Skip to main content

Changelog

4.0.0-rc.1 (2026-11-14)​

Features​

  • first release candidate of Webda 4.0, npm version badge in package READMEs (#1083) (0cf8a55)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-rc.1
      • @webda/models bumped to 4.0.0-rc.1
      • @webda/utils bumped to 4.0.0-rc.1
      • @webda/workout bumped to 4.0.0-rc.1
    • devDependencies
      • @webda/auth bumped to 4.0.0-rc.1
      • @webda/compiler bumped to 4.0.0-rc.1
      • @webda/content-mapper bumped to 4.0.0-rc.1
      • @webda/fs bumped to 4.0.0-rc.1
      • @webda/mcp bumped to 4.0.0-rc.1
      • @webda/test bumped to 4.0.0-rc.1

4.0.0-beta.14 (2026-11-10)​

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.14
      • @webda/models bumped to 4.0.0-beta.14
      • @webda/utils bumped to 4.0.0-beta.13
    • devDependencies
      • @webda/auth bumped to 4.0.0-beta.14
      • @webda/compiler bumped to 4.0.0-beta.14
      • @webda/fs bumped to 4.0.0-beta.14
      • @webda/mcp bumped to 4.0.0-beta.14

4.0.0-beta.13 (2026-11-04)​

Features​

  • azure: add Azure services, Container Apps and Functions deployers (#998) (6c7b1aa)
  • core: refuse to start when a @webda package is loaded twice (#965) (b67f2d4)
  • oauth,oidc: shared login across applications with remote resource-bound access tokens (#993) (2c9778a), closes #992
  • oauth: let one refresh-token family mint tokens for several resources (#1056) (9b0832b), closes #1049

Bug Fixes​

  • core: keep the session when refreshes race with the same token (#1053) (6fdb416), closes #1052
  • oauth: block MFA-pending sessions at authorize and preserve mfaAt across refresh (#1033) (b385f56)
  • security: address medium and low security review findings (AGY-018 to AGY-036) (#1050) (8de0715)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.13
      • @webda/models bumped to 4.0.0-beta.13
      • @webda/utils bumped to 4.0.0-beta.12
      • @webda/workout bumped to 4.0.0-beta.7
    • devDependencies
      • @webda/auth bumped to 4.0.0-beta.13
      • @webda/compiler bumped to 4.0.0-beta.13
      • @webda/content-mapper bumped to 4.0.0-beta.11
      • @webda/fs bumped to 4.0.0-beta.13
      • @webda/mcp bumped to 4.0.0-beta.13
      • @webda/test bumped to 4.0.0-beta.9

4.0.0-beta.12 (2026-10-22)​

Features​

  • end-to-end encrypted model fields (SealedField, UserKeys, @webda/sealed-client) (#941) (fbc5bd2)
  • mcp,oauth: dynamic client registration, resource-bound tokens and insufficient_scope (#901) (#988) (f75c854)

Bug Fixes​

  • content-mapper: list Events of an optional [WEBDA_EVENTS]? member under strict (#978) (c303962)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.12
      • @webda/models bumped to 4.0.0-beta.12
      • @webda/utils bumped to 4.0.0-beta.11
      • @webda/workout bumped to 4.0.0-beta.6
    • devDependencies
      • @webda/auth bumped to 4.0.0-beta.12
      • @webda/compiler bumped to 4.0.0-beta.12
      • @webda/content-mapper bumped to 4.0.0-beta.10
      • @webda/fs bumped to 4.0.0-beta.12
      • @webda/mcp bumped to 4.0.0-beta.12
      • @webda/test bumped to 4.0.0-beta.8

4.0.0-beta.11 (2026-10-16)​

Bug Fixes​

  • oauth: copy configured clients without structuredClone (#929) (e2e3301)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.11
      • @webda/models bumped to 4.0.0-beta.11
    • devDependencies
      • @webda/auth bumped to 4.0.0-beta.11
      • @webda/compiler bumped to 4.0.0-beta.11
      • @webda/fs bumped to 4.0.0-beta.11

4.0.0-beta.10 (2026-10-15)​

Features​

  • delegated OAuth 2.1 tokens with operation-level consent (#928) (44709d6)

Bug Fixes​

  • unit test models relations (2d160f1)

Dependencies​

  • The following workspace dependencies were updated
    • dependencies
      • @webda/core bumped to 4.0.0-beta.10
      • @webda/models bumped to 4.0.0-beta.10
      • @webda/utils bumped to 4.0.0-beta.10
    • devDependencies
      • @webda/auth bumped to 4.0.0-beta.10
      • @webda/compiler bumped to 4.0.0-beta.10
      • @webda/content-mapper bumped to 4.0.0-beta.9
      • @webda/fs bumped to 4.0.0-beta.10