prepare for release v0.8.0 - #247
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Coverage Report for CI Build 31802104088Coverage remained the same at 60.234%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
ePDS@0.8.0
Who should read this release
Minor Changes
#233
ebd214eThanks @aspiers! - Signing in and managing your account now run on the latest AT Protocol server, which requires operators to upgrade to Node.js 22.19 or newer.Affects: End users, Operators
End users: the account and sign-in screens now come from a newer version of the underlying AT Protocol software, which adds changing your handle and deactivating or deleting your account through the account-management interface. The passwordless email-code sign-in and email verification you already use through ePDS are unchanged.
Operators:
node:22-alpine.engines.nodeis now>=22.19.0(the floor is set by a transitiveundici@8runtime dependency, which fails on Node 22.0–22.18).@atproto/pds0.5.23,@atproto/oauth-provider0.21.1,@atproto/oauth-provider-ui0.8.9.better-sqlite3module must be built for the Node 22 ABI — a cleanpnpm installon Node 22 handles this; an in-place Node version switch needspnpm rebuild better-sqlite3.#231
fe3b15cThanks @aspiers! - Catch likely email-domain typos before sending a sign-in code.Affects: End users
End users: addresses one edit away from Gmail, Hotmail, Outlook, Yahoo, or iCloud now show a “Did you mean…?” prompt as soon as they are typed. Accepting replaces the address in the email field; dismissing keeps the original. The prompt never changes or blocks an address silently.
Patch Changes
#224
610b5e6Thanks @aspiers! - Sign-in, recovery and handle-choice feedback is now announced automatically by screen readers.Affects: End users
End users: authentication errors now use standard alert and live-region semantics across sign-in, recovery, handle selection, and the demo client, so screen-reader users hear failures without having to search the page for changed text. Repeated failures — such as entering a second incorrect one-time code — announce each time rather than falling silent, and handle availability ("Available!" / "Already taken.") is now announced as you type.
#223
0637fa7Thanks @aspiers! - Sign-in code boxes now ignore stray characters pasted or typed alongside your code.Affects: End users
End users: every screen that asks for a sign-in code — the main sign-in screen, Account Settings sign-in, and account recovery — now drops characters your code can't contain, so a code pasted with surrounding quotes, brackets, or a trailing full stop is accepted instead of rejected. The main sign-in screen previously ignored only spaces and line breaks. Where the operator has turned on codes that mix letters and numbers, typing them in lowercase now works too.
#220
68b2104Thanks @aspiers! - Asking for a new sign-in code now clears the boxes and tells you the old code has stopped working.Affects: End users
End users: the boxes reset on Send a new code, so a half-typed old code no longer has to be deleted by hand before you can type the new one. The confirmation also warns that only the newest code will be accepted, and points at the spam folder — the two things most likely to be going wrong for anyone who got that far.
#222
9e12e30Thanks @aspiers! - Sign-in and recovery email fields now work more reliably with browser autofill and password managers.Affects: End users
End users: email fields now identify themselves to browsers as email addresses, while the same sign-in field identifies itself as a username after switching to handle entry. This helps browsers and password managers offer the right saved value in each mode.
#229
6f4fa2dThanks @aspiers! - Sign-in pages no longer leak a malformed client_id as the displayed app name.Affects: End users
End users: if you arrived at a sign-in page with a broken
client_idparameter on the URL (e.g. from a misconfigured app or a tampered link), the page would display that raw broken value as the app's name, e.g. "Sign in to not-a-url" or "Sign in to my-local-app". The page now falls back to "an application" in that case, so a malformed value in the URL doesn't leak into the visible page text or browser tab title.#243
534647dThanks @aspiers! - The approval and account-chooser screens now honour the handle mode your app asked for, instead of falling back to the server default.Affects: Client app developers
Client app developers: no action needed —
epds_handle_modeis resolved exactly as before (the/oauth/authorizequery parameter, then your OAuth client metadata, then the server default). Previously the resolved mode was lost on the way to the approval step, so a flow that asked for a chosen handle could still show a generated one there. The mode is now carried through/oauth/epds-callbackand applied on the approval and chooser screens. Values that are not one of the recognised modes are ignored rather than forwarded.#227
68b0760Thanks @aspiers! - Handle-picker error wording is now accurate when the handle is reserved.Affects: End users
End users: if you tried to claim a handle that was on the reserved list (admin, www, …) the picker said "That handle was just taken — please choose another." That's misleading — it wasn't just taken, it's permanently unavailable. The wording is now "That handle is not available — please choose another." which doesn't imply you can wait it out.
#237
ddde1b2Thanks @aspiers! - Sign-in errors are written in plain English instead of showing the raw failure code.Affects: End users
End users: a rejected code used to report "Invalid OTP", an unexplained acronym that ran straight into the recovery link beside it — "Invalid OTP Send a new code". It now reads "That code didn't work." followed by the link, and the two other common failures are similarly rewritten: an aged-out code says "That code has expired.", and one rejected after repeated wrong attempts says "Too many tries — that code is no longer usable.". Any failure outside those three is still shown as-is rather than hidden behind a generic apology, so an unexpected problem can still be reported accurately.
#225
23dcd0fThanks @aspiers! - Sign-in buttons now show a visible keyboard focus ring.Affects: End users
End users: keyboard users tabbing through the sign-in pages couldn't tell where focus was — the buttons styled out the browser default focus ring without replacing it. Verify, Resend, Use different email, Recover, Send recovery code, Continue with email, Update handle, etc. all now show a clear outline when focused via the keyboard, while still hiding the ring on a mouse click.
#232
87ef832Thanks @aspiers! - Small grey text on the sign-in page is darker and easier to read.Affects: End users, Client app developers
End users: the 13px grey text — the terms line, the "Recover with backup email" link, the "or continue with" / "or use email" separators, and the "powered by Certified" footer — was too light to meet the WCAG AA contrast minimum against either the card or the page background behind it. It is now dark enough to pass on both.
Client app developers: the
--muted-foregroundcustom property on the sign-in page changes from[#999](https://github.com/hypercerts-org/ePDS/issues/999)to[#666](https://github.com/hypercerts-org/ePDS/issues/666). If yourbranding.csssets it, check your value clears 4.5:1 against both#F8F8F8(the card) and#E8E8E8(the page) — the old default reached only 2.68:1 and 2.33:1 respectively, so a value chosen to sit alongside it may be equally low. The separator text between the social and email sign-in options now follows--muted-foregroundtoo, where it previously ignored your override and stayed grey.#234
3924855Thanks @aspiers! - Apps you sign in to are now told that your email address is confirmed.Affects: End users, Client app developers, Operators
End users: Apps no longer ask you to verify an address you have already confirmed with an emailed code.
Client app developers: The
email_verifiedclaim is nowtruefor accounts that signed in through the emailed-code flow, instead of alwaysfalse.Operators: Deploy the auth service and the PDS together — the signed handover between them carries a new required field, and a mixed pair rejects sign-in until both are updated. An older auth service is rejected with an explicit
Missing or invalid email_verified parameterrather than a generic signature error, so a mixed-version rollout is recognisable in the logs. Accounts predating this release are repaired the next time their owner signs in through the emailed-code flow; a sign-in that does not prove control of the address leaves them unconfirmed. To fix the rest, see "Backfilling Email Confirmation" indocs/deployment.md.#41
d4256eaThanks @aspiers! - Both services now refuse to start unless their secret environment variables are set, instead of silently falling back to well-known development defaults.Affects: Operators
Operators:
AUTH_SESSION_SECRETandEPDS_CALLBACK_SECRETare now mandatory. Previously, a deployment that omitted them would boot successfully using hardcoded placeholders such asdev-session-secret-change-me, leaving session cookies and the signed/oauth/epds-callbackredirect verifiable by anyone who has read the source. The auth service and PDS Core now throw at startup with a message naming the missing variable and theopenssl rand -hex 32command to generate one. Check that both variables are set in your deployment before upgrading, and note thatEPDS_CALLBACK_SECRETmust be identical across the two services.AUTH_CSRF_SECREThas been removed entirely. CSRF protection derives its tokens fromcrypto.randomBytesand never consumed the value, so the variable was inert; it is no longer read, no longer generated byscripts/setup.sh, and can be deleted from your environment.#209
0af6d7fThanks @aspiers! - Resend webhook logs now identify the email event type and provider in their message text.Affects: Operators
Operators: Log messages use text such as
Received email event 'delivered' from Resend, making events legible in log viewers that de-emphasize structured fields.#236
e238c38Thanks @aspiers! - The sign-in button that emails you another code now says "Send a new code" instead of "Resend code".Affects: End users
End users: each request emails a genuinely new code and stops the previous one working, so "Resend" was misleading — it suggested the code already in your inbox was still the one to type. The confirmation after clicking now starts "Sent!" rather than "Resent!", and still tells you that earlier codes no longer work. The same wording appears on the recovery and account sign-in pages, and on the link offered beside a rejected or expired code.
#242
a0a819aThanks @aspiers! - The email sign-in button now waits until the page is ready before accepting clicks.Affects: End users
End users: tapping Continue before the sign-in page finished loading could start a broken sign-in attempt that silently did nothing. The button is now disabled until the page is ready. Browsers with JavaScript disabled see a message explaining that JavaScript is required to sign in with email, instead of a button that never responds.
#220
50c8620Thanks @aspiers! - Sign-in error messages now appear next to the field that caused them, instead of at the top of the page.Affects: End users
End users: a rejected sign-in code used to report the problem above the page heading, several elements away from the boxes you had just typed into — easy to miss, and it left the Verify button looking like the thing to press again. The message now sits directly between the code boxes and Verify, and a failed email submission likewise reads under the email field rather than above it.
A rejected code now also carries a Send a new code link beside the message. The standalone button below the form was easy to overlook, and "that code didn't work" often means there is no usable code left at all rather than that you mistyped it — after too many wrong attempts, after signing in from another tab, or once an old code has aged out. Retyping cannot recover any of those. The boxes still clear and refocus, so retyping remains one keystroke away when that is what you need.
#237
43baeb5Thanks @aspiers! - Clickable text on the sign-in screens now looks the same wherever it appears.Affects: End users, Client app developers
End users: the same action no longer renders differently depending on where it sits. "Resend code", "Use different email" and "Recover with backup email" are now all plain text that darkens when you point at it, while actions embedded in a sentence — "Send a new code" in an error message, and the Terms of Use and Privacy Policy links — stay underlined so they remain visible against the text around them. Pointing at an underlined action no longer makes its underline vanish, and every one of these actions now shows a focus outline when reached with the keyboard.
Client app developers:
--muted-foregroundnow also sets the colour of the.btn-secondaryactions on the sign-in page, which previously hardcoded#6b6b6b. If you override that custom property in yourbranding.css, it will now recolour "Resend code" and "Use different email" alongside "Recover with backup email" and the other muted text. Choose a value that clears 4.5:1 contrast against your card background.--recovery-link-displayis unchanged.#215
1a90062Thanks @aspiers! - "Use different email" on the sign-in code page now clears the email field.Affects: End users
End users: clicking Use different email on the code-entry page used to take you back to the email form with your previous address still filled in — exactly the opposite of what the button suggests, and forcing you to clear the field manually before you could type a new address. The form now starts empty, with the cursor in the field, so you can just type the new address and continue.