CHANGELOG.md

Change Log

v4.10.0 (2024-09-10)

Full Changelog

Added

• Prompt Partial model changes #1035 (tusharpandey13)
• Add organization support for client credentials to node-auth0 #1033 (tusharpandey13)

v4.9.0 (2024-08-26)

Full Changelog

Added

• Node SDK support for SS-SSO #1028 (tusharpandey13)
• Update Codecov Action with Token #1029 (developerkunal)

Changed

• Update codeowner file with new GitHub team name #1025 (stevenwong-okta)

v4.8.0 (2024-08-02)

Full Changelog

Added

• Added support for client, tenant and resource level properties related to HRI #1024 (gyaneshgouraw-okta)
• Added support for users getSessions & getRefreshTokens endpoint in management api client #1021 (gyaneshgouraw-okta)
• Added support for Session & Refresh token in management api client #1019 (gyaneshgouraw-okta)

v4.7.0 (2024-07-08)

Full Changelog

Added

• Support SCIM features. #1016 (nandan-bhat)

v4.6.0 (2024-06-20)

Full Changelog

Added

• Added enabled_clients in connection interface #1014 (gyaneshgouraw-okta)

Fixed

• Fixed bugs in the EXAMPLES.md's code snippets #994 (grjan7)

Security

• Bump braces from 3.0.2 to 3.0.3 #1010 (dependabot[bot])

v4.5.0 (2024-06-14)

Full Changelog

Changed

• Support signing up with organization membership. #1012 (nandan-bhat)

⚠️ BREAKING CHANGES

• Changes to ResourceServer interfaces (ResourceServerTokenDialectEnum, ResourceServerCreateTokenDialectEnum and ResourceServerUpdateTokenDialectEnum). #1012 (nandan-bhat)
  • The key token is changed to access_token.
  • The key token_authz is changed to access_token_authz.

v4.4.1 (2024-06-11)

Full Changelog

Fixed

• fix: Fixed undici-types error by updating the dependecy #1008 (gyaneshgouraw-okta)

v4.4.0 (2024-05-07)

Full Changelog

Added

• Added new values of token_dialect in management api generated section #1003 (gyaneshgouraw-okta)
• Added changes to support mTLS authentication #1002 (gyaneshgouraw-okta)
• Added additional request parameter to support PAR with JAR requests #995 (gyaneshgouraw-okta)
• Added new authorization_details parameter to support RAR requests #997 (gyaneshgouraw-okta)
• Bump jose from 4.14.4 to 4.15.5 #993 (dependabot[bot])

v4.3.1 (2024-02-09)

Full Changelog

Changed

• Add support for show_as_button on organization connections #988 (frederikprijck)

v4.3.0 (2024-01-31)

Full Changelog

Added

• Add support for prompt partials #985 (frederikprijck)

v4.2.0 (2023-12-07)

Full Changelog

Added

• Add support for Pushed Authorization Requests #973 (frederikprijck)

v4.1.0 (2023-10-30)

Full Changelog

Added

• [SDK-4646] Add MFA tenant setting and handle deprecations #960 (adamjmcgrath)

v4.0.2 (2023-10-25)

Full Changelog

Changed

• Export models that are using in the runtime #954 (frederikprijck)
• Type errorCode as possibly undefined #953 (frederikprijck)

v4.0.1 (2023-09-15)

Full Changelog

Fixed

• Ensure to pass-trough options to TokenProvider #938 (frederikprijck)

v4.0.0 (2023-09-14)

Full Changelog

This release brings a variety of exciting new features and improvements, including:

• Rewritten from the ground up in TypeScript
• Types for methods, request parameters, bodies, errors and responses
• Customisable modern networking stack

This release also drops support for Node <18. See the Migration Guide for more information.

v4.0.0-beta.10 (2023-09-12)

Full Changelog

Fixed

• [SDK-4548] Support optional responses #928 (adamjmcgrath)
• mark user_id as required for grants.deleteByUserId #930 (frederikprijck)
• add fields and include_fields to organization.getMembers #929 (frederikprijck)
• add pagination overloads to client.getAll() #931 (frederikprijck)

v3.7.1 (2023-09-11)

Full Changelog

Fixed

• fix: ManagementTokenProvider should also respect the keepAlive config option #927 (alaczi)

v4.0.0-beta.9 (2023-09-06)

Full Changelog

⚠️ BREAKING CHANGES

• Rename fetch option, add request examples #923 (adamjmcgrath)
• Change client id params to client_id #924 (adamjmcgrath)

Fixed

• Avoid optional properties on responses where possible #921 (frederikprijck)

v3.7.0 (2023-08-29)

Full Changelog

Added

• feat: add configuration for using persistent connections #919 (alaczi)

v3.6.1 (2023-08-22)

Full Changelog

Changed

• Support providing Organization when resetting password #892 (frederikprijck)

v4.0.0-beta.8 (2023-08-22)

Full Changelog

Fixed

• Update AttackProtection response and general types #911 (frederikprijck)
• Fix default condition should be the last one #915 (frederikprijck)
• Fix trigger_id types for actions #914 (frederikprijck)

v4.0.0-beta.7 (2023-08-16)

Full Changelog

⚠️ BREAKING CHANGES

• [SDK-4485] Use native fetch, drop Node 16 support #906 (adamjmcgrath)
• Do not expose a grant method #904 (frederikprijck)
• Only allow confidential clients #905 (frederikprijck)

Added

• Support providing Organization when resetting password #893 (frederikprijck)

Fixed

• Improve ESM and CJS support #902 (frederikprijck)

v4.0.0-beta.6 (2023-07-19)

Full Changelog

Changed

• Update managers #883 (frederikprijck)
• Handle duplicate user sign up #886 (frederikprijck)

Added

• Support Organization Name #885 (frederikprijck)
• Add support for userinfo endpoint #872 (frederikprijck)
• Support custom parameters with Authorization Code and Refresh Token Grants #889 (frederikprijck)

v3.6.0 (2023-07-18)

Full Changelog

Added

• Support Organization Name #884 (frederikprijck)

Changed

• Do not lowercase org_name claim #887 (frederikprijck)

v4.0.0-beta.5 (2023-06-28)

Full Changelog

Fixed

• Fix issue with TS rewriting fetch dynamic imports #878 (adamjmcgrath)

v4.0.0-beta.4 (2023-06-28)

Full Changelog

Added

• Upgrade to fetch 3 #876 (adamjmcgrath)

v3.5.0 (2023-06-26)

Full Changelog

Added

• Add option to pass x-request-language header for passwordless #873 (adamjmcgrath)

v4.0.0-beta.3 (2023-05-19)

Full Changelog

Fixed

• Fix void responses in Beta types #864 (adamjmcgrath)
• Fix: add missing endpoint and model properties #866 (frederikprijck)

v4.0.0-beta.2 (2023-05-18)

Full Changelog

Fixed

• Fix types exports #860 (adamjmcgrath)

v4.0.0-beta.1 (2023-05-15)

Full Changelog

• Rewritten from the ground up in TypeScript
• Full TypeScript coverage of methods, request paramters, bodies, errors and responses
• Customisable modern networking stack

v3.4.0 (2023-05-05)

Full Changelog

Added

• feat: allow to pass a method as token #793 (KillianHmyd)

Fixed

• Fix ESM #828 (adamjmcgrath)

v3.3.0 (2023-03-14)

Full Changelog

Added

• [SDK-4013] Add API2 Factor Management Endpoints #791 (adamjmcgrath)
• ESM support #784 (btakita)

v3.2.0 (2023-02-09)

Full Changelog

Added

• Add DELETE /api/v2/users/{id}/authenticators #785 (adamjmcgrath)

v3.1.2 (2023-01-25)

Full Changelog

Fixed

• Add support for proxy in AuthenticationClient #779 (frederikprijck)

v3.1.1 (2023-01-12)

Full Changelog

Fixed

• bump-jwks-rsa #776 (adamjmcgrath)

v3.1.0 (2023-01-12)

Full Changelog

Added

• [SDK-3868] Add support for managing client credentials #774 (adamjmcgrath)
• [SDK-3856] Add client_assertion to authenticate clients #761 (adamjmcgrath)

v3.0.1 (2022-12-22)

Full Changelog

Fixed

• bump jwks-rsa #769 (adamjmcgrath)

v3.0.0 (2022-12-22)

Full Changelog

⚠️ BREAKING CHANGES

• Update jsonwebtoken #766 (adamjmcgrath)

This release drops support for Node versions <14.

v2.44.1 (2022-12-09)

Full Changelog

Fixed

• Prevent calling the callback more than once #759 (snocorp)

v2.44.0 (2022-10-11)

Full Changelog

Added

• [SDK-3653] Add proxy support to Management Client #747 (adamjmcgrath)

v2.43.0 (2022-10-10)

Full Changelog

Added

• Add option to include response headers in the result #744 (adamjmcgrath)

v2.42.0 (2022-05-23)

Full Changelog

Added

• chore: add branding theme routes #725 (alejofernandez)

v2.41.0 (2022-05-20)

Full Changelog

Added

• Added ClientsManager.rotateClientSecret method #721 (sbmelvin)

v2.40.0 (2022-02-11)

Full Changelog

Added

• [CAUTH-1270]: feat(attack protection): add three features (bf, sipt, bpd) #705 (sdwvit)

v2.39.0 (2022-01-31)

Full Changelog

Added

• feat: update draft deploy #702 (TwelveNights)

v2.38.1 (2022-01-27)

Full Changelog

Fixed

• Fix wrong property in assignRolestoUser #700 (adamjmcgrath)
• signIn method should provide using audience prop in userData #699 (maxism)

v2.38.0 (2022-01-26)

Full Changelog

Changed

• refactor to es6 syntax with classes #665 (hornta)

Fixed

• [SDK-3030] Wrong url when doing assign users with a callback #686 (adamjmcgrath)

v2.37.0 (2021-10-14)

Full Changelog

Added

• Add support for checking connection status #662 (frederikprijck)

Fixed

• Fix undefined tokenProvider when access token is provided. #642 (Gilighost)

v2.36.2 (2021-09-20)

Full Changelog

Security

• [Snyk] Security upgrade rest-facade from 1.13.0 to 1.13.1 #653 (snyk-bot)
• [Snyk] Security upgrade axios from 0.21.1 to 0.21.3 #649 (snyk-bot)

v2.36.1 (2021-07-28)

Fixed

• Fix docs for rate limit default maxRetries #640 (jimmyjames)
• Fix updateCustomTextByLanguage #638 (davidpatrick)

Full Changelog

v2.36.0 (2021-07-23)

Added

• [SDK-2666] Update endpoint methods to document allowance of 'from' and 'take' checkpoint pagination parameters #634 (evansims)

Full Changelog

v2.35.1 (2021-06-21)

Fixed

• Update setUniversalLoginTemplate example to correctly reflect documentation #624 (mendhak)
• Use id instead of action_id as per the mgmt api. #622 (stevezau)

Full Changelog

v2.35.0 (2021-05-17)

Added

• Add method to verify OTP received via email #620 (alexesprit)
• [actionsManager] Adding new Actions Managment APIs #570 (shushen)

Full Changelog

v2.34.2 (2021-04-12)

Fixed

• [SDK-2484] Encode user ids on patch/update/delete #608 (davidpatrick)

Full Changelog

v2.34.1 (2021-04-01)

Fixed

• Small fix to ManagementTokenProvider Cache #604 (davidpatrick)

Security

• Bump y18n from 4.0.0 to 4.0.1 #602 (dependabot-preview)
• Security upgrade jwks-rsa from 1.10.0 to 1.12.1 #601 (snyk-bot)

v2.34.0 (2021-03-24)

Added

• feat(orgs): Support Organization feature #592 (mcastany)
• Org idtoken validation support #597 (davidpatrick)
• Allow passwordless SMS code verification to use token endpoint #591 (jimmyjames)

Changed

• Doc Updates #599 (davidpatrick)
• Update get role users docs #587 (jhiner)
• revokeRefreshToken method is missing in docs #584

Security

• [Security] Bump elliptic from 6.5.3 to 6.5.4 #589 (dependabot-preview[bot])

Full Changelog

v2.33.0 (2021-02-05)

Added

• feat: add revokeRefreshToken #579 (andreafspeziale)
• ULP-2609/ULP-2914: add page templates support to /branding #574 (sebadoom)

Full Changelog

v2.32.0 (2021-01-21)

Added

• Additional options on getByEmail [SDK-2268]#577 (davidpatrick)
• [SDK-2261] Add forwardFor support to passwordless calls #576 (frederikprijck)
• Adding Support for Guardian factor settings endpoints #569 (JayHelton)

Full Changelog

v2.31.1 (2021-01-05)

Fixed

• Expose getJobErrors to management client #563 (davidaubin19)
• Fix passing a custom User-Agent to Axios. #562 (djanowski)
• Expose assignUsersToRole to ManagementClient #561 (davidaubin19)

Security

• [Security] Bump axios from 0.19.2 to 0.21.1 #565 (dependabot-preview[bot])

Full Changelog

v2.31.0 (2020-12-08)

Added

• Updated documentation on Link Users #558 (davidpatrick)
• Add support for new passwordless endpoint #556 (nbandarchi)

Fixed

• Adds importUsersJob to ManagementClient #553 (mikemeerschaert)

Full Changelog

v2.30.0 (2020-10-22)

Added

• Provide headers on mgmt token fetch #543 (davidpatrick)

Changed

• [SDK-1975] Use exponential backoff rather than rate limit headers #538 (adamjmcgrath)

Fixed

• Bumps Rest-Facade Dependencies #542 (davidpatrick)
• Fix deprecation warning in importUserJobs #537 (JCQuintas)

Full Changelog

v2.29.0 (2020-09-23)

Added

• Adding support for prompts and custom texts #533 (davidpatrick)
• Adding call to invalidate all remembered browsers. #528 (tandrup)
• Adding docs for secondary and federated identity email verification #519 (jimmyjames)

Changed

• Update dependencies #535 (davidpatrick)
• Update jwks-rsa dependency to avoid DeprecationWarning Buffer() #534 (jalie)

Security

• [Security] Bump node-fetch from 2.6.0 to 2.6.1 #532 (dependabot-preview[bot])

Full Changelog

v2.28.0 (2020-08-27)

Added

• Added support for Log Streams #518 (cv711)

Removed

• Remove bluebird #520 (mattiasnixell)

Security

• [Security] Bump elliptic from 6.5.2 to 6.5.3 #521 (dependabot-preview[bot])

Full Changelog

v2.27.1 (2020-07-23)

Changed

• Use [REDACTED] instead of [SANITIZED] when cleaning errors #515 (jimmyjames)

Security

• Sanitize Headers on Errors #507 (jimmyjames)
• Bump lodash from 4.17.15 to 4.17.19 #506 (dependabot[bot])

Full Changelog

v2.27.0 (2020-06-30)

Added

• feat(migrations): adds migrations manager #503 (CriGoT)
• Added deleteUserByEmail to ConnectionsManager #502 (MatthewBacalakis)
• feat(guardian): support policies, selected-provider, message-types methods [MFA-310]#501 (pmalouin)

Fixed

• fix: management methods throwing error on access #500 (pmalouin)
• fix: guardian-related code examples #499 (pmalouin)

Full Changelog

v2.26.0 (2020-06-05)

Added

• JobsManager handling importUsers response payload #492 (davidpatrick)

Deprecated

• Deprecate importUsers in favor of importUsersJob #494 (davidpatrick)

Fixed

• Bump codecov - npm audit fix #495 (davidpatrick)

Security

• Fixes dependency vulnerabilities from webpack #498 (davidpatrick)

Full Changelog

v2.25.1 (2020-05-03)

Fixed

• Return response.data where Axios is used #484 (taylorbryant)

Full Changelog

v2.25.0 (2020-04-29)

Changed

• Deprecate Request lib #475 (davidpatrick)

Fixed

• Fix typos #480 (pgrimaud)
• Update getRulesConfigs docs to include callback #473 (akvamalin)

Security

• Dependency bump #481 (davidpatrick)
• [Security] Bump acorn from 6.2.1 to 6.4.1 #471 (dependabot-preview[bot])

Full Changelog

v2.24.0 (2020-03-06)

Fixed

• Update and fix JSDocs related to JobsManager #469 (orangain)
• Fixes test on supportedAlgorithms #466 (davidpatrick)
• Fixes calls on passwordless endpoints #465 (davidpatrick)

Full Changelog

v2.23.0 (2020-02-21)

Added

• [DXEX-455] Allow custom headers to be set in Management/Auth Clients. #460 (seejee)

Changed

• Updates node-jwks-rsa #461 (davidpatrick)

Fixed

• Update lru-memoizer dependency to avoid DeprecationWarning Buffer() #459 (jalie)
• getUsersInRole Docs #457 (davidpatrick)

Security

• [Security] Bump codecov from 3.5.0 to 3.6.5 #462 (dependabot-preview[bot])

Full Changelog

v2.22.0 (2020-01-24)

Added

• Support for Hooks API #440 (astanciu)

Full Changelog

v2.21.0 (2020-01-15)

Added

• Improved OIDC compliance #446 (davidpatrick)

Changed

• Add client secret to refreshToken and remove ID token validation #433 (joshcanhelp)

Security

• [Security] Bump handlebars from 4.1.2 to 4.5.3 #441 (dependabot-preview[bot])
• Update rest-facade dependency #436 (joshcanhelp)

Full Changelog

v2.20.0 (2019-09-17)

Added

• expose createEmailTemplate, getEmailTemplate, updateEmailTemplates vi… #416 (rameshanandakrishnan)

Security

• Sanitize Error Request Data #424 (davidpatrick)
• [Security] Bump mixin-deep from 1.3.1 to 1.3.2 #421 (dependabot-preview[bot])

Full Changelog

v2.18.1 (2019-08-08)

Added

• Implement auth0-forwarded-for header passing in Authentication Client #401 (kjarmicki)

Changed

• Improve JobManager (get errors + parse error message when importing users) #407 (jbauth0)

Full Changelog

v2.18.0 (2019-07-23)

Changed

• Encode id param on GET #374 (luisrudge)

Full Changelog

v2.18.0 (2019-06-26)

Full Changelog

Added

• Add Management API support for Branding and Prompts endpoints. #370 (chrisscott)

v2.17.1 (2019-05-22)

Full Changelog

Fixed

• Fix telemetry header #362 (lbalmaceda)

v2.17.0 (2019-04-15)

Full Changelog

Added

• Add method to assign users to a role #348 (pushpabrol)
• Add support for roles and permissions #344 (pushpabrol)

v2.16.0 (2019-03-18)

Full Changelog

Added

• Add support for Auth0 Grants #343 (jsmpereira)

v2.15.0 (2019-03-11)

Full Changelog

Added

• Add users-exports endpoint #340 (arjenvanderende)

Fixed

• Don't validate id_token when alg is HS256 and there is no clientSecret #330 (luisrudge)

v2.14.0 (2018-11-12)

Full Changelog

Added

• Add method to refresh a token using a refresh_token #313 (modeswitch)
• Add all Guardian APIs #311 (stevezau)
• Add Custom Domains methods #310 (stevezau)
• Add send_completion_email and upsert params for importUsers #270 (Floppy)

Deprecated

• Deprecate UsersManager.deleteAll and deleteAllUsers wrapper methods #309 (M-Zuber)

v2.13.0 (2018-09-28)

Full Changelog

Added

• Add id_token validation (HS256 and RS256) #295 (luisrudge)

v2.12.0 (2018-08-09)

Full Changelog

Added

• Added authorizationCodeGrant method to OAuthAuthenticator #290 (cwurtz)
• Add Guardian Enrollments endpoints #278 (fmedinac)

v2.11.0 (2018-07-25)

Full Changelog

Added

• Added Pagination Docs for a Client Grants, Resouce Servers and Rules #282 (cocojoe)
• Added rules config methods #227 (dctoon)

Fixed

• Get access token before importing users #267 (Floppy)

v2.10.0 (2018-05-29)

Full Changelog

Added

• Adding pagination docs for clients/connections #268 (luisrudge)

Fixed

• Fix deleteUserMultifactor naming #259 (luisrudge)

v2.9.3 (2018-03-01)

Full Changelog

Fixed

• Add client secret to passwordGrant #217 (luisrudge)

v2.9.2 (2018-01-16)

Full Changelog

Security

• Update rest facade #232 (luisrudge)

v2.9.1 (2017-12-08)

Full Changelog

Fixed

• fixed missing data object error #224 (dctoon)

v2.9.0 (2017-12-07)

Full Changelog

Added

• Added support for /users-by-email method. #218 (kopertop)
• Add retry functionality for management api requests #215 (dctoon)

v2.8.0 (2017-09-30)

Full Changelog

Added

• Added tokenProvider functionality #196 (dctoon)

Fixed

• Fix wrapPropertyMethod mistake for updateClientGrant #202 (danedmunds)

v2.7.1 (2017-09-30)

Full Changelog

Fixed

• Fix auth/users.getInfo to return JSON (fixes #158) #192 (pilwon)

Security

• Update request to address ReDoS vulnerability #206 (dancrumb)

v2.7.0 (2017-06-28)

Full Changelog

Added

• Add password grant method #189 (hzalaz)
• Retrieve a user's Guardian enrollments #181 (joshuaali)
• Add get user logs #176 (amiram)

Changed

• Update packages and utilize error classes from rest-facade correctly (Fixes #154) #183 (charsleysa)

Fixed

• Fix impersonation to send AT in the params. #190 (hzalaz)
• Fixed minor typo in DatabaseAuthenticator module #184 (scostello-paanalytics)
• fix: avoid possible prototype override protection bypass #170 (AlmaasAre)