From 0fc9b730ddabe74798136053757ccfb581ffdebf Mon Sep 17 00:00:00 2001 From: Brandon Corbett Date: Mon, 12 Oct 2026 20:12:31 -0400 Subject: [PATCH] fix(init): pin seamless-templates v0.19.1 v0.19.1 moves the Express, Fastify and Next.js starters onto core 0.20.0, which fixes the cookie guard accepting the pre-auth cookie as a session. --- .changeset/pin-templates-0-19-1.md | 5 +++++ src/core/images.ts | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 .changeset/pin-templates-0-19-1.md diff --git a/.changeset/pin-templates-0-19-1.md b/.changeset/pin-templates-0-19-1.md new file mode 100644 index 0000000..bc3370d --- /dev/null +++ b/.changeset/pin-templates-0-19-1.md @@ -0,0 +1,5 @@ +--- +"seamless-cli": patch +--- + +Security: new projects scaffold the starters from `seamless-templates` `v0.19.1` (was `v0.19.0`). The Express, Fastify, and Next.js starters there depend on `@seamless-auth/express` `^0.20.0`, `@seamless-auth/fastify` `^0.11.1`, and `@seamless-auth/nextjs` `^0.4.0`, on `@seamless-auth/core` 0.20.0. Earlier starters resolved core 0.19.1, whose cookie guard accepted the pre-auth cookie `/login` issues from an email address alone as a signed-in session for that account (fixed in fells-code/seamless-auth-server#211). Projects scaffolded by an earlier CLI should move to those adapter versions. diff --git a/src/core/images.ts b/src/core/images.ts index 30de2a4..22daeb6 100644 --- a/src/core/images.ts +++ b/src/core/images.ts @@ -28,6 +28,6 @@ export const SEAMLESS_AUTH_ADMIN_DASHBOARD_REF = SEAMLESS_AUTH_ADMIN_DASHBOARD_V // point at a local checkout with SEAMLESS_TEMPLATES_DIR. export const SEAMLESS_TEMPLATES_REPO = "fells-code/seamless-templates"; -export const SEAMLESS_TEMPLATES_REF = "v0.19.0"; +export const SEAMLESS_TEMPLATES_REF = "v0.19.1"; -export const SEAMLESS_TEMPLATES_COMMIT = "350b9cbfb208b3e8341deada8f8759d0d64aae69"; +export const SEAMLESS_TEMPLATES_COMMIT = "89ebd0f6e21d3e95bf7304754db667910451c2ca";