All pull requests

Pull requests

• fix(api): bound post-commit notification emails by the request budget (#2888)

  #2897·melcheikh opened Nov 3, 2026Contributor·

  ·

• feat(oauthserver): support Client ID Metadata Documents

  #2895·melcheikh opened Oct 31, 2026Contributor·

  ·
  1

  1

• feat(oauthserver): bind access tokens to RFC 8707 resource indicators

  #2894·melcheikh opened Oct 30, 2026Contributor·

  ·
  1

• feat(saml): add dedicated_scope option for SAML providers

  #2893·hf opened Oct 30, 2026Contributor·

  ·
  1

• fix(crypto): keep multi-byte required characters intact in GeneratePassword

  #2891·Abhishek-B-R opened Oct 29, 2026·

  ·

• fix(mfa): consume the accepted TOTP time step so a code cannot be replayed

  #2890·Tyagiquamar opened Oct 28, 2026·

  ·
  1

  2

• fix(auth): hide whether an email address is registered when it is changed

  #2889·SLMassari opened Oct 26, 2026·

  ·
  2

• fix: add timeout and size limit to SAML metadata fetch

  #2885·Dextheking1 opened Oct 23, 2026·

  ·
  3

• fix: check tx.Reload error correctly in verifyGet

  #2880·AleksaMCode opened Oct 19, 2026·

  ·

• feat(saml): allow overriding the SP ACS URL and entity id

  #2875·Gugic opened Oct 15, 2026·

  ·
  2

• fix(mfa): allow TOTP enrollment for users without an email

  #2873·emiliosandoval4 opened Oct 14, 2026·

  ·
  1

• fix(oauthserver): accept loopback redirect URIs on any port

  #2871·just-some-random-pal opened Oct 13, 2026·

  ·
  1

  4

• fix(oauth-server): inherit approving session's AAL in OAuth tokens

  #2869·rudrakshsisodia opened Oct 13, 2026·

  ·
  1

  3

• feat: optional allow list check for loopback redirect URLs

  #2867·satishweb opened Oct 13, 2026·

  ·
  2

• docs: align admin OpenAPI contracts with server behavior

  #2866·haranishi opened Oct 11, 2026·

  ·
  1

  1

• fix(verify): preserve custom scheme in PKCE redirects

  #2865·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix(oauth): map refresh grant errors to RFC 6749 invalid_grant

  #2864·Tyagiquamar opened Oct 10, 2026·2 tasks done·

  ·
  1

• fix: require an aal2 access token to unenroll a verified MFA factor

  #2861·emfataliev opened Oct 8, 2026·

  ·
  2

• fix: drop unique constraint on mfa_factors.last_challenged_at

  #2860·yvlocorp opened Oct 7, 2026·

  ·
  1

• docs: rewrite the contributing guide as discussion-first and add an AI policy

  #2856·annabkr opened Oct 6, 2026Contributor·2/2·

  ·
  1

• docs: move the local setup guide from CONTRIBUTING.md to DEVELOPMENT.md

  #2855·annabkr opened Oct 6, 2026Contributor·1/2·

  ·

• fix(hooks): run pg-functions hooks in a transaction when the caller has none

  #2853·aerotech-vadb opened Oct 6, 2026·

  ·
  1

• fix(hooks): preserve identity unlink notification recipient

  #2851·ttulttul opened Oct 6, 2026·

  ·

• fix: report the new address when an email change is rejected as invalid

  #2848·vjymisal0 opened Oct 2, 2026·

  ·
  1

• fix(saml): don't report next key as configured when SAML is disabled

  #2846·claude[bot] opened Oct 1, 2026Bot·

  ·