Repository navigation
Epic: v0.19 the right choice today #385
Description
Goal
Make what Seamless Auth already does trustworthy and findable, and fix what strangers trip on.
API 0.19.0 shipped on 2026-10-18 as the security release. The rest of this milestone ships as 0.19.x patch and minor releases, and the milestone closes when the criteria below are met.
Scope
Sizes: S under a day, M one to three days, L about a week. Must-have items gate the tag; stretch items ship in v0.19 if ready and do not block it.
1. Hygiene (first)
- chore(security): publish the two advisories fixed in 0.8.0 #428 Publish the two advisories fixed in 0.8.0 (P1, S)
- ci: fail when openapi.json drifts from the package version #395 openapi.json and adapter manifest version drift, regenerate on release (P1, S)
- chore: make the docs repository public seamless-auth-docs#112 Make the docs repository public (P1, S)
- Published .d.ts files use extensionless relative imports, so NodeNext consumers get any types seamless-auth-server#214 NodeNext types (merged; ships with the server release PR)
- zod peer/dependency floor is lower than the declarations need seamless-auth-types#95 zod floor (merged; ships with the types release PR)
- seamless add: every repo's local stack shares the Compose project name 'seamless' seamless-cli#270, seamless add: rough edges found while documenting it seamless-cli#271
seamless addfixes (released in CLI 0.23.1) - fix(nextjs): pass the organization OAuth provider retirement routes through seamless-auth-server#180 and Update AuthRoutes import for @seamless-auth/react 0.14 and add a Next.js template seamless-templates#93 were already done; closed
2. Security and safety fixes
- Two findings handled privately, fixed in 0.19.0 (fix(lockout): keep passkey sign-in out of lockout and enforce lockoutSeconds #448, fix(magic-link): issue one session per link, and confirm links opened on another device #449) and published as GHSA-66gq-4pwg-33jq and GHSA-9jg2-jjqq-3346
- fix(routes): fail closed when a response does not match its schema #429 Fail closed on a response schema mismatch (P1, S)
- fix(auth): verify aud on access tokens, require typ, and require exp on service tokens #430 Verify
aud, requiretyp, requireexpon service tokens (P1, S) - fix(boot): refuse development mode settings outside localhost #431 Refuse development mode settings outside localhost (P1, S)
- feat(config): warn at boot when one secret serves several purposes #432 Warn when one secret serves several purposes (P1, S)
- fix(admin): refuse to remove or demote the last admin #433 Refuse to remove or demote the last admin (P1, S)
- fix: refuse to delete a user's last sign-in method #400 Refuse to delete a user's last sign-in method (P1, M, pulled in from v0.20)
3. Adopter fixes
- fix: the same-origin console build requests /config.js, which 404s seamless-auth-admin-dashboard#290 Console
/config.js404, then bump the dashboard ref in the API Dockerfile (P1, S) - fix(client): don't follow cross-origin redirects with a bearer token seamless-auth-react#177 Bearer token on cross-origin redirects (P2, M)
- fix(react): make the web binding cookie transport only seamless-auth-react#178 Web binding cookie transport only (P2, S to M, breaking minor)
- fix(client): confirm the authorizedFetch origin check on React Native URL implementations seamless-auth-react#179 Verify the origin check on React Native URL implementations (P3, S)
- chore: move the templates to @seamless-auth/react 0.16 and react-native 0.3 seamless-templates#123 Templates on react 0.16 and react-native 0.3 (P1, S)
4. First-try quickstart (closes #334)
- feat(init): create the first admin without reading container logs seamless-cli#275 First admin without reading container logs (P1, M)
- test(conformance): cover CLI commands, bearer transport, the dashboard and types PRs seamless-cli#209 Conformance: CLI commands against a live API, import and enrollment specs (P2, M)
- feat(migrate): import users from Microsoft Entra ID seamless-cli#213 Import users from Microsoft Entra ID (P2, M)
- Make Seamless Auth legible to coding agents and AI answers #383 AI legibility: docs#103 and AGENTS.md links (P1, S)
5. Honest docs
- docs: correct the security posture and document per-instance limits #434 Correct the security posture and document per-instance limits (P1, M)
- docs: refresh SECURITY.md and document how to verify the container image #435 SECURITY.md and image verification (P1, S)
- docs: security posture page and threat model seamless-auth-docs#111 Security posture page and threat model (P1, M, after section 2)
- docs: production self-hosting checklist seamless-auth-docs#116 Production self-hosting checklist (P1, M)
- docs: publish the license pledge and a governance document #394 License pledge and governance (P1, S)
- docs(fido): publish FIDO conformance self-validation results #396 Publish FIDO self-validation results (P1, S)
6. Choosing Seamless
- docs: compare Seamless Auth with Auth0 seamless-auth-docs#107 Compare with Auth0, including Okta Customer Identity (P1, S)
- docs: compare Seamless Auth with Keycloak seamless-auth-docs#108 Compare with Keycloak (P1, S to M)
Stretch
- docs: compare Seamless Auth with Cognito and Firebase Auth seamless-auth-docs#109 Compare with Cognito and Firebase Auth (P2, M)
- docs: identity cost calculator seamless-auth-docs#110 Identity cost calculator (P2, M)
- docs: RFC 9700 conformance matrix for the inbound OAuth client seamless-auth-docs#117 RFC 9700 matrix for the inbound OAuth client (P2, S)
- ci: run the suite and the migration chain against real Postgres #436 Suite and migration chain on real Postgres (P2, M)
Moved out
- Epic: agent-ready Glance seamless-glance#100 Agent-ready Glance and its children (docs: default LOGIN_METHODS to include email_otp for headless login #101 to chore: remove PR star-check workflow and star requirement #105): removed from v0.19 on 2026-10-21; Glance is outside the platform versions
- feat: deliver enrollment invites through adopter messaging seamless-auth-server#183 enrollment invites through adopter messaging: v0.22 (a feature, not a bug)
- chore(fido): interoperability testing and Functional Certification submission #397 FIDO interoperability and certification submission: v1.0
- feat(admin): require step-up for config, role and user deletion writes #437 step-up on admin config, role and deletion writes: v0.20
- fix(users): prepare-device-replacement needs step-up and identity proofing seamless-cli#245 device replacement from the CLI: v0.20 (fails with a clear pointer to the dashboard today)
- Types and dashboard conformance (test(conformance): run types and dashboard PRs through the conformance matrix seamless-cli#280), Action pinning and Scorecard (ci: pin Actions by SHA and add OpenSSF Scorecard #438), JWT consolidation (chore(deps): consolidate JWT handling on jose #439): v1.0
Release criteria
- No open P0 or P1 issue in the v0.19 milestone in any repo
- The two private findings fixed and their advisories published, with 0.19.0 as the patched version; the two 0.8.0 advisories published
openapi.jsonandadapter-manifest.jsonmatch the package version, enforced in CI- On a clean macOS machine and a clean Linux machine,
seamless initto first admin signed in, first try, without reading logs - Released: API 0.19.0 with the console built from the fixed dashboard tag, the server adapters with Rare 20s timeout under coverage, unrelated to the mock-state leaks in #190 #214, types with feat: add admin routes to manage OAuth providers at runtime #95, react with No enforceable phishing-resistant-only login mode, and magic link is on by default #177 and No authentication coverage report for assessment and insurance responses #178, the CLI with fix(api): correct metrics, provider concurrency and five other defects #275, and the templates on current SDKs. The docs compatibility matrix matches
- On the public docs site: the repository is public, the security posture page is accurate against 0.19.0, the production checklist and the license pledge are live, and the Auth0 and Keycloak comparisons are live with sources dated the day they were published
- FIDO self-validation results published
- GitHub release notes for each package and a docs announcement
Release notes outline
- Security: two advisories fixed and two older fixed advisories disclosed; fail-closed response validation; development mode refused on public hosts; stricter token checks; a warning when secrets are shared
- Never stranded: the last admin and a user's last sign-in method can no longer be removed
- Easier first run: first admin without logs, templates on current SDKs, the console
/config.jsfix, NodeNext types - Honest documentation: public docs repository, security posture and threat model, production checklist, per-instance limits, image verification, FIDO self-validation results
- Choosing Seamless: Auth0 and Keycloak comparisons with when not to use Seamless, the license pledge and governance
- Breaking (minor under 0.x): the React web binding is cookie transport only; development mode settings refuse to boot outside localhost
Activity
20 remaining items
Bccorb commentedon Oct 20, 2026
Phase 4: clean machine quickstart runs (2026-10-20)
The Self-Hosted Quickstart as written, with the published
seamless-cli0.24.0:npx seamless-cli init my-app --local --yes --email=...,docker compose up, then signing in as the first admin through the app's/authroutes (as the browser does), with the code fromseamless owner-code. Script and workflow: fells-code/seamless-cli#288.initdocker compose up(pull, build, start)/authubuntu-latest,ubuntu-24.04-arm), 4 CPUs, Node 22, Docker 28.0.4. No npm cache and no Docker images.seamless-auth-api:v0.19.1andpostgres:18were already cached, so their pull time is not included. GitHub's macOS runners cannot run Docker, so a fully clean macOS run needs a Mac without those images.admin:write, with no container logs read.api/and writesapi/logs/app.logas root. The user then cannot delete their own project withoutsudo. Tracked as a follow-up for the templates and CLI.The human steps (reading the output, opening the browser, typing the code) are not timed.
Bccorb commentedon Oct 21, 2026
Phase 7: release criteria, checked 2026-10-21
openapi.jsonandadapter-manifest.jsonmatch the package version, enforced in CItests/unit/openapi/generatedContract.spec.tsfails on drift, and the version step regenerates both.seamless initto first admin, first try, no logscheck:matrixclean once npm serves CLI 0.25.1).reference/release-v0-19in fells-code/seamless-auth-docs#132.Found and fixed during Phase 6 and 7
statewas not bound to the client that started the sign-in. Fixed as a plain patch by decision: API 0.19.2 (fix(oauth): bind the OAuth state to the client that started sign-in #465), types 0.29.0 (types#104), client 0.7.1 (react#203), dashboard 0.10.1 (dashboard#307, shipped in API 0.19.3 via fix(console): ship admin dashboard v0.10.1 #466), starters (templates#130), harness (cli#298).OAUTH_ALLOW_UNBOUND_STATEis a deprecated escape hatch removed in v0.20.Stretch
Bccorb commentedon Oct 21, 2026
v0.19 is complete. Release criteria and evidence are in the Phase 7 comment above; since then #396 is closed (FIDO self-validation results published at https://docs.seamlessauth.com/understand/fido-self-validation/, 159 passed, 0 failed), fells-code/seamless-auth-docs#112 is closed, and Glance moved out of the milestone. #155 stays open for #397 (v1.0). Open follow-ups: fells-code/seamless-auth-docs#128 and #130 await sign-off, fells-code/seamless-cli#213 awaits the live tenant check.