diff --git a/.changeset/add-smtp2go-email-connector.md b/.changeset/add-smtp2go-email-connector.md deleted file mode 100644 index 4f03460402a8..000000000000 --- a/.changeset/add-smtp2go-email-connector.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"@logto/connector-smtp2go-email": minor -"@logto/connector-kit": minor -"@logto/connector-mailjunky": patch ---- - -add SMTP2GO email connector for transactional auth emails via the SMTP2GO send API - -Export shared SMTP mailbox parsing and formatting utilities from `@logto/connector-kit`, and adopt them in the MailJunky connector diff --git a/.changeset/curly-bikes-travel.md b/.changeset/curly-bikes-travel.md deleted file mode 100644 index c4ec4cfa6fb5..000000000000 --- a/.changeset/curly-bikes-travel.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -"@logto/core": patch -"@logto/phrases": patch ---- - -map custom UI asset Azure Blob transport failures to retryable storage download errors diff --git a/.changeset/escape-saml-auto-submit-form.md b/.changeset/escape-saml-auto-submit-form.md deleted file mode 100644 index d5c9011910ce..000000000000 --- a/.changeset/escape-saml-auto-submit-form.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -"@logto/core": patch ---- - -escape HTML attribute values in the SAML IdP auto-submit form - -When Logto acts as a SAML IdP, the auto-submit form posted to the SP's ACS interpolated `SAMLResponse`, `RelayState` and the action URL into HTML attributes without escaping. If a value contained a double quote, the browser truncated the attribute at that quote. - -This broke SPs that send a JSON string as `RelayState`: the SP received only `{` instead of the full value, losing the post-login context. The values are now HTML-escaped, so quotes and other markup characters round-trip intact (this also closes a reflected-markup injection vector in the interstitial page). - -In addition, the form action URL is now restricted to the `http`/`https` schemes before rendering. Escaping the attribute value alone does not neutralize a scriptable scheme such as `javascript:`, which the browser would execute on submission, so such URLs are now rejected. diff --git a/.changeset/fix-console-username-update-401.md b/.changeset/fix-console-username-update-401.md deleted file mode 100644 index 0a4d1e1838e4..000000000000 --- a/.changeset/fix-console-username-update-401.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -"@logto/console": patch ---- - -fix Console username update returning 401 by redirecting to Account Center - -The Account API requires identity verification for username changes, which the -Console profile page does not implement. Redirect username editing to the -Account Center's `/account/username` page (same pattern as MFA) where the full -verification flow is already implemented. diff --git a/.changeset/fix-custom-css-flash.md b/.changeset/fix-custom-css-flash.md deleted file mode 100644 index 0aa7d1e5e963..000000000000 --- a/.changeset/fix-custom-css-flash.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -"@logto/core": patch ---- - -fix a flash of built-in styles on the hosted sign-in experience when custom CSS is configured - -Custom CSS was injected on the client via react-helmet, which mutates `` asynchronously after the page had already painted with the built-in styles. The server-rendered experience HTML now inlines the configured custom CSS into ``, so it is part of the cascade on the first paint. The `` sequence in custom CSS is escaped so it cannot terminate the style element early, and the SSR data embedded in the inline `