# latest_releases

source-backed

stack.pulse

cd ..track stack

#stacks/authjs/auth

Auth.js release notes, breaking changes, and upgrade notes.

Authentication for the Web StackPulse turns upstream changelogs into scannable summaries with risky changes, deprecations, migration notes, and source links.

source repo $track this stack plan upgrade rss

releases

breaking

security

deprecated

migrations

weekly upgrade digest

Get source-linked upgrade notes and occasional sponsor recommendations. No GitHub login required.

what stackpulse tracks

Auth.js releases from GitHub

StackPulse watches Auth.js release notes and keeps the original source link close to every summary.

upgrade risk

Breaking changes and deprecations

Risky changes are separated from normal feature notes so you can scan upgrade impact before changing production dependencies.

migration notes

Source-backed next steps

Migration steps and recommended actions are only shown when the upstream release notes support them.

# latest_releases

source-backed

all breaking deprecation migration security

next-auth@4.24.15criticalbreakingsecurityJul 20, 2026

next-auth@4.24.15

Security patch release for the 4.x line, addressing token handling, OAuth security, email validation, host precedence, and CommonJS compatibility.

affected

Users relying on malformed Bearer tokens or cross-provider OAuth callbacks are affected.

action

Update to 4.24.15 for security fixes and ensure OAuth flows handle provider-bound cookies.

release_signals

-`getToken()` now returns `null` instead of throwing for malformed Bearer tokens.

-OAuth `state`, `nonce`, and PKCE check cookies are provider-bound and reject mismatched callbacks.

-Sign-ins in flight across the upgrade fail once before succeeding on retry due to provider-bound cookie changes.

!Email addresses are Unicode-normalized (NFKC) before validation, closing a homoglyph `@` bypass.

!OAuth security improved by binding `state`, `nonce`, and PKCE cookies to the originating provider.

view source on github->