchange

  #2843·akasakariko opened Sep 29, 2026·

  ·
  1

  1

• test: cover admin user creation ban persistence

  #2842·akasakariko opened Sep 29, 2026·

  ·
  1

• fix(admin): reject per_page=0 on paginated admin endpoints

  #2841·RaphaelFakhri opened Sep 29, 2026·

  ·

• fix(api): honor options.redirect_to and options.data in admin generate_link

  #2840·AmitKulkarni23 opened Sep 29, 2026·

  ·
  1

• fix: describe password maximum length in bytes

  #2837·KYHyeon opened Sep 27, 2026·

  ·