This release focuses on safer, more reliable authentication, especially OAuth flows backed by Redis.

Highlights

• Separated short-lived OAuth exchange state from long-lived user sessions.
• Added a configurable 15-minute expiry for Redis-backed OAuth attempts.
• Atomically consume OAuth callbacks to prevent replay attacks.
• Replace stale provider attempts instead of accumulating obsolete state.
• Gracefully restart expired or missing OAuth flows.
• Prevent reuse of legacy embedded Gothic session data.
• Improve GitHub OAuth failures by returning users to login instead of showing HTTP 500 errors.
• Strengthen diagnostic redaction so tokens, cookies, authorization codes, and OAuth state never reach logs.
• Preserve inactive OAuth tombstones to ensure correct session-ID regeneration.

Testing

Authentication coverage was expanded across every services/auth package, including expiry, replay protection, session preservation, Redis lifecycle, boundary conditions, and secret redaction.

Combined authentication coverage: 99.7%.