[dependabot]

Bumps the github-actions group with 2 updates: fells-code/seamless-cli/.github/workflows/verify-conformance.yml and astral-sh/setup-uv.

Updates fells-code/seamless-cli/.github/workflows/verify-conformance.yml from 0.26.0 to 0.27.2

Release notes

Sourced from fells-code/seamless-cli/.github/workflows/verify-conformance.yml's releases.

v0.27.2

Patch Changes

• 3890db9: The adapter conformance suite now sends x-seamless-auth-transport: cookie on its cookie-transport requests, as @seamless-auth/client does, so body-less POST and DELETEfells-code/seamless-auth-api#558403 cross_site_request_blocked and leaves the session alone, and a body-less form-encoded POST /auth/recovery-codes without the transport header answers 415 unsupported_media_type. The 415 case is a pending contract: it is skipped unless SEAMLESS_VERIFY_CONTRACTS=content-type-gate (or all) is set, so an adapter that has not released the gate yet keeps passing. verify/CONFORMANCE.md lists pending contracts. The conformance grid no longer counts a skipped case as a failure.

  Requests that ask for external delivery (x-seamless-auth-delivery-mode: external) now carry a service token with the seamless-auth-external-deliveryfells-code/seamless-auth-api#556

• ba479f2: Depend on @seamless-auth/types ^0.35.0, which adds the OpenID Provider session binding contract.

v0.27.1

Patch Changes

• 3c94d99: seamless init scaffolds templates v0.21.2, whose API and full-stack starters declare the v0.21 server adapters: @seamless-auth/express 0.23, @seamless-auth/fastify 0.14, @seamless-auth/nextjs 0.7, and seamless-auth 0.4 for Go, Rust and Python.

v0.27.0

Minor Changes

• 0413554: seamless clients shows whether an application requires PKCE and the nonce, and create and update accept --pkce/--no-pkce and --nonce/--no-nonce. Only a confidential client can turn PKCE off, and the nonce can be turned off only once PKCE is off. An application with both off relies only on state and client authentication against authorization code injection, so list, get, create and update warn about it. Pins @seamless-auth/types 0.34.0.

• d6304a1: Set hosted page branding from the CLI (#320). seamless config hosted-ui get|set|reset (alias branding) reads the instance's hosted_ui system config, merges the fields you pass (--app-name, --logo, --font-family, and the six color flags) into the current branding, validates the result with HostedUiSchema from @seamless-auth/types, and writes the whole object back, since the instance replaces it rather than merging. reset removes named fields or, after a confirmation (--force to skip), clears all branding. hosted_ui is also writable as a whole value with config set hosted_ui '<json>' or config set hosted_ui null. The logo must be an https URL where the image is hosted: the instance does not store uploaded files, so a local path is refused with that message. Needs auth server v0.21 or later; an older instance reports that it does not support branding. Bumps @seamless-auth/types to 0.34.0 and lists the four new OpenID Provider keys as not yet writable (#332).

• 8aea8aa: seamless migrate assess <csv|entra-id|auth0|cognito> [source args] [--report <path>] [--json] writes a readiness report from the source alone, with no Seamless Auth instance and no login. It reuses each source's parsing and validation and reports users found, how many would import and why the rest would not (including duplicate emails), contact coverage (verified email, phone only, neither), the roles and organization memberships that would be granted and the fields left behind, source features Seamless Auth does not cover (such as Auth0 enterprise connections or Cognito SAML providers, plus what an export cannot show, such as Cognito identity pools) with a link to the matching guide, and a link to the docs cost calculator with the user count filled in. The Markdown report holds counts and names of fields, roles and organizations, never a user's email, phone or id. --json prints the same assessment.

• 6b8105e: seamless migrate auth0 <export.ndjson> and seamless migrate cognito <list-users.json>... read an Auth0 user export and Amazon Cognito list-users output directly, so the migration guides no longer need a jq conversion to CSV. Both share the dry run, --apply, --report and --json of migrate csv, and read files only (no AWS or Auth0 SDK or credentials).

  • Auth0: user_id becomes the external id, with email and phone_number. A gzip-compressed export is read as downloaded. Roles and organizations come from app_metadata or user_metadata only through --map.
  • Cognito: the sub attribute becomes the external id, with email and phone_number. --groups turns the guide's username-to-groups map into roles (ignoring Cognito's per-provider groups), and --map can read an attribute such as custom:tenant into organizations. One response, the Users array, an array of responses, concatenated responses, and several chunk files are all accepted.

  Blocked or disabled users, users whose email the source marks unverified (--allow-unverified imports them) and unconfirmed Cognito sign-ups (--include-unconfirmed) are skipped and listed in the report. Users with no email, including phone-only users, are reported invalid. Unlike the guides' earlier jq recipes, unverified emails are no longer imported by default.

• 471b05a: Configure an OAuth provider from its issuer. seamless config oauth-providers add and update take --issuer <url>, and a provider with an issuer can leave out authorizationUrl, tokenUrl, userInfoUrl, and jwksUri: the instance reads the missing ones from the issuer's /.well-known/openid-configuration. Without an issuer, add refuses before sending anything and names the missing endpoints. The new seamless config oauth-providers refresh <id> (alias discover) asks the instance to read the discovery document again and drop its cached signing keys, then prints the endpoints sign-in will use (--json for the provider object); like other provider writes it steps up when the instance asks. oauth-providers list shows a provider's issuer. Needs auth server v0.21 or later. Bumps @seamless-auth/types to 0.34.0, which also adds the oidc_account_notice_sent and oidc_account_notice_failed auth event types.

• 411691e: Add seamless clients and seamless resources for the OpenID Provider. clients lists, creates, updates and deletes OIDC clients, rotates a shared secret (printed once), registers a key file or JWKS URI, and sets which resources and scopes a client may use. Public clients, loopback and private-use redirect URIs, the device grant and token TTLs are flags, and redirect URIs and cross-field rules are checked with the @seamless-auth/types schemas before the instance is asked. resources manages the APIs clients may get tokens for and their scopes. Writes use the existing step-up flow. seamless apps still means managed applications in the portal. Needs an auth API with the /admin/applications and /admin/resources routes.

• 2e758a2: Write the OpenID Provider config keys (#332). oidc_provider_enabled, oidc_issuer, allow_client_secrets, and third_party_clients_enabled are now writable with seamless config set and config apply. config set checks their values before sending: the three switches take true or false, and oidc_issuer takes a URL, or null to clear it. seamless config --help documents them: the instance refuses to enable the provider until oidc_issuer is set, allow_client_secrets enables the weaker shared-secret client authentication (and seamless clients refuses shared-secret clients until it is on), and third-party clients need third_party_clients_enabled. Needs auth server v0.21.0 or later, whose strict patch schema is the first to accept these keys. Bumps @seamless-auth/types to 0.34.0.

Patch Changes

• 9ce5813: Pin source downloads to commits. --auth=local now checks that the cloned seamless-auth-api tag is the commit this CLI pins and removes the clone, before anything in it runs, when it is not. --admin=source downloads the dashboard by its pinned commit and checks the archive's commit before unpacking. The auth server and dashboard images are referenced by digest as well as tag, and npm run check:pins checks every pin against its tag.
• ff1736c: seamless init scaffolds auth API v0.21.0 and admin dashboard v0.12.0, pinned to the commits and image digests their tags name.
• 877e90a: seamless init --auth=local and --auth=docker (and seamless add --local) now write a generated JWKS_KID such as local-3f9a0c1b2d4e instead of dev-main, so the scaffolded adapter no longer warns on every boot that its kid is a placeholder. Re-running init on an existing project keeps a kid it already wrote. The value is only the kid header on the service tokens the adapter signs with the service secret; nothing verifies against it.
• 0bbdb1d: Scaffold templates v0.21.1, whose production images run as non-root and listen on port 8080, matching the compose file the CLI now generates.
• 364bd55: Depend on @seamless-auth/types ^0.34.0, the stable release, instead of the 0.34.0 prerelease.
• babb5bd: Map the web container to port 8080. The seamless-templates web and Next.js images now run as non-root and listen on 8080 instead of 80 (seamless-templates#133), so the generated compose file publishes 127.0.0.1:5173:8080 and health-checks /health on 8080, and the verify harness serves every web, reference, and Next.js app on 8080 (the nginx ones from nginxinc/nginx-unprivileged, as the templates do). This needs a templates release that carries the change: a scaffold from the templates pinned before it would map a port its web image no longer listens on.

Changelog

Sourced from fells-code/seamless-cli/.github/workflows/verify-conformance.yml's changelog.

seamless-cli

0.27.2

Patch Changes

• 3890db9: The adapter conformance suite now sends x-seamless-auth-transport: cookie on its cookie-transport requests, as @seamless-auth/client does, so body-less POST and DELETEfells-code/seamless-auth-api#558403 cross_site_request_blocked and leaves the session alone, and a body-less form-encoded POST /auth/recovery-codes without the transport header answers 415 unsupported_media_type. The 415 case is a pending contract: it is skipped unless SEAMLESS_VERIFY_CONTRACTS=content-type-gate (or all) is set, so an adapter that has not released the gate yet keeps passing. verify/CONFORMANCE.md lists pending contracts. The conformance grid no longer counts a skipped case as a failure.

  Requests that ask for external delivery (x-seamless-auth-delivery-mode: external) now carry a service token with the seamless-auth-external-deliveryfells-code/seamless-auth-api#556

• ba479f2: Depend on @seamless-auth/types ^0.35.0, which adds the OpenID Provider session binding contract.

0.27.1

Patch Changes

• 3c94d99: seamless init scaffolds templates v0.21.2, whose API and full-stack starters declare the v0.21 server adapters: @seamless-auth/express 0.23, @seamless-auth/fastify 0.14, @seamless-auth/nextjs 0.7, and seamless-auth 0.4 for Go, Rust and Python.

0.27.0

Minor Changes

• 0413554: seamless clients shows whether an application requires PKCE and the nonce, and create and update accept --pkce/--no-pkce and --nonce/--no-nonce. Only a confidential client can turn PKCE off, and the nonce can be turned off only once PKCE is off. An application with both off relies only on state and client authentication against authorization code injection, so list, get, create and update warn about it. Pins @seamless-auth/types 0.34.0.

• d6304a1: Set hosted page branding from the CLI (#320). seamless config hosted-ui get|set|reset (alias branding) reads the instance's hosted_ui system config, merges the fields you pass (--app-name, --logo, --font-family, and the six color flags) into the current branding, validates the result with HostedUiSchema from @seamless-auth/types, and writes the whole object back, since the instance replaces it rather than merging. reset removes named fields or, after a confirmation (--force to skip), clears all branding. hosted_ui is also writable as a whole value with config set hosted_ui '<json>' or config set hosted_ui null. The logo must be an https URL where the image is hosted: the instance does not store uploaded files, so a local path is refused with that message. Needs auth server v0.21 or later; an older instance reports that it does not support branding. Bumps @seamless-auth/types to 0.34.0 and lists the four new OpenID Provider keys as not yet writable (#332).

• 8aea8aa: seamless migrate assess <csv|entra-id|auth0|cognito> [source args] [--report <path>] [--json] writes a readiness report from the source alone, with no Seamless Auth instance and no login. It reuses each source's parsing and validation and reports users found, how many would import and why the rest would not (including duplicate emails), contact coverage (verified email, phone only, neither), the roles and organization memberships that would be granted and the fields left behind, source features Seamless Auth does not cover (such as Auth0 enterprise connections or Cognito SAML providers, plus what an export cannot show, such as Cognito identity pools) with a link to the matching guide, and a link to the docs cost calculator with the user count filled in. The Markdown report holds counts and names of fields, roles and organizations, never a user's email, phone or id. --json prints the same assessment.

• 6b8105e: seamless migrate auth0 <export.ndjson> and seamless migrate cognito <list-users.json>... read an Auth0 user export and Amazon Cognito list-users output directly, so the migration guides no longer need a jq conversion to CSV. Both share the dry run, --apply, --report and --json of migrate csv, and read files only (no AWS or Auth0 SDK or credentials).

  • Auth0: user_id becomes the external id, with email and phone_number. A gzip-compressed export is read as downloaded. Roles and organizations come from app_metadata or user_metadata only through --map.
  • Cognito: the sub attribute becomes the external id, with email and phone_number. --groups turns the guide's username-to-groups map into roles (ignoring Cognito's per-provider groups), and --map can read an attribute such as custom:tenant into organizations. One response, the Users array, an array of responses, concatenated responses, and several chunk files are all accepted.

  Blocked or disabled users, users whose email the source marks unverified (--allow-unverified imports them) and unconfirmed Cognito sign-ups (--include-unconfirmed) are skipped and listed in the report. Users with no email, including phone-only users, are reported invalid. Unlike the guides' earlier jq recipes, unverified emails are no longer imported by default.

• 471b05a: Configure an OAuth provider from its issuer. seamless config oauth-providers add and update take --issuer <url>, and a provider with an issuer can leave out authorizationUrl, tokenUrl, userInfoUrl, and jwksUri: the instance reads the missing ones from the issuer's /.well-known/openid-configuration. Without an issuer, add refuses before sending anything and names the missing endpoints. The new seamless config oauth-providers refresh <id> (alias discover) asks the instance to read the discovery document again and drop its cached signing keys, then prints the endpoints sign-in will use (--json for the provider object); like other provider writes it steps up when the instance asks. oauth-providers list shows a provider's issuer. Needs auth server v0.21 or later. Bumps @seamless-auth/types to 0.34.0, which also adds the oidc_account_notice_sent and oidc_account_notice_failed auth event types.

• 411691e: Add seamless clients and seamless resources for the OpenID Provider. clients lists, creates, updates and deletes OIDC clients, rotates a shared secret (printed once), registers a key file or JWKS URI, and sets which resources and scopes a client may use. Public clients, loopback and private-use redirect URIs, the device grant and token TTLs are flags, and redirect URIs and cross-field rules are checked with the @seamless-auth/types schemas before the instance is asked. resources manages the APIs clients may get tokens for and their scopes. Writes use the existing step-up flow. seamless apps still means managed applications in the portal. Needs an auth API with the /admin/applications and /admin/resources routes.

• 2e758a2: Write the OpenID Provider config keys (#332). oidc_provider_enabled, oidc_issuer, allow_client_secrets, and third_party_clients_enabled are now writable with seamless config set and config apply. config set checks their values before sending: the three switches take true or false, and oidc_issuer takes a URL, or null to clear it. seamless config --help documents them: the instance refuses to enable the provider until oidc_issuer is set, allow_client_secrets enables the weaker shared-secret client authentication (and seamless clients refuses shared-secret clients until it is on), and third-party clients need third_party_clients_enabled. Needs auth server v0.21.0 or later, whose strict patch schema is the first to accept these keys. Bumps @seamless-auth/types to 0.34.0.

Patch Changes

• 9ce5813: Pin source downloads to commits. --auth=local now checks that the cloned seamless-auth-api tag is the commit this CLI pins and removes the clone, before anything in it runs, when it is not. --admin=source downloads the dashboard by its pinned commit and checks the archive's commit before unpacking. The auth server and dashboard images are referenced by digest as well as tag, and npm run check:pins checks every pin against its tag.
• ff1736c: seamless init scaffolds auth API v0.21.0 and admin dashboard v0.12.0, pinned to the commits and image digests their tags name.
• 877e90a: seamless init --auth=local and --auth=docker (and seamless add --local) now write a generated JWKS_KID such as local-3f9a0c1b2d4e instead of dev-main, so the scaffolded adapter no longer warns on every boot that its kid is a placeholder. Re-running init on an existing project keeps a kid it already wrote. The value is only the kid header on the service tokens the adapter signs with the service secret; nothing verifies against it.
• 0bbdb1d: Scaffold templates v0.21.1, whose production images run as non-root and listen on port 8080, matching the compose file the CLI now generates.
• 364bd55: Depend on @seamless-auth/types ^0.34.0, the stable release, instead of the 0.34.0 prerelease.
• babb5bd: Map the web container to port 8080. The seamless-templates web and Next.js images now run as non-root and listen on 8080 instead of 80 (seamless-templates#133), so the generated compose file publishes 127.0.0.1:5173:8080 and health-checks /health on 8080, and the verify harness serves every web, reference, and Next.js app on 8080 (the nginx ones from nginxinc/nginx-unprivileged, as the templates do). This needs a templates release that carries the change: a scaffold from the templates pinned before it would map a port its web image no longer listens on.

0.26.0

Minor Changes

• fells-code/seamless-auth-api#490403 step_up_required, the CLI asks for the code, verifies it with POST /totp/verify-mfa on the same session, and retries the write once. This covers config set, config apply, config oauth-providers add|update|remove, users delete, users prepare-device-replacement, the org and org members writes, and every batch of migrate. A wrong code can be re-entered up to three times; a lockout, a rate limit, and an account with no authenticator app enrolled each get their own message instead of the old "requires an admin role" one. Without a terminal, SEAMLESS_TOTP_CODE supplies the code for the first step-up of a run.

... (truncated)

Commits

• 28a363f chore: version packages (#348)
• a0bb363 ci: move to Changesets v3 for changesets/action v2 (#347)
• 3890db9 test(verify): send the cookie transport header and cover the request guards (...
• ba479f2 chore: depend on @​seamless-auth/types 0.35.0 (#346)
• 92a474d chore(deps): bump the github-actions group with 8 updates (#331)
• bf99b55 Merge pull request #342 from fells-code/changeset-release/main
• 1d806a1 chore: version packages
• a82890b Merge pull request #341 from fells-code/chore/templates-v0-21-2
• 3c94d99 chore: pin templates v0.21.2 for the v0.21 server adapters
• 57bfb31 Merge pull request #328 from fells-code/changeset-release/main
• Additional commits viewable in compare view

Updates astral-sh/setup-uv from 10.3.2 to 10.3.3

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.3.3 🌈 Use Astral mirror for version manifests with GitHub fallback

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable. (Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

• Use Astral mirror for version manifests with GitHub fallback @​eifinger (#1119)
• fix: allow whitespace in uv requirement specifiers @​soujasK (#1112)
• fix: resolve ~= specifiers with PEP 440 semantics @​soujasK (#1111)
• fix: only report a saved cache when saving succeeded @​soujasK (#1110)

🧰 Maintenance

• chore: update known checksums for 0.13.6 @github-actions[bot] (#1117)

📚 Documentation

• docs: use JSDoc for compatible release specifier comment @​eifinger (#1113)
• docs: update version references to v10.3.2 @github-actions[bot] (#1104)

Commits

• 68559e9 Use Astral mirror for version manifests with GitHub fallback (#1119)
• 0192b69 chore: update known checksums for 0.13.6 (#1117)
• 2f29784 docs: use JSDoc for compatible release specifier comment (#1113)
• 9c73321 fix: allow whitespace in uv requirement specifiers (#1112)
• 80fbe01 fix: resolve ~= specifiers with PEP 440 semantics (#1111)
• 36b7b57 fix: only report a saved cache when saving succeeded (#1110)
• 56618ca docs: update version references to v10.3.2 (#1104)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions