Security

• Upgrade @auth0/auth0-spa-js to 1.22.6 #468 (ewanharris)

This patch release is identical to 1.12.0 but has been released to ensure tooling no longer detects a vulnerable version of jsonwebtoken being used by @auth0/auth0-spa-js.

Even though 1.22.5 of @auth0/auth0-spa-js was not vulnerable for the related CVE because of the fact that jsonwebtoken is a devDependency of @auth0/auth0-spa-js, we are cutting a release to ensure build tools no longer report our SDK's that use @auth0/auth0-spa-js as vulnerable to the mentioned CVE.

Description

Auth0-React v2 includes many significant changes compared to v1:

• Removal of polyfills from bundles
• Introduction of authorizationParams and logoutParams for properties sent to Auth0
• Removal of buildAuthorizeUrl and buildLogoutUrl
• Removal of redirectMethod on loginWithRedirect in favour of openUrl
• Removal of localOnly from logout
• Renaming of ignoreCache to cacheMode and introduction of cache-only
• Use application/x-www-form-urlencoded by default
• Do not fallback to refreshing tokens via iframe by default
• Changes to default scopes and removal of advancedOptions.defaultScope
• Removal of claimCheck on withAuthenticationRequired

As with any major version bump, v2 of Auth0-React contains a set of breaking changes. Please review the migration guide thoroughly to understand the changes required to migrate your application to v2.

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

Added

• SDK-3666 Support multiple providers #416 (ewanharris)

Added

• Enrich onRedirectCallback method with User object (#400) #401 (devjmetivier)

Fixed

• Correctly extend Error for OAuthError #367 (mjbcopland)

Fixed

• Make sure handleRedirectCallback is only called once in StrictMode React 18 #355 (adamjmcgrath)

Added

• Update React and other deps #350 (adamjmcgrath)

Fixed

• appState is an optional argument #341 (adamjmcgrath)

Added

• Update to [email protected] #319 (adamjmcgrath)
• Memoize context value in auth0-provider #318 (claycoleman)

Fixed

• Avoid potential multiple invocations of loginWithRedirect #311 (kweiberth)
• Add connection property to Auth0ProviderOptions #283 (stevehobbsdev)

Added

• Bump Auth0-SPA-JS to 1.18.0 #279 (adamjmcgrath)

Added

• Bump SPA JS to 1.17.1 #270 (adamjmcgrath)