v2.19.2

Security

• fix: clear worker refresh tokens on logout (#1596) #1597 (parasol-aser)

v2.19.1

Fixed

• fix: prevent ghost cache entry during multi-audience refresh token (MRRT) lookup #1592 (yogeshchoudhary147)
• fix: prevent ghost cache entry when subset-matched token expires #1590 (yogeshchoudhary147)
• fix: throw GenericError from worker path in revokeRefreshToken #1589 (yogeshchoudhary147)

v2.19.0

Added

• feat: add refresh token revocation #1541 (yogeshchoudhary147)

v2.18.3

Added

• fix: validate fetchUrl against allowlisted domain in token worker #1569 (yogeshchoudhary147)
• ci: add verify-types job to prevent missing typings on publish #1576 (yogeshchoudhary147)

v2.18.2

Fixed

• fix(build): restore dist/typings/ in published package #1574 (yogeshchoudhary147)

v2.18.1

Added

• fix: validate postMessage origin in runPopup #1563 (yogeshchoudhary147)

v2.18.0

Added

• Feat/native to web sso support #1547 (nelsonmaia)

Fixed

• fix: eliminate modulo bias in createRandomString #1559 (yogeshchoudhary147)

v2.17.1

Changed

• build(deps): update @auth0/auth0-auth-js to version 1.5.0 #1554 (gyaneshgouraw-okta)

v2.17.0

Added

• feat: support MFA step-up authentication via popup in iframe-based silent auth flow #1540 (gyaneshgouraw-okta)

Fixed

• Fix misspelling of authenticate in createAuth0Client docstring #1537 (StephenP-Hung)

v2.16.0

Added

• feat: implement step-up authentication with interactive error handling and popup support #1531 (gyaneshgouraw-okta)
• Chore: Update TOC to reflect Custom Token Exchange section in EXAMPLES.md #1533 (cschetan77)