v0.12.2

0.12.2 (2026-07-30)

Bug Fixes

• Preserve session on transient refresh failures (#79) (c920a46)

v0.12.1

0.12.1 (2026-06-23)

Bug Fixes

• cache JWKS instance across verifyAccessToken calls (#67) (fe77bbd)

v0.12.0

What's Changed

• chore: Pin third-party GitHub Actions to full commit SHAs by @devin-ai-integration[bot] in #71
• Add runtime feature flag support by @stanleyphu in #72

New Contributors

• @stanleyphu made their first contribution in #72

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• Add context7.json to repo by @nicknisi in #55
• feat: enable npm Trusted Publishers by @nicknisi in #56
• Remove deprecated Coana workflows by @gjtorikian in #66
• Implement PKCE and sealed OAuth state flow by @devin-ai-integration[bot] in #68
• v0.11.0 by @nicknisi in #70

New Contributors

• @gjtorikian made their first contribution in #66
• @devin-ai-integration[bot] made their first contribution in #68

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

• feat: Add organizationId to onSuccess callback by @nicknisi in #43
• feat: Add saveSession for manual auth flows by @chaance in #52
• fix: Unwrap nested data response from React Router by @DennisKraaijeveld in #44

New Contributors

• @chaance made their first contribution in #48
• @DennisKraaijeveld made their first contribution in #44
• @ryanvanoss made their first contribution in #42

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• Fix infinite redirects with load balancer TLS termination by @nicknisi in #39
• Add roles from JWT payload by @atainter in #40
• v0.9.0 by @atainter in #41

New Contributors

• @atainter made their first contribution in #40

Full Changelog: v0.8.1...v0.9.0

v0.8.1

What's Changed

• fix: use fresh user data when refreshing sessions by @nicknisi in #36

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• Fix: Preserve return pathname on session refresh failure by @nicknisi in #31
• fix: return null user when access token is expired in withAuth by @nicknisi in #32

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

This version implements security improvements to the authentication system.

Changes

• Modified the authentication data structure to improve security
• Added a new getAccessToken() function for explicit access to authentication data
• Updated documentation with security best practices

Breaking Changes

⚠️ This is a breaking change for applications that rely on access tokens being available in loader data.

See the updated README for migration instructions.

Full Changelog: v0.6.1...v0.7.0

v0.6.1

What's Changed

• Fix organization ID preservation during token refresh by @nicknisi in #27

Full Changelog: v0.6.0...v0.6.1