From 44bf55097af90c4c9dc240a8ea0d81923763a60e Mon Sep 17 00:00:00 2001 From: Gani Georgiev Date: Mon, 27 Apr 2026 09:30:32 +0300 Subject: [PATCH] updated changelogs --- CHANGELOG.md | 4 ++-- CHANGELOG_16_22.md | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index decfd3f2..ab638329 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,10 +10,10 @@ - Added `ghupdate.BaseURL` config option ([#7665](https://github.com/pocketbase/pocketbase/issues/7665)). -- Added dummy bcrypt password check for the failure auth path to minimize enumaration timing attacks when registrations are disabled. +- Added dummy bcrypt password check for the failure auth path to minimize enumeration timing attacks when registrations are disabled. - Adjusted Bitbucket, GitHub, GitLab and Gitea/Forgejo OAuth2 providers to better reflect recent API updates and doc references. - _In case the userinfo data is not sufficient, some of the providers now send a sepatate list emails request in order to minimize eventual linking security issues caused by custom onpremise setups (e.g. Gitea/Forgejo allows skipping the email verification if an ENV variable is configured)._ + _In case the userinfo data is not sufficient, some of the providers now send a separate list emails request in order to minimize eventual linking security issues caused by custom onpremise setups (e.g. Gitea/Forgejo allows skipping the email verification if an ENV variable is configured)._ - ⚠️ Fixed a pre-hijacking OAuth2 linking vulnerability ([#7662](https://github.com/pocketbase/pocketbase/discussions/7662); thanks @Alardiians for reporting it privately). diff --git a/CHANGELOG_16_22.md b/CHANGELOG_16_22.md index f771c0c4..c0dc562f 100644 --- a/CHANGELOG_16_22.md +++ b/CHANGELOG_16_22.md @@ -2,6 +2,14 @@ > For the most recent versions, please refer to [CHANGELOG.md](./CHANGELOG.md) --- +## v0.22.42 + +- (_Backported from v0.37.4_) Adjusted Bitbucket, GitHub, GitLab and Gitea/Forgejo OAuth2 providers to better reflect recent API updates and doc references. + _In case the userinfo data is not sufficient, some of the providers now send a separate list emails request in order to minimize eventual linking security issues caused by custom onpremise setups (e.g. Gitea/Forgejo allows skipping the email verification if an ENV variable is configured)._ + +- (_Backported from v0.37.4_) ⚠️ Fixed a pre-hijacking OAuth2 linking vulnerability ([#7662](https://github.com/pocketbase/pocketbase/discussions/7662)). + + ## v0.22.41 - (_Backported from v0.36.9_) Updated the Discord `AuthUser.Name` field to use `global_name`.