Stojan Dimitrovski

feat: allow limiting lifespan of low-aal sessions

2

Adds a new optional config `GOTRUE_SESSIONS_ALLOW_LOW_AAL` (duration) which when set will prevent the continued refreshing of a user session if the session has not been upgraded to the highest possible...

fix: adjust required claims in custom access token hook

1

`email` and `phone` should not be required as they are not used by Supabase Auth for anything meaningful. They also don't have to exist (but are probably set as `""`...

ci: create fast release tarball

1

To enable fast releases with internal Supabase tooling, a special tarball structure is needed. This is temporary until the internal tool is changed to support a more conventional tarball structure....

feat: do not send non-JWTs in `Authorization` header

1

In preparation for the introduction of new API keys, the client library should not pass non-JWT values in the `Authorization` header, as requests like this will definitely fail. Two backward...

docs: new api keys

3

To be released concurrently with early access rollout of new API keys.

How is this library built and released? Could you please move this to a GitHub Action that can be audited here publicly as well as published on NPM [with provenance](https://docs.npmjs.com/generating-provenance-statements)?...

Previously when attempting to use `getSession()` from insecure storage such as cookies in SSR on the server, a disruptive warning was logged. It's been a long while and most developers...