Skip to content

CHANGELOG.md

Latest commit

 

History

History
801 lines (561 loc) · 50.8 KB

CHANGELOG.md

File metadata and controls

801 lines (561 loc) · 50.8 KB
Raw

Change Log

7.50.0 (2026-11-10)

Full Changelog

Fixed

  • Add requested_token_type for On-Behalf-Of token exchange #1133 (Hawxy)

Security

7.49.0 (2026-08-19)

Full Changelog

Added

  • feat: Adds On-Behalf-Of (OBO) Token Exchange support - exchange an incoming user access token for a short-lived, audience-scoped token for a downstream API (OAuth 2.0 Token Exchange, RFC 8693), preserving user identity and actor attribution; GetCurrentActor() and GetDelegationChain() expose the act claim for authorization and audit #1094 (kailash-b)

Security

  • deps: Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt from 8.21.0 to 8.22.0 #1083 (dependabot[bot])
  • deps: Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt from 8.20.0 to 8.21.0 #1079 (dependabot[bot])

7.48.0 (2026-07-23)

Full Changelog

Added

  • feat: Adds Token Vault support - exchange an Auth0 token for an access token issued by a federated connection (Google, Facebook, etc.) to call that provider's APIs on the user's behalf #1064 (kailash-b)
  • feat: Adds Custom Token Exchange support - the OAuth 2.0 Token Exchange grant (RFC 8693), covering both access-token exchange and Session Transfer Token issuance #1057 (kailash-b)
  • feat: Adds Multi-Resource Refresh Token (MRRT) support - exchange a single refresh token for access tokens targeting different APIs and/or broader scopes, with the granted scope surfaced on the response #1056 (kailash-b)
  • feat: Phases out Newtonsoft.Json in favour of System.Text.Json across Auth0.Core and Auth0.AuthenticationApi (UserInfo.AdditionalClaims is now deprecated) #1046 (kailash-b)

Security

  • deps: Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt from 8.19.2 to 8.20.0 #1075 (dependabot[bot])
  • deps: Bump Microsoft.IdentityModel.Protocols.OpenIdConnect & System.IdentityModel.Tokens.Jwt from 8.19.1 to 8.19.2 #1070 (kailash-b)

7.47.0 (2026-06-26)

Full Changelog

Added

7.46.0 (2026-05-13)

Full Changelog

Added

  • Adds id token validation in CIBA flow #1003 (kailash-b)
  • Accepts expected nonce value from user for Id token validation #971 (kailash-b)

Security

  • Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt from 8.17.0 to 8.18.0 #1004 (kailash-b)
  • Bump actions/upload-pages-artifact from 4 to 5 #1004 (kailash-b)
  • Upgrade codecov-action to 6.0.0 and deploy-pages to 5.0 #977 (kailash-b)

7.45.1 (2026-03-26)

Full Changelog

Security

  • Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt to v8.17.0 #955 (kailash-b)

7.45.0 (2026-02-24)

Full Changelog

Fixed

  • Fix Base64Url encoding and harden authentication input validation #919 (kailash-b)

Security

  • Upgrade Microsoft.IdentityModel.Protocols.OpenIdConnect & System.IdentityModel.Tokens.Jwt to 8.16.0 #922 (kailash-b)

7.44.0 (2026-01-29)

Full Changelog

Added

  • feat(mgmt): Adds support to manage App Access configuration #904 (kailash-b)

7.43.1 (2026-01-15)

Full Changelog

Added

  • Updates ClientApplicationType Enum to include newly added app_types #901 (kailash-b)

7.43.0 (2025-12-05)

Full Changelog

Added

Fixed

  • Make OrganizationMember.Roles nullable #895 (g1n93r)

Security

7.42.0 (2025-10-09)

Full Changelog

Added

  • Adds support to manage Native to SSO configuration on clients #885 (kailash-b)

7.41.0 (2025-09-15)

Full Changelog

Added

  • Adds support for getting connections enabled for a specific client #877 (mikejr83 / kailash-b)
  • Adds CancellationToken parameter in IUsersClient.DeleteAsync #873 (kailash-b)

Fixed

Security

7.40.0 (2025-08-13)

Full Changelog

Added

  • Add support for DomainAliasesConfig in SelfService SSO create request #847 (kailash-b)

Deprecated

Fixed

  • fix: Use case-insensitive string comparer for HTTP header parsing #857 (mikejr83)

Security

  • deps: Bump Microsoft.IdentityModel.Protocols.OpenIdConnect and System.IdentityModel.Tokens.Jwt to 8.13.0 #846 (kailash-b)
  • deps: Upgrade dependencies #841 (kailash-b)

7.39.0 (2025-07-07)

Full Changelog

Added

  • feature: Add support for managing Network ACLs #828 (kailash-b)

Changed

  • fix: data-type from int to float for Branding related configs #824 (kailash-b)

Security

  • chore: Upgrade version of System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.Protocols.OpenIdConnect #825 (kailash-b)

7.38.0 (2025-06-23)

Full Changelog

Added

  • Add support for v2/jobs/get-errors API #819 (kailash-b)
  • Use Polysharp to take advantage of latest language features #813 (kailash-b)

Deprecated

  • Deprecate EnabledClients in Connections in favour of Get and Update EnabledClients #821 (kailash-b)

Fixed

7.37.0 (2025-05-30)

Full Changelog

Added

  • Allow monitoring Token Quota limits on every M2M authentication call #808 (kailash-b)
  • Add support for Delete authenticators registered to a user #810 (kailash-b)
  • Adds missing fields in Tenant Settings and Tenant flags #809 (kailash-b)
  • Adds support to update Token Quota at different levels #805 (kailash-b)

Changed

  • Change scope from string to dynamic in LogEntry #811 (kailash-b)

Fixed

7.36.0 (2025-04-10)

Full Changelog

Added

  • Adds support to Enroll / Verify / List / Challenge / Delete Multi Factor Authenticators #798 (czf / kailash-b)
  • Adds missing backchannel logout initiators #796 (dmarjoram)

Fixed

  • Fix for PasswordlessEmailRequest passing literal NULL when no client_secre… #800 (kailash-b)

7.35.0 (2025-03-24)

Full Changelog

Added

7.34.0 (2025-02-19)

Full Changelog

Added

  • Adding support for managing branding theme #784 (kailash-b)
  • Add support for managing Branding Phone Notification Templates #783 (kailash-b)
  • Add support for managing Branding Phone Provider settings #780 (kailash-b)

Fixed

7.33.0 (2025-02-05)

Full Changelog

Added

  • Adds support for managing SNS configuration - Push Notification - MFA policies #775 (kailash-b)
  • Update documentation to clarify LoginHint.Issuer field usage in CIBA context #773 (kailash-b)
  • Add support for /guardian end-points #771 (kailash-b)

Changed

  • Allow Optional AssignMembershipOnLogin field to be nullable #776 (kailash-b)

7.32.0 (2025-01-22)

Full Changelog

Added

Fixed

  • Added missing user ID field in Device Credentials class #768 (Mohsens22)
  • Added missing fields to LogEntry (#766) #767 (Mohsens22)

7.31.0 (2025-01-08)

Full Changelog

Added

7.30.0 (2024-11-28)

Full Changelog

Added

  • Adds support for managing custom-text and partial-prompts #749 (kailash-b)
  • Adds support for Self-Service-Profile endpoints #747 (kailash-b)
  • Support PhoneNumber as a flexible identifier #746 (kailash-b)

Changed

  • Adds Checkpoint Pagination support for fetching all connections #752 (kailash-b)

Note this change can cause compilation errors (ambiguous invocation) in cases where the code was calling GetAllAsync method in ConnectionsClient with only the first parameter. The users are recommended to choose the pagination explicitly after going through the recommendations in the documentation

7.29.0 (2024-11-08)

Full Changelog

Added

7.28.0 (2024-10-25)

Full Changelog

Added

7.27.0 (2024-09-30)

Full Changelog

Added

  • Add support for Managing SCIM configuration #726 (kailash-b)
  • Adds 'is_signup_enabled' for OrganisationConnection #724 (kailash-b)

Fixed

  • Fixes issue where SendInvitationEmail is not defaulting to True #728 (kailash-b)

7.26.2 (2024-04-03)

Full Changelog

Changed

7.26.1 (2024-01-11)

Full Changelog

Fixed

7.26.0 (2023-12-21)

Full Changelog

Changed

Note: This release drops support for .NET Framework 4.5.2, 4.6.0 and 4.6.1, which have no longer been supported by Microsoft since April 2022.

7.25.1 (2023-12-14)

Full Changelog

Added

7.25.0 (2023-11-28)

Full Changelog

Added

Fixed

7.24.0 (2023-11-08)

Full Changelog

Added

7.23.1 (2023-10-25)

Full Changelog

Changed

7.23.0 (2023-10-19)

Full Changelog

Added

Changed

7.22.3 (2023-08-29)

Full Changelog

Changed

7.22.2 (2023-08-14)

Full Changelog

Changed

7.22.1 (2023-07-28)

Full Changelog

Changed

Fixed

7.22.0 (2023-07-19)

Full Changelog

Added

7.21.1 (2023-07-03)

Full Changelog

Fixed

7.21.0 (2023-06-05)

Full Changelog

Added

  • Add support for Client Credentials endpoint support in Management API #607 (frederikprijck)
  • Added cancellation token to device credentials request #619 (msmolka)

7.20.0 (2023-05-16)

Full Changelog

Added

  • Added revoke refresh token endpoint support #617 (msmolka)

7.19.1 (2023-04-25)

Full Changelog

Changed

7.19.0 (2023-03-13)

Full Changelog

Added

7.18.0 (2023-01-18)

Full Changelog

Added

7.17.4 (2022-10-17)

Full Changelog

Changed

7.17.3 (2022-10-03)

Full Changelog

Changed

  • [SDK-3641] Support stage property in Breached Password Detection configuration #591 (ewanharris)

7.17.2 (2022-09-12)

Full Changelog

Changed

  • Support EnabledConnections in OrganizationCreateRequest #585 (ssurowiec)

7.17.1 (2022-09-12)

Full Changelog

Fixed

  • Moving IDisposable on to IManagementApiClient #581 (kevbite)

7.17.0 (2022-07-26)

Full Changelog

Added

7.16.1 (2022-07-12)

Full Changelog

Changed

  • Add display_name to ConnectionCreateRequest and ConnectionUpdateRequest #573 (rinkeb)

release-7.16.0 (2022-05-03)

Full Changelog

Changed

Security

  • [Snyk] Security upgrade Newtonsoft.Json from 12.0.3 to 13.0.1 #560 (crew-security)
  • [Snyk] Security upgrade Microsoft.IdentityModel.Protocols.OpenIdConnect from 5.6.0 to 6.5.0 #559 (snyk-bot)

release-7.15.0 (2022-03-04)

Full Changelog

Added

Changed

Note that with this release, ID Token validation has been added when retrieving a token using any of the Device Code or Passwordless flows. There might be a rare occasion where this could break your application, in the situation where you are using invalid ID Tokens. However, typically this should not cause any issues as ID Tokens are supposed to be valid. If they aren't, you probably want to get notified about it as soon as possible.

Prior to this change, those methods would return the tokens without checking the validaty of your ID Token. However, given the fact that this should realy be an edge case, and we believe it's a good idea to inform you about invalid tokens sooner rather than later, we decided to introduce this change in a minor release.

release-7.14.0 (2022-02-15)

Full Changelog

Added

release-7.13.0 (2022-02-11)

Full Changelog

Added

release-7.12.1 (2022-01-07)

Full Changelog

Changed

Fixed

release-7.12.0 (2021-10-27)

Full Changelog

Added

  • Support setting access token after instantiation of ManagementApiClient #532 (mfolker)
  • Add auth0-forwarded-for header to passwordless sms authentication for… #530 (rhyswilliamszip)

release-7.11.0 (2021-10-01)

Full Changelog

Added

Changed

release-7.10.0 (2021-08-30)

Full Changelog

Added

Fixed

release-7.9.0 (2021-08-24)

Full Changelog

Added

  • Add cancellation token support #513 (hawxy)
  • Implement automatic rate-limit handling #512 (frederikprijck)
  • Add connection property to OrganizationConnection #511 (frederikprijck)
  • Update pagination interface to support 'from' and 'take' checkpoint pagination parameters #507 (evansims)

Fixed

Note: In the situation where you are providing your own implementation for IManagementConnection or IAuthenticationConnection, upgrading to 7.9.0 will require changing your implementations to also include the optional CancellationToken parameters.

release-7.8.1 (2021-07-07)

Full Changelog

Fixed

release-7.8.0 (2021-04-02)

Full Changelog

Added

release-7.7.0 (2021-03-23)

Full Changelog

Added

release-7.6.1 (2021-03-12)

Full Changelog

Changed

release-7.6.0 (2021-02-15)

Full Changelog

Added

Changed

release-7.5.1 (2021-02-02)

Full Changelog

Changed

release-7.5.0 (2021-01-21)

Full Changelog

Added

release-7.4.0 (2020-12-11)

Full Changelog

Added

release-7.3.2 (2020-11-13)

Full Changelog

Added

  • Allow creating and updating RefreshToken settings for Clients #451 (SamTheWizard)

release-7.3.1 (2020-11-12)

Full Changelog

Fixed

release-7.3.0 (2020-10-23)

Full Changelog

Added

release-7.2.0

Full Changelog

  • Support passing the Identity property to the payload sent to JobsClient.SendVerificationEmailAsync and TicketClient.CreateEmailVerificationTicketAsync in Auth0.ManagementApi
  • Fix ConnectionsClient.GetAllAsync when trying to use multiple strategies in Auth0.ManagementApi
  • Add Sources to the User's Permissions when using UserClient.GetPermissionsAsync in Auth0.ManagementApi. The return type of the UserClient.GetPermissionsAsync method has been changed, so there might be use-cases where this is breaking your existing code base. In case you are inheriting the UserClient and overriding the GetPermissionsAsync method, you will need to update your code to ensure the return type matches the return type of the updated UserClient.GetPermissionsAsync method.

release-7.1.0

Full Changelog

  • Add support for Log Streams API in Auth0.ManagementApi

release-7.0.9

Full Changelog

  • Fix boolean casing on form post operations such as ImportUsersAsync so that upsert and sendCompletionEmail work.

release-7.0.8

Full Changelog

  • Add missing "connections" property on UserBlock class

release-7.0.7

Full Changelog

  • AuthenticationApiClient now respects path portions of the URI passed to the constructor.

release-7.0.6

Full Changelog

  • Force DateParseHandling of DateTime in JSON.NET serialization to avoid global setting.

release-7.0.5

Full Changelog

  • Use own JSON.NET serialization settings (avoids conflicts with changes to global)
  • Fix Jobs ImportUsersAsync function, add new SendVerificationEmail setting.
  • Add missing properties to Jobs class.
  • Add client_secret support to passwordless authentication.

release-7.0.4

Full Changelog

  • Ensure JWKS keys are cached for the correct period.
  • Raise RateLimitApiException on 429/TooManyRequests status code response.

release-7.0.3

Full Changelog

  • Fixed path encoding allowing ResourceServers.GetAsync to work with HTTP URLs #377
  • Add support for extra error properties to faciliate mfa_required etc. #376

release-7.0.2

Full Changelog

  • Fixed a concurrency issue - missing ConfigureAwait(false) in HttpClient*Connections.

release-7.0.1

Full Changelog

  • Fixes request message disposal issue in HttpClient*Connection.GetAsync on .NET Framework 4.x

release-7.0.0

Full Changelog

There are many breaking changes in this release. Please see our Migration Guide for v7 at https://auth0.github.io/auth0.net/migrating.html

The summary of changes is:

  • Authentication SDK includes new ID Token Validation. If your application uses HS256 signing you should set either SigningAlgorithm to SigningAlgorithm.HS256 on requests you make to AuthenticationApiClient or switch to RS256 if your application is not confidential.

  • Improved testing and mocking support. You can now mock IAuthenticationConnection / IManagementConnection classes to provide local unit-testing functionality for AuthenticationApiClient and ManagementApiClient respectively.

  • Many classes moved namespace and assembly primarily ones in Core that were around paging. Visual Studio should be able to suggest where classes you were using now reside.

  • Disposal is now consistent. If AuthenticationApiClient or ManagementApiClient create a connection for you they will manage its lifecycle. If you pass in a connection then it will be your responsibility to manage it. This also applies to how HttpClientAuthenticationConnection and HttpClientManagementConnection will only dispose of a HttpClient they create and not ones they are given.

  • Rate Limiting information is now only available on the RateLimitApiException which is raised when the rate limit is exceeded.

  • ApiException is now ErrorApiException. If you use the status code or error message on exception you will need to switch to catching the later. The former is now a base class that does not have this information but ensures any old catch ApiException will continue to catch rate limit exceptions which also now inherit from this class.

  • Microsoft recommends HttpClient is reused as much as possible. Therefore you should use dependency injection or inversion of control to ensure that either a single instance of AuthenticationApiClient / ManagementApiClient or its connections HttpClientXConnection are created to ensure sharing. These classes are now thread-safe. You can additionally share HttpClient objects between them if you wish by injecting it into the HttpClientXConnection constructor.

  • Connections now have DisplayName, Realms and IsDomainConnection properties.

release-6.5.6

Full Changelog

  • Fix sharing of ApiConnection objects (would keep expanding default Auth0-Client header)

release-6.5.5

Full Changelog

  • Signup API result now handles custom databases returning variations of "id" name
  • Fix EnrollmentAuthMethod.Authenticator enum name
  • ClientBase now has property for initiate_login_uri

release-6.5.4

Full Changelog

SECURITY FIX for CVE-2019-16929. See https://github.com/auth0/auth0.net/blob/master/SECURITY-NOTICE.md#idtokenvalidator-public for more details.

release-6.5.3

Full Changelog

WARNING: If you generate tokens in your project via System.IdentityModel.Tokens.Jwt please read the important notice at #300

  • Upgraded System.IdentityModel.Tokens.Jwt to 5.5 to fix incompatible kid
  • Upgraded Microsoft.IdentityModel.Protocols.OpenIdConnect to 5.5
  • Add ClientId to VerifyEmailJobRequest
  • Updated all test dependencies (xunit, FluentAssertions, .NET Test SDK)
  • Removed unused Console Workbench project

release-6.5.2

Full Changelog

  • UserClient.GetEnrollments now correctly passes user id.

release-6.5.1

Full Changelog

  • User and role permissions endpoints in UsersClient and RolesClient paging fix.

release-6.5.0

Full Changelog

  • Assembly is now strong-name-signed so it can be used by other strong-name-signed packages.
  • NOTE: This is code signing only using a non-secret key. It is not authenticode or tamper protection.
  • User and role permissions endpoints in UsersClient and RolesClient now correctly honoring paging.
  • User model optional fields (CreatedAt, UpdatedAt, LastLogin) are now nullable.

release-6.4.0

Full Changelog

  • TenantSettings lifetimes are now double not integer.
  • Added various Guardian-related endpoints on UserClient.

release-6.3.0

Full Changelog

  • Missing Tenant settings now available (device flow, Guardian MFA, Change Password, flags etc.

release-6.2.0

Full Changelog

  • Added client_id to GetDeviceCredentials response
  • Added various user properties to UserUpdateRequest

release-6.1.0

Full Changelog

  • New user permission endpoints added to UsersClient
  • New role permission endpoints added to RolesClient
  • AuthenticationApiClient now implements IDisposable to dispose ApiConnection and HttpClient
  • Added various new and missing properties to Resource Servers (ResourceServerBase)

release-6.0.0

Full Changelog

  • New GuardianClient for managing /guardian endpoints
  • New RolesClient for managing /roles endpoints
  • PasswordChangeTicket now has IncludeEmailInRedirect and MailEmailAsVerified
  • ApiConnection now has Dispose to dispose the HttpClient it creates
  • ManagementApiClient now has Dispose to dispose the ApiConnection it creates
  • XML documentation tweaks
  • Dependencies updated

BREAKING CHANGES See our migration guide at https://github.com/auth0/auth0.net/blob/master/docs-source/migrating-to-v6.md

  • All I*Client interfaces have been removed so adding endpoints is no longer breaking
  • IManagementApi interface was removed so adding new clients is no longer breaking
  • All non-paging GetAll methods have been removed
  • DiagnosticsHeader/DiagnosticsComponent are no longer available