SDK v4

[guabu]

v4.0.1 (2025-02-12)

Full Changelog

Fixed

• fix: sanitize the returnTo parameter to prevent open redirect vulnerabilities. #1897 (guabu)

v4.0.0 (2024-01-30)

⚠️ BREAKING CHANGES.

Significant updates have been introduced in this release. Please refer to the V3 → V4 MIGRATION GUIDE for details on upgrading.

Fixed

• chore: add telemetry and options to disable in chore: add telemetry and options to disable #1864
• chore: reduce session lifetime defaults in chore: reduce session lifetime defaults #1869
• fix: persist access token scope in tokenset in fix: persist access token scope in tokenset #1870
• chore: in-memory cache for authorization server metadata in chore: in-memory cache for authorization server metadata #1871

v4.0.0-beta.14 (2024-01-06)

Fixed

• fix: propagate session data updates within the same request (fixes: Refresh token error when calling getAccessToken in v4 beta #1841)
• chore: export SessionDataStore and LogoutToken types (closes: v4: Export SessionDataStore #1852)
• feat: add generateSessionCookie testing helper (closes: v4: Add generateSessionCookie testing helper #1857)

v4.0.0-beta.13 (2024-12-20)

Fixed

• chore: refresh the token set when calling getAccessToken instead of the middleware (fixes: v4.0.0-beta.12: Unknown or invalid refresh token thrown from middleware #1851 and Refresh token error when calling getAccessToken in v4 beta #1841)
• feat: add idToken to beforeSessionSaved hook (closes: Can't get ididToken on v4 version #1840)
• fix: ensure builds succeed without AUTH0_DOMAIN set (closes: 4.0.0-beta.12 throws a startsWith error when AUTH0_DOMAIN not set #1849)
• chore: allow specifying client assertion config via env vars

v4.0.0-beta.12 (2024-12-18)

Fixed

• chore: add note about RP-Initiated logout
• chore: warn instead of throwing error when using insecure requests flag in prod (closes: Breaking change with local testing using V4 plugin #1846)
• chore: remove warning for prod env with non-https (closes: v4 "The application's base URL is not set to HTTPS" warning is annoying in localhost #1847)

v4.0.0-beta.11 (2024-12-17)

• feat: introduce updateSession helper (closes: v4.0.0-beta.9 updateSession support #1836)
• feat: private_key_jwt authentication method
• fix: peerDependencies for React 19 (closes: v4.0.0-beta.10 next 15.1 react 19.0.0 npm install unable to resolve dependency tree #1844)
• chore: allowInsecureRequests for mock OIDC server during development (closes: Breaking change with local testing using V4 plugin #1846)

v4.0.0-beta.10 (2024-12-10)

Fixed

• chore: add more description in error log on discovery errors (closes: @auth0/nextjs-auth0 4.0.0-beta.8 next15.0.3 not working on vercel cloud #1832)
• chore: migration guide
• chore: include typeVersions for type resolution (fixes: Typescript support for moduleResolution: node #1816)
• fix: only dist files should be published (fixes: 4.0.0-beta.7 breaks grype scanning #1825)
• feat: add PAR support
• feat: allow customizing auth routes (closes: 4.0.0-beta.9 next15.0.3 callback URL: basePath not supported #1834)
• chore: set secure cookie attribute based on app base URL protocol (closes: v4.0.7-beta.7 "InvalidStateError: The state parameter is invalid" in callback #1821)

v4.0.0-beta.9 (2024-12-03)

Fixed

• fix: clear session before redirecting to /v2/logout (closes v4 beta 8 - Logging out does not delete session #1826)
• feature: add Auth0Provider to pass initialUser (closes: v4 - ability to pass user directly to client from server #1823)
• fix: getAccessToken types should not return null (closes: v4 beta 8 "getAccessToken" is typed to possibly return null #1831)

v4.0.0-beta.8 (2024-11-25)

Fixed

• Fixes documentation for allowed logout URL
• Falls back to /v2/logout endpoint when the end_session_endpoint is not enabled for a tenant
• Adds docs about default claims from ID token populated in the user object
• Prevent revalidation when user is not authenticated in useUser() hook
• Fix error handling in useUser() hook (closes v4.0.0-beta.7 - when /profile request returns 401 (Unauthhorized) should be handle somehow #1817)
• Export types under /types sub-module (closes v4 beta 7 user type is not exported #1824 and v4.0.0-beta.7 - Cannot export the User type #1810)
• Exports errors under /errors sub-module
• getAccessToken() method throws an error when an access token could not be obtained to allow handling by the caller (closes v4.0.0-beta.7(getAccessToken) - when occured error while trying to refresh the access token should not provide expired one #1820 and v4 not exporting AccessTokenError #1819)
• Add warning when cookie size exceeds 4096 bytes

v4.0.0-beta.7 (2024-11-19)

Fixed

• Updated README.md
• Bumped up the version

v4.0.0-beta.5 (2024-11-19)

Fixed

• Bumping up the version

v4.0.0-beta.4 (2024-11-19)

Fixed

• Adds e2e tests.
• Removes error on env vars when undefined during build.

v4.0.0-beta.3 (2024-11-14)

Fixed

• Bug fixes
• Addressing the following customer issues.
  • V4 set returnTo or post_logout_redirect_uri during logout #1797
  • V4 Nextjs 15 pages router "Failed to load external module" on any import #1795
  • After upgrading auth0 library to 4.0, middleware is breaking #1794

v4.0.0-beta.2 (2024-11-11)

• The previous NPM publish missed including the build files. We are now bumping the version and releasing an updated version with the latest build.

v4.0.0-beta.1 (2024-11-11)

Fixed

• ESM imports for Pages router

v4.0.0-beta.0 (2024-11-05)

• Expands unit test coverage
• Implements Back-Channel Logout
• Adds sample with shadcn
• Refer README.md for more details.

v4.0.0-alpha.0 (2024-10-23)

• This is an experimental alpha release, and we encourage users to test it thoroughly in their development environments before upgrading in production.
• Review the breaking changes carefully to ensure a smooth transition.
• Refer README.md for more details.