Skip to main content

Changelog

4.0.0-beta.12 (2026-10-22)​

⚠ BREAKING CHANGES​

  • Webda/Mailer moved to @webda/mailer

Features​

  • @webda/templates and @webda/mailer, keep only mailer contracts in core (#58) (#984) (58e6ee6)
  • auth: add an SMS second factor with a pluggable SmsSender (#979) (05a9bf2), closes #61
  • auth: track MFA verification time and enforce step-up freshness (maxMfaAge) (#963) (86cda56)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.12
      • @webda/models bumped to 4.0.0-beta.12
      • @webda/utils bumped to 4.0.0-beta.11
      • @webda/workout bumped to 4.0.0-beta.6
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.12
      • @webda/content-mapper bumped to 4.0.0-beta.10
      • @webda/fs bumped to 4.0.0-beta.12
      • @webda/test bumped to 4.0.0-beta.8

4.0.0-beta.11 (2026-10-16)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.11
      • @webda/models bumped to 4.0.0-beta.11
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.11
      • @webda/fs bumped to 4.0.0-beta.11

4.0.0-beta.10 (2026-10-15)​

Features​

  • auth: add model-scoped MFA with typed behavior configuration (#888) (ee068e8)
  • auth: TLS client certificate (mTLS) authentication (#834) (#899) (5bf7996)
  • delegated OAuth 2.1 tokens with operation-level consent (#928) (44709d6)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.10
      • @webda/models bumped to 4.0.0-beta.10
      • @webda/utils bumped to 4.0.0-beta.10
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.10
      • @webda/content-mapper bumped to 4.0.0-beta.9
      • @webda/fs bumped to 4.0.0-beta.10

4.0.0-beta.9 (2026-10-14)​

Features​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.9
      • @webda/models bumped to 4.0.0-beta.9
      • @webda/utils bumped to 4.0.0-beta.9
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.9
      • @webda/content-mapper bumped to 4.0.0-beta.8
      • @webda/fs bumped to 4.0.0-beta.9

4.0.0-beta.8 (2026-10-12)​

Bug Fixes​

  • enable strict mode in ql, oci, fs and auth (#874) (dec29f6)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.8
      • @webda/models bumped to 4.0.0-beta.8
      • @webda/utils bumped to 4.0.0-beta.8
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.8
      • @webda/fs bumped to 4.0.0-beta.8
      • @webda/test bumped to 4.0.0-beta.7

4.0.0-beta.7 (2026-10-11)​

Features​

  • stable and documented configuration secret encryption (#837) (55fad94)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.7
      • @webda/models bumped to 4.0.0-beta.7
      • @webda/utils bumped to 4.0.0-beta.7
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.7
      • @webda/content-mapper bumped to 4.0.0-beta.7
      • @webda/fs bumped to 4.0.0-beta.7

4.0.0-beta.6 (2026-10-09)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.6
      • @webda/models bumped to 4.0.0-beta.6
      • @webda/utils bumped to 4.0.0-beta.6
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.6
      • @webda/content-mapper bumped to 4.0.0-beta.6
      • @webda/fs bumped to 4.0.0-beta.6
      • @webda/test bumped to 4.0.0-beta.6

4.0.0-beta.5 (2026-10-08)​

⚠ BREAKING CHANGES​

  • core: models defining canAct are now enforced on REST, gRPC and MCP operations; refused calls return 403. Query pages can be shorter than their LIMIT. OwnerModel ignores a client supplied _user. ResourceAcl.canAct signature changed to (context, action) and entries need a principal.

Bug Fixes​

  • auth: give the stub provider test helper a declarable type (4ee513c)
  • core: enforce model permissions on every transport, deny by default (#810) (24c1182)
  • packaging: point every package's repository at its monorepo folder (#812) (3717b73)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.5
      • @webda/models bumped to 4.0.0-beta.5
      • @webda/utils bumped to 4.0.0-beta.5
      • @webda/workout bumped to 4.0.0-beta.5
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.5
      • @webda/content-mapper bumped to 4.0.0-beta.5
      • @webda/fs bumped to 4.0.0-beta.5
      • @webda/test bumped to 4.0.0-beta.5

4.0.0-beta.4 (2026-10-08)​

⚠ BREAKING CHANGES​

  • google-auth: configure the provider as its own service next to Authentication (redirects.success/failure, authorized_uris); the referer whitelist, no_referer, exposeScope, project_id, the GoogleAuth.Tokens event and getLocalClient are removed.
  • auth: redesign authentication with @webda/auth (#800)

Features​

  • auth: redesign authentication with @webda/auth (#800) (74dc5df)
  • google-auth: port Google login onto @webda/auth with hardened OAuth flow (#804) (e4c4b57)

Bug Fixes​

  • unit test models relations (2d160f1)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.4
      • @webda/models bumped to 4.0.0-beta.4
      • @webda/utils bumped to 4.0.0-beta.4
    • devDependencies
      • @webda/compiler bumped to 4.0.0-beta.4
      • @webda/content-mapper bumped to 4.0.0-beta.4
      • @webda/fs bumped to 4.0.0-beta.4