Epic: v0.19 the right choice today #385

Goal

Make what Seamless Auth already does trustworthy and findable, and fix what strangers trip on.

API 0.19.0 shipped on 2026-10-18 as the security release. The rest of this milestone ships as 0.19.x patch and minor releases, and the milestone closes when the criteria below are met.

Scope

Sizes: S under a day, M one to three days, L about a week. Must-have items gate the tag; stretch items ship in v0.19 if ready and do not block it.

1. Hygiene (first)

• chore(security): publish the two advisories fixed in 0.8.0 #428 Publish the two advisories fixed in 0.8.0 (P1, S)
• ci: fail when openapi.json drifts from the package version #395 openapi.json and adapter manifest version drift, regenerate on release (P1, S)
• fells-code/seamless-auth-docs#112 Make the docs repository public (P1, S)
• Published .d.ts files use extensionless relative imports, so NodeNext consumers get any types seamless-auth-server#214 NodeNext types (merged; ships with the server release PR)
• zod peer/dependency floor is lower than the declarations need seamless-auth-types#95 zod floor (merged; ships with the types release PR)
• seamless add: every repo's local stack shares the Compose project name 'seamless' seamless-cli#270, seamless add: rough edges found while documenting it seamless-cli#271 seamless add fixes (released in CLI 0.23.1)
• fix(nextjs): pass the organization OAuth provider retirement routes through seamless-auth-server#180 and Update AuthRoutes import for @seamless-auth/react 0.14 and add a Next.js template seamless-templates#93 were already done; closed

2. Security and safety fixes

• Two findings handled privately, fixed in 0.19.0 (fix(lockout): keep passkey sign-in out of lockout and enforce lockoutSeconds #448, fix(magic-link): issue one session per link, and confirm links opened on another device #449) and published as GHSA-66gq-4pwg-33jq and GHSA-9jg2-jjqq-3346
• fix(routes): fail closed when a response does not match its schema #429 Fail closed on a response schema mismatch (P1, S)
• fix(auth): verify aud on access tokens, require typ, and require exp on service tokens #430 Verify aud, require typ, require exp on service tokens (P1, S)
• fix(boot): refuse development mode settings outside localhost #431 Refuse development mode settings outside localhost (P1, S)
• feat(config): warn at boot when one secret serves several purposes #432 Warn when one secret serves several purposes (P1, S)
• fix(admin): refuse to remove or demote the last admin #433 Refuse to remove or demote the last admin (P1, S)
• fix: refuse to delete a user's last sign-in method #400 Refuse to delete a user's last sign-in method (P1, M, pulled in from v0.20)

3. Adopter fixes

• fix: the same-origin console build requests /config.js, which 404s seamless-auth-admin-dashboard#290 Console /config.js 404, then bump the dashboard ref in the API Dockerfile (P1, S)
• fix(client): don't follow cross-origin redirects with a bearer token seamless-auth-react#177 Bearer token on cross-origin redirects (P2, M)
• fix(react): make the web binding cookie transport only seamless-auth-react#178 Web binding cookie transport only (P2, S to M, breaking minor)
• fix(client): confirm the authorizedFetch origin check on React Native URL implementations seamless-auth-react#179 Verify the origin check on React Native URL implementations (P3, S)
• chore: move the templates to @seamless-auth/react 0.16 and react-native 0.3 seamless-templates#123 Templates on react 0.16 and react-native 0.3 (P1, S)

4. First-try quickstart (closes #334)

• feat(init): create the first admin without reading container logs seamless-cli#275 First admin without reading container logs (P1, M)
• test(conformance): cover CLI commands, bearer transport, the dashboard and types PRs seamless-cli#209 Conformance: CLI commands against a live API, import and enrollment specs (P2, M)
• feat(migrate): import users from Microsoft Entra ID seamless-cli#213 Import users from Microsoft Entra ID (P2, M)
• Make Seamless Auth legible to coding agents and AI answers #383 AI legibility: docs#103 and AGENTS.md links (P1, S)

5. Honest docs

• docs: correct the security posture and document per-instance limits #434 Correct the security posture and document per-instance limits (P1, M)
• docs: refresh SECURITY.md and document how to verify the container image #435 SECURITY.md and image verification (P1, S)
• fells-code/seamless-auth-docs#111 Security posture page and threat model (P1, M, after section 2)
• fells-code/seamless-auth-docs#116 Production self-hosting checklist (P1, M)
• docs: publish the license pledge and a governance document #394 License pledge and governance (P1, S)
• docs(fido): publish FIDO conformance self-validation results #396 Publish FIDO self-validation results (P1, S)

6. Choosing Seamless

• fells-code/seamless-auth-docs#107 Compare with Auth0, including Okta Customer Identity (P1, S)
• fells-code/seamless-auth-docs#108 Compare with Keycloak (P1, S to M)

7. Seamless Glance

• Epic: agent-ready Glance seamless-glance#100 Agent-ready Glance: headless JSON mode, structured findings, MCP server, read-only throughout (P1, kept in v0.19 on 2026-10-16; tracked in its own epic)

Stretch

• fells-code/seamless-auth-docs#109 Compare with Cognito and Firebase Auth (P2, M)
• fells-code/seamless-auth-docs#110 Identity cost calculator (P2, M)
• fells-code/seamless-auth-docs#117 RFC 9700 matrix for the inbound OAuth client (P2, S)
• ci: run the suite and the migration chain against real Postgres #436 Suite and migration chain on real Postgres (P2, M)

Moved out

• feat: deliver enrollment invites through adopter messaging seamless-auth-server#183 enrollment invites through adopter messaging: v0.22 (a feature, not a bug)
• chore(fido): interoperability testing and Functional Certification submission #397 FIDO interoperability and certification submission: v1.0
• feat(admin): require step-up for config, role and user deletion writes #437 step-up on admin config, role and deletion writes: v0.20
• fix(users): prepare-device-replacement needs step-up and identity proofing seamless-cli#245 device replacement from the CLI: v0.20 (fails with a clear pointer to the dashboard today)
• Types and dashboard conformance (test(conformance): run types and dashboard PRs through the conformance matrix seamless-cli#280), Action pinning and Scorecard (ci: pin Actions by SHA and add OpenSSF Scorecard #438), JWT consolidation (chore(deps): consolidate JWT handling on jose #439): v1.0

Release criteria

• No open P0 or P1 issue in the v0.19 milestone in any repo
• The two private findings fixed and their advisories published, with 0.19.0 as the patched version; the two 0.8.0 advisories published
• openapi.json and adapter-manifest.json match the package version, enforced in CI
• On a clean macOS machine and a clean Linux machine, seamless init to first admin signed in, first try, without reading logs
• Released: API 0.19.0 with the console built from the fixed dashboard tag, the server adapters with Rare 20s timeout under coverage, unrelated to the mock-state leaks in #190 #214, types with feat: add admin routes to manage OAuth providers at runtime #95, react with No enforceable phishing-resistant-only login mode, and magic link is on by default #177 and No authentication coverage report for assessment and insurance responses #178, the CLI with fix(api): correct metrics, provider concurrency and five other defects #275, and the templates on current SDKs. The docs compatibility matrix matches
• On the public docs site: the repository is public, the security posture page is accurate against 0.19.0, the production checklist and the license pledge are live, and the Auth0 and Keycloak comparisons are live with sources dated the day they were published
• FIDO self-validation results published
• GitHub release notes for each package and a docs announcement

Release notes outline

1. Security: two advisories fixed and two older fixed advisories disclosed; fail-closed response validation; development mode refused on public hosts; stricter token checks; a warning when secrets are shared
2. Never stranded: the last admin and a user's last sign-in method can no longer be removed
3. Easier first run: first admin without logs, templates on current SDKs, the console /config.js fix, NodeNext types
4. Honest documentation: public docs repository, security posture and threat model, production checklist, per-instance limits, image verification, FIDO self-validation results
5. Choosing Seamless: Auth0 and Keycloak comparisons with when not to use Seamless, the license pledge and governance
6. Breaking (minor under 0.x): the React web binding is cookie transport only; development mode settings refuse to boot outside localhost