Back to milestones

v0.24

Open

No due date

•Last updated Nov 10, 2026

Security release and stabilization: fixes from the 2026-11-09 security review across the API, provider edge, adapters, SDKs and templates, adapter and SDK parity, and doc claims the code does not uphold.

0% complete

fix(csrf): require Origin to match Host without an allow-list and default to SameSite=Lax
fells-code/seamless-auth-server#283 · opened on Nov 10, 2026 · v0.24
1
fix(express,fastify): verify guard claims against JWKS instead of trusting the cookie payload
fells-code/seamless-auth-server#284 · opened on Nov 10, 2026 · v0.24
fix(core): handle concurrent refreshes across instances
fells-code/seamless-auth-server#285 · opened on Nov 10, 2026 · v0.24
1
ci(prerelease): gate npm prerelease publishing behind a protected environment
fells-code/seamless-auth-server#286 · opened on Nov 10, 2026 · v0.24
fix: low severity Node adapter hardening (review bundle 4)
fells-code/seamless-auth-server#287 · opened on Nov 10, 2026 · v0.24
fix: close Node adapter parity gaps with Go, Python and Rust
fells-code/seamless-auth-server#288 · opened on Nov 10, 2026 · v0.24
1