@auth/azure-tables-adapter@1.11.3 next-auth@4.24.15
ysharma3501/LuxTTSJul 20, 2026 → Jul 20, 20260 days between releases
What's New
next-auth 4.24.15 is a security patch: null-returning getToken(), provider-bound OAuth cookies, NFKC email checks.
Breaking Changes
- getToken() now returns null rather than throwing when the Authorization header holds a malformed Bearer value, so callers relying on the exception must handle null instead.
- OAuth state, nonce, and PKCE cookies are now scoped to the issuing provider, so sign-ins already in flight during the upgrade fail once and only succeed on retry.
- An explicitly set NEXTAUTH_URL now wins over the auto-detected forwarded host in trusted-host mode, which can change generated callback URLs behind proxies.
New Features
- CommonJS consumers can require() next-auth again now that uuid is pinned to ^11.1.1 instead of the ESM-only 14.x line.
Improvements
- OAuth state, nonce, and PKCE check cookies are bound to the provider that created them, blocking cross-provider callback attacks.
- Email addresses are NFKC-normalized before validation in the email sign-in flow, closing a homoglyph '@' bypass.
- uuid is pinned to ^11.1.1 so CommonJS builds keep working on Node versions below 20.19.
- Explicit NEXTAUTH_URL configuration is now authoritative over forwarded-host detection.
Bug Fixes
- getToken() no longer throws on malformed Bearer tokens in the Authorization header.
- require() breakage caused by the ESM-only uuid 14.x dependency is resolved.
- Unicode homoglyph email addresses can no longer slip past sign-in validation.
Upgrade Notes
The two tags belong to different packages in the repo (@auth/azure-tables-adapter vs next-auth), so the only meaningful delta is the next-auth 4.x security patch. Audit any code that catches exceptions from getToken(), and expect a single failed sign-in for users mid-flow during rollout. If you run behind a proxy with trusted-host mode, verify NEXTAUTH_URL is set to the public URL you actually want in callbacks.
The Two Releases
Jul 20, 2026· 3 months ago
Minimal release notes: "## Other - **@auth/core**: dependency update (8a933f95)"
Full release notesnext-auth@4.24.15
Jul 20, 2026· 3 months ago
A security patch release addressing vulnerabilities related to token handling, OAuth cookies, and email validation.
Full release notes