Changelog

4.0.0-beta.5 (2026-10-08)

⚠ BREAKING CHANGES

• core: models defining canAct are now enforced on REST, gRPC and MCP operations; refused calls return 403. Query pages can be shorter than their LIMIT. OwnerModel ignores a client supplied _user. ResourceAcl.canAct signature changed to (context, action) and entries need a principal.

Bug Fixes

• auth: give the stub provider test helper a declarable type (4ee513c)
• core: enforce model permissions on every transport, deny by default (#810) (24c1182)
• packaging: point every package's repository at its monorepo folder (#812) (3717b73)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @webda/core bumped to 4.0.0-beta.5
    • @webda/models bumped to 4.0.0-beta.5
    • @webda/utils bumped to 4.0.0-beta.5
    • @webda/workout bumped to 4.0.0-beta.5
  • devDependencies
    • @webda/compiler bumped to 4.0.0-beta.5
    • @webda/content-mapper bumped to 4.0.0-beta.5
    • @webda/fs bumped to 4.0.0-beta.5
    • @webda/test bumped to 4.0.0-beta.5

4.0.0-beta.4 (2026-10-08)

⚠ BREAKING CHANGES

• google-auth: configure the provider as its own service next to Authentication (redirects.success/failure, authorized_uris); the referer whitelist, no_referer, exposeScope, project_id, the GoogleAuth.Tokens event and getLocalClient are removed.
• auth: redesign authentication with @webda/auth (#800)

Features

• auth: redesign authentication with @webda/auth (#800) (74dc5df)
• google-auth: port Google login onto @webda/auth with hardened OAuth flow (#804) (e4c4b57)

Bug Fixes

• unit test models relations (2d160f1)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @webda/core bumped to 4.0.0-beta.4
    • @webda/models bumped to 4.0.0-beta.4
    • @webda/utils bumped to 4.0.0-beta.4
  • devDependencies
    • @webda/compiler bumped to 4.0.0-beta.4
    • @webda/content-mapper bumped to 4.0.0-beta.4
    • @webda/fs bumped to 4.0.0-beta.4