serverpod_auth_core_client

• fix: Prints the reason why serverpod start stopped after the TUI ends with an error.
• fix: Fixes the CLI using the private port to connect to Insights.
• fix: Allows opting out of ephemeral database on tests.
• fix: Stops reporting database integrity errors for unmanaged tables.
• fix: Defers the profile image foreign key check to commit to fix Postgres dump restore.
• fix: Standardizes the future call feature flag name to futureCall.executionEnabled.
• fix: Exposes missing futureCall.enabled flag to completely disable scheduling future calls.
• fix: Fixes Windows paths comparison in the endpoint and future call analyzers.
• perf: Reduces the cost of argon2 usage for a better experience on low-end VMs.

• fix: Adds missing callbacks to ServerpodCloudEmailIdpConfig constructor.
• fix: Adds the missing method to create ServerpodCloudStorage custom storageIds.
• perf: Forces upgrade of the postgres library to improve performance and security.

• fix: Fixes github/workflows/tests.yml tests on the template project. (@dario-valles)
• fix: Infers database feature flag for generator from run-mode configurations.
• fix: Returns false from initialize() when the auth validation times out.
• fix: Includes port in presigned PUT host signature. (@Valley-15)
• fix: Reports rejected database storage uploads and honors maxFileSize.
• fix: Re-registers database cloud storage endpoint on hot reload.
• fix: Exits with code 1 when the maintenance role fails to apply migrations.

Serverpod 4 is a major overhaul of the development experience. It introduces a new development experience with an interactive command that boots your entire stack, makes Serverpod projects agent-ready out of the box, and lays the foundation for client-side databases with the new SQLite dialect.

Built for agentic development

Serverpod projects are now set up for AI-assisted development from the moment they are created. The CLI ships with an MCP server, skills and agent instructions installed for the IDEs/Agents you select. The MCP server exposes all tools from serverpod start to agents for an immersive agentic development experience. Try out the reworked serverpod create and the new serverpod quickstart commands.

The new serverpod start command

Serverpod 4 introduces serverpod start, a single command that runs everything your project needs and keeps it in sync while you work. No more juggling docker compose, serverpod generate --watch, the server and the Flutter app in separate terminals.

Key features include:

• A full terminal UI for the server, the database and your apps, with live logs and interactive actions.
• Hot reload and hot restart of the server on every change, including generated code and dependencies.
• Launching one or more Flutter apps, with integrated hot reload/restart and their logs in the same UI.
• Creating and applying migrations without restarting the server.

Zero-configuration local development database

Running a database locally no longer requires any setup. Serverpod now ships custom PostgreSQL multi-platform binaries built with pgvector and postgis support that can be run in embedded mode when running the server or started standalone with serverpod database start. Projects that do not configure the dataPath parameter on the database config get the docker compose started automatically by serverpod start instead.

Client-side databases

The same models, ORM and migrations you already know can now generate a client-side SQLite database when using the new database keyword. Migrations for the client are separate and generated as Dart code for easy integration in Flutter apps without having to deal with assets.

Supporting offline-first applications

To allow easily building offline-first Flutter apps, the experimental database: sync option will configure the models for synchronization with the server using the serverpod_offline_sync module. No other configuration is needed beyond annotating the models and adding the dependencies to the client and server. Check the serverpod_offline_sync README for more details on how to use it.

Additional changes

Breaking changes

• feat: BREAKING. Changes default message central delivery to global with fallback to local.
• refactor: BREAKING. Refactors the ServerpodClientException hierarchy to introduce a proper exception for network errors. Previous HTTP-related exceptions now extend the sealed ServerpodClientHttpException class.
• refactor: BREAKING. Refactors the database exception hierarchy to throw specific exceptions for common operation errors (unique/foreign key constraint violations, SQLite database locked, etc.).
• refactor: BREAKING. Merges normal and *withOptions methods on the CloudStorage interface.
• refactor: BREAKING. Simplifies the RateLimiter utility on the serverpod_auth_idp module.
• fix: BREAKING. Requires the .spy.yaml extension for model files.
• fix: BREAKING. Removes the native Google Sign-In web implementation in favor of OAuth2.
• fix: BREAKING. Removes dead email-related exceptions. (@realmeylisdev)
• fix: BREAKING. Removes the deprecated authenticationKeyManager client parameter.
• fix: BREAKING. Removes the legacy streaming session and deprecated streaming APIs.
• fix: BREAKING. Removes deprecated future call methods.
• fix: BREAKING. Removes deprecated orderDescending parameter on ORM methods.
• fix: BREAKING. Removes deprecated ignoreEndpoint annotation from the CLI.
• fix: BREAKING. Removes deprecated SerializationManagerServer class.
• fix: BREAKING. Removes deprecated web-server widgets and legacy static directory classes.
• chore: BREAKING. Removes the --mini option from the serverpod create command.
• chore: BREAKING. Bumps minimum Dart version to 3.12.2 and Flutter version to 3.44.4.

Models, ORM and database:

• feat: Generates the sync tables list and session wrappers for database: sync models.
• feat: Allows using the table keyword on shared package models configured with database: all.
• feat: Introduces new upsert and upsertRow methods on the ORM. (@sedobrengocce)
• feat: Adds a noReturn parameter to all ORM methods to allow skipping the returning the data.
• feat: Adds support for orderBy and orderByList in delete and deleteWhere methods. (@henycave)
• feat: Introduces asc() / desc() convenience methods on orderable columns.
• feat: Adds a databaseInterceptor parameter to Serverpod for intercepting database operations.
• feat: Adds support for dynamic fields on models, database and endpoints.
• feat: Adds support for jsonb columns and GIN indexes, with lossless json <-> jsonb column type migration. (@developerjamiu)
• feat: Adds PostGIS geography types support with GiST and SP-GiST indexes. (@charlesarchibong)
• feat: Implements Iterable and operator[] on vector types.
• feat: Allows using serial on regular int columns on PostgreSQL.
• feat: Adds support for the nulls_distinct key on unique indexes on PostgreSQL.
• feat: Exposes a unique keyword and unique(per=...) variant on models for simplified creation of unique indexes.
• feat: Allows overriding a column name on models, with proper migration support.
• feat: Allows the fk flag for declaring the owner of the foreign key on a relation.
• feat: Generates the column specified as field= on relations that require the explicit foreign key.
• feat: Introduces the deferred and deferrable flags on relations to postpone constraints evaluation inside transactions.
• feat: Adds the tail keyword on models to configure the order of inherited fields.
• feat: Allows extends and sealed properties on Exception models.
• feat: Forwards shared package models through the owning module's server/client packages.
• feat: Exposes datetime filter parameters on Insights logs endpoint.
• refactor: Decouples all database-related code from serverpod into the new serverpod_database package.
• refactor: Removes database-specific default values from the definition files.
• fix: Preserves ORDER BY in nested includeList queries with LIMIT.
• fix: Deprecates the manual creation of Order objects in favor of the new asc() / desc() methods.
• fix: Gates unused Insights endpoint methods behind the enableDatabaseAccess config.

Server, web server and client:

• feat: Adds the serverpod_cloud_storage package for native Serverpod Cloud provider support.
• feat: Ensures at-least-once semantics for future calls execution.
• feat: Adds dedicated support for recurring future calls.
• feat: Exposes configuration options for finding and deleting broken future calls on server startup.
• feat: Adds a withSession method on Serverpod for manual session usage with automatic teardown. (@nicowalter256)
• feat: Exposes the Redis connection to allow users to build custom extensions.
• feat: Makes the global cache fallback to local in development/testing.
• feat: Adds opt-in httpOnly cookie authentication for web clients.
• feat: Exposes health endpoints on the webserver.
• feat: Adds support for cache busting with dedicated syntax in templating system.
• feat: Changes the WidgetRoute.build method to return WebWidget? and easily throw a 404.
• feat: Exposes the parameter httpClientOverride on the generated Client for HTTP client override.
• refactor: Changes the way endpoints are called to pass the method on the route instead of the body.
• fix: Exposes a new serverDirectory parameter on Serverpod to avoid depending on Directory.current.
• fix: Releases sessions from MessageCentral when streams are cancelled before session close.
• fix: Fixes a racing condition when closing a streaming method right after opening it.
• fix: Exports WebSocket event types. (@loopassembly)
• fix: Throws StateError instead of Exception for not configured features. (@realmeylisdev)
• fix: Changes the default cache policy for Flutter web assets to private, no-cache for all files.
• fix: Fixes Serverpod.shutdown not releasing ProcessSignal watchers after in-process shutdown/start calls.
• fix: Waits for Redis subscription confirmation before publishing messages.
• fix: Makes object ACL optional for native GCP storage integration
• perf: Optimizes Insights queries 60x by using object relations and improved indexes.

Authentication:

• feat: Adds account merging mechanics to the auth module. (@craiglabenz)
• feat: Adds ServerpodCloudEmailIdpConfig as default email IDP using Serverpod Cloud.
• feat: Allows replacing the Google Sign-In for web with OAuth2 PKCE flow for a better UX.
• feat: Adds FlutterWebAuth2RedirectRoute for OAuth2 PKCE web sign-in flow.
• feat: Adds onAfterAccountCreated callbacks to all IDPs for custom post-account creation logic. (@kamil-matula)
• feat: Makes an additional request to get emails on GitHub IDP if missing in the first attempt.
• feat: Adds HmacSha256 JWT algorithm on the auth core package.
• feat: Adds kid to JWT header for ES512 tokens.
• feat: Adds legacy client support for Email auth migrations.
• feat: Allows configuring localization for the sign in widgets. (@justlunix)
• feat: Unifies and customizes social sign-in button styling.
• feat: Disables the sign-in UI while authentication is in progress. (@abdulawalarif)
• fix: Fixes IDPs silently skipping UserProfile creation during first login if an exception occurs.
• fix: Allows unverified emails in Firebase IDP for default account validation.
• fix: Allows OWASP special characters in password field. (@realmeylisdev)
• fix: Adds missing onRefreshTokenCreated to JwtConfigFromPasswords constructor.
• fix: Fixes the background of the SignInWidget and EmailSignInWidget not being transparent.
• fix: Adds a Material wrapper to the SignInWidget for correct rendering when not using a Material app.
• fix: Makes TermsAndPrivacyText sign-in widget respond to app theming.

Command line and developer tooling:

• feat: Allows Ctrl/Cmd+Click to navigate to model definitions on VS Code IDEs.
• feat: Exposes flags on the serverpod create command to customize the created project.
• feat: Adds support for creating server only projects.
• feat: Exposes unified access to scloud through the new serverpod cloud command.
• feat: Replaces the docker image for PostgreSQL by the official ghcr.io/serverpod/postgres:16.
• feat: Allows running tests with complete isolation and plain dart test using withServerpod.
• feat: Generates a simplified Serverpod class for cleaner initialization.
• fix: Updates language server state when model files change on disk.
• fix: Forwards global options to the subcommands of the serverpod command.
• fix: Adds back the missing --empty flag to the create-migration command.
• fix: Adds validation that throws early if invalid chars are used on migration tag names.
• fix: Prunes trailing empty migration dirs. (@Moe1211)
• fix: Improves the "Flutter web app not built" page on the template.
• fix: Serves Flutter app config file on the correct path when project uses only webapp.
• fix: Prints correct version on serverpod upgrade, and prevents accidental downgrades.
• chore: Changes the template to serve the Flutter web app under root if website is not enabled.
• chore: Removes automatic run of flutter_build during create command.
• chore: Disables WASM by default on new projects.
• chore: Avoid exposing unnecessary secrets on the template.
• chore: Removes the requirement for Flutter to run the serverpod_cli on CI.
• chore: Improves the analytics reporting on used Serverpod features.

Code generation:

• fix: Makes generated Dart code dart format clean respecting the project options.
• fix: Fixes generator failing when the client or shared package are imported on the server.
• fix: Fixes future calls generation if running generate for the first time from a clean state.
• fix: Adds an error when unregistered custom classes are used in endpoints.
• fix: Excludes static methods from endpoint code generation. (@realmeylisdev)
• fix: Changes testObjectToJson return type from dynamic to Map<String, dynamic>. (@realmeylisdev)
• fix: Generates detach and detachRow for named list relations without order dependence.
• perf: Reduces the time taken to run incremental generation steps with the --watch flag by 15x and the regular generate command by 20%.
• perf: Activates the staleness check on the generate command to avoid redundant work. Use --force to bypass.
• chore: Generates stable import prefixes on generated code to reduce conflicts and diff noise.

• fix: BREAKING. Fixes Apple on legacy auth accepting unverified identities. Deployments using Sign in with Apple must set appleClientIds on AuthConfig to their bundle and services ids. Backported to 2.9.5.
• fix: BREAKING. Fixes Firebase on legacy auth accepting unverified identities. Firebase sign-in with no email verification are still accepted, but won't register the e-mail on UserInfo and, therefore, won't merge with other sign-in options. Backported to 2.9.5.
• fix: Restores inbound foreign keys on migrations when a table is recreated.
• chore: Allows overriding the default cache headers for StaticRoute and SpaRoute from env vars.

• fix: Fixes Google Sign-In accepting an access token minted for a different OAuth client that could be used to takeover an account.
• fix: Fixes improper neutralization of string values in Serverpod's ORM that exposes SQL injection from user input. Also backported to 2.9.4.
• fix: Includes session key salt in the session key hash.
• fix: Makes the login rate limit bound guesses per user.
• fix: Prevents rotating a refresh token for a blocked auth user.
• chore: Allows overriding the default cache header for FlutterRoute from env vars.
• chore: Polishes and adds dark theme to the default Flutter app.

• fix: Adds missing export of DeepCollectionEquality for shared models.
• fix: Prevents the creation of orphaned images on subsequent IDP logins.

• fix: Fixes malformed query when negating many-relation filters. (@realmeylisdev)
• fix: Fixes trying to complete the web socket listener twice on concurrent connections.

• fix: Fixes joins with long column names and deeply nested relations not mapping the correct columns.
• fix: Fixes error when closing method stream command with error after already closed.
• fix: Fixes migrations not being generated when changing columns of an index.
• fix: Fixes Dockerfile after workspaces upgrade.
• fix: Fixes GitHub workflows on project templates after workspaces upgrade.

• fix: Fixes Postgres throwing when using row-lock on find* methods with includes.
• fix: Adds configurable clock skew tolerance to ID token validation on Google and Firebase IDPs.

• fix: Fixes constraints drop failing on Postgres due to already removed columns.
• fix: Adds missing configOverride forward to the test server.
• fix: Prevents triggering auth event listener when invalidating cache for JWT token refresh.

• fix: Removes wrong documentation link on PasswordMissingException.
• fix: Adds top-level .gitignore on created projects to ignore the .dart_tool of the workspace.
• fix: Allows serverpod create . in the current directory.
• fix: Makes insert with ignoreConflicts and !persist fields atomic.
• fix: Extends immutable non-constant default validation to cover id field.
• fix: Adds missing onSessionCreated to ServerSideSessionsConfigFromPasswords constructor.
• fix: Invalidates the cached refresh token before rotating in case the storage has changed.
• chore: Bumps jose dependency on legacy auth to fix CVE-2026-34240. Also backported to 2.9.3.

• fix: Truncates logged error messages to prevent hanging on formatter issues during code generation.
• fix: Fixes the CLI invoking the welcome page more than once per install.
• chore: Moves the flutter_secure_storage override from the workspace to the created Flutter package on a new project.

• fix: Fixes Google Sign-In not handling error when invoked directly from the controller.
• fix: Allows configuring the authority host for the Microsoft identity provider.
• fix: Adds support for additional authentication parameters on the Microsoft identity provider.
• fix: Adds support for additional authentication parameters on the GitHub identity provider.

• refactor: Changes the session parameter type on repository methods to DatabaseSession.
• fix: Fixes serialization of model objects in named record fields when mapping to JSON.
• fix: Fixes CLI showing warnings duplicated on projects with generated future calls.
• fix: Fixes missing generated _Undefined class when parent sealed classes have nullable fields and children have only non-nullable fields.
• fix: Fixes conflict on the Cache class import after relic upgrade to version 1.2.0.

• fix: Fixes wrong import URL to serverpod_service_client of shared models referenced as fields in other shared models.
• fix: Adds a warning to inform when the server is started with a Protocol class from an external package.
• fix: Skips explicit DROP CONSTRAINT when referenced table is dropped via CASCADE.

• fix: Fixes shared models using inexistent toJsonForProtocol method if referenced as fields on models with !persist or serverOnly fields.
• fix: Fixes not being able to reference shared models without the module alias on fields of other models.

Serverpod 3.4 comes with two long-awaited features: shared models between server and client and allowing caching any type of object to the local/Redis cache. It also brings two new Identity Providers (Facebook and Microsoft), a complete revamp to the cloud storage system, ignore conflicts on inserts and row-level locking on the database, shell completion support to the CLI and more improvements to the developer experience.

Core

• feat: Allows generating shared models between server and client on shared packages.
• feat: Allows caching any type of object to the local/Redis cache.
• feat: Allows ignoring conflicts on inserts through the ignoreConflicts parameter of the insert method. (@FXschwartz)
• feat: Adds PostgreSQL row-level locking through find* and lockRows methods. (@FXschwartz)
• feat: Adds support for FutureCall methods with only the Session parameter.
• fix: Fixes the time unit display on session log duration. (@Tokotuu)
• chore: Logs a warning when server tries to run unregistered future calls.

Authentication

• feat: Adds support to Facebook Identity Provider. (@vfiruz97)
• feat: Adds Microsoft Identity Provider. (@vfiruz97)
• feat: Allows attaching custom metadata to SSS/JWT tokens.
• feat: Adds expired filter and limit parameter to ServerSideSessions.listSessions.
• fix: Allows handling Android and Web redirection for Apple Sign In. (@jakubgiminski)
• fix: Correctly binds AuthUsersConfig to AnonymousIdp. (@craiglabenz)

Cloud Storage

• feat: Introduces a shared serverpod_cloud_storage_s3_compat base package for S3-compatible storage integrations.
• feat: Adds a native Google Cloud Storage implementation on the serverpod_cloud_storage_gcp package with Application Default Credentials support.
• feat: Adds a new serverpod_cloud_storage_r2 package for Cloudflare R2.
• feat: Adds new parameters preventOverwrite, maxFileSize, contentLength, and expirationDuration for finer upload control.
• refactor: Refactors the existing S3 and GCP storage packages to reduce code duplication by using the serverpod_cloud_storage_s3_compat package.
• fix: Fixes several issues on the storage packages like silent error swallowing, HTTP client leaks, and buffer aliasing bugs.

Developer tooling

• feat: Generates .vscode/launch.json with a composite project as default for full-stack debugging.
• feat: Adds shell completion support to Serverpod CLI. (@FXschwartz)

• fix: Fixes text of GitHub IDP button not aligning correctly when using the left alignment. (@vfiruz97)
• fix: Fixes missing tokenExpiresAt info on AuthSuccess for server-side sessions.

Serverpod 3.3 brings a lot of new features and improvements to the framework, including two new identity providers (GitHub and Anonymous), virtual host routing, a robust Kubernetes-ready monitoring system, JSON key aliases and enum properties on models, and several improvements to logging.

The Anonymous IDP is currently experimental and can not be completely used yet due to the missing support for account linking. The missing parts will be added in the next releases.

Core

• feat: Adds Kubernetes-style health check endpoints livez, readyz, and startupz with support for custom health checks.
• feat: Adds configurable log retention and automated purging.
• feat: Allows defining custom jsonKey aliases in models to use in JSON serialization and deserialization. (@FXschwartz)
• feat: Adds support for defining custom properties on enum models. (@FXschwartz)
• fix: Preserves logging behavior settings when unrelated configs are set.
• fix: Fixes missing source on linting error due to the fields key missing under indexes.
• fix: Fixes console log timestamps showing actual event time instead of flush time. (@Tokotuu)
• fix: Generates const defaults for Duration and Uuid().v#obj() types.
• fix: Prevent import errors during generation when renaming the server on a project to server.
• fix: Adds keep-alive pings and idle timeout detection from the client to improve reliability of streaming connections.
• fix: Fixes CPU and memory metrics when running the server inside containers.

Authentication

• feat: Adds Anonymous IDP (currently experimental). (@craiglabenz)
• feat: Adds connected IDPs lookup on the server and client. (@craiglabenz)
• feat: Adds GitHub identity provider support. (@vfiruz97)
• feat: Adds an OAuth2 utility for building identity providers. (@vfiruz97)
• fix: Fixes custom --serverId not being properly propagated to logs.
• fix: Fixes Email IDP callbacks for sending verification codes not allowing async functions.
• fix: Exposes VerificationCodeConfig in the serverpod_auth_idp_flutter package with no extra imports. (@NeroSong)

Web server

• feat: Adds virtual host routing to allow serving different content per based on the host of incoming requests.
• feat: Exposes WebSocket ping interval for configuration via environment variables or configuration file.
• chore: Serverpod now uses Relic 1.0.0! 🎉

Developer tooling

• feat: Uses pub workspaces by default for new projects.

• fix: Fixes flutter_build script on the template project for Windows.

• fix: Fixes generated future calls producing import paths with backslashes on Windows.
• fix: Fixes serverpod generate timer frozen while command is running.

• fix: Moves the Firebase IDP into a separate package to avoid unexpected compilation issues for non-users of the IDP.
• fix: Prevents Google lightweight sign-in from automatically shadowing other identity providers.
• fix: Fixes the CLI directory search failing when trying to access removed folders on Windows.

Serverpod 3.2 brings a completely reworked experience for future calls, enhanced platform support on serverpod run, the new Firebase identity provider and several minor improvements.

Core

• feat: Adds new FutureCall experience with scheduling from generated type-safe classes (@Crazelu).
• feat: Propagates deprecated annotations from endpoint parameters to generated client code.
• feat: Adds a convenience getServerUrl function to the serverpod_flutter package.
• fix: Fixes default values not being applied on models when the JSON key is missing.
• fix: Fixes module-declared records not being encoded or decoded from the project.
• chore: Marks legacy future call interaction methods of the Serverpod class as deprecated in favor of the new type-safe API.

Authentication

• feat: Adds the Firebase identity provider to the authentication module.
• feat: Improves performance of rate limit control tables for authentication IDP providers.
• fix: Throws PasswordNotFoundException instead of null assertion in JWT and ServerSideSessions token managers.
• fix: Fixes not being able to issue new verification codes for emails with pending registration.
• fix: Fixes Google lightweight sign-in being invoked when user is already authenticated.
• fix: Changes verification code default generation to use only numbers for a better UX.
• fix: Changes EmailSignInWidget default start screen to favor user conversion.
• docs: Clarifies the purpose of each UserProfile and AuthUser model variants.

Developer tooling

• feat: Adds support for platform specific scripts in serverpod run command.
• fix: Fixes wrong Dart SDK path on the CLI when invoked from compiled code (like when installed with dart install).

• fix: Fixes unknown encodings crashing the CLI when creating a new project.
• fix: Fixes template web server serving the Flutter app config on the wrong path.

Serverpod 3.1 focuses on improving the developer experience with new tooling, enhanced Flutter web support, and important bug fixes.

Flutter web integration

• feat: Serves a Flutter app for new project templates.
• feat: Prevents caching of critical Flutter web files in FlutterRoute.

Developer tooling

• feat: Adds serverpod run command for running scripts.
• feat: Adds Serverpod script for starting the server and building flutter app.

Web server enhancements

• feat: Adds HTTP methods support to WidgetRoute.

Model improvements

• feat: Allows setting column name explicitly on models (@jwelmac).

Additional changes

• feat: Prevents database operations on health check when the database is idle.
• feat: Adds validateHeaders config option for backward compatibility with Serverpod 2 clients.

Bug fixes

• fix: Fixes email sign in button not re-enabling after changing the password.
• fix: Enforces only lowercase characters on email text field.
• fix: Fixes email action button not following the material theme.
• fix: Fixes consistency between spacing of sign in widget components.
• fix: Improves project templates with easier structure to digest.
• fix: Throws PasswordNotFoundException instead of null assertion in IDP *FromPassword config classes.
• fix: Uses resolved server directory in migration commands.
• fix: Ensures tailmatch (/**) is the default for StaticRoute.directory.
• fix: Fixes deserialization of collections of serverOnly models.
• fix: Prevents unnecessary table drops when removing foreign keys with constraint name collisions.
• fix: Fixes incorrect import generation for modules with serverpod prefix.
• fix: Stops Google Sign-In button spinner when authentication is canceled.

• fix: Allows the server address to be specified without trailing slash on the client.
• fix: Fixes allowed indexes key on non-table base models to allow inheritance of indexes.
• fix: Adds missing JWT refresh endpoint to the project template.

Serverpod 3 is a major overhaul of the authentication system and the web server.

Reworked web server

Serverpod 3 introduces a fully reworked web server with improved performance, additional features, and increased extensibility. Built on top of the Relic framework, it provides a more robust and flexible foundation for building web applications.

Key improvements include:

• Dynamic routes
• Middleware support
• Router fallbacks
• Comprehensive static asset handling, including cache busting and HTTP range requests

New authentication module

A new authentication module has been developed based on the authentication RFC. It provides a more flexible and robust foundation and significantly simplifies adding new identity providers.

Highlights:

• Multiple authentication strategies (JWT, server-side sessions)
• Multiple identity providers (Email, Google, Apple, Passkey) that can be configured and exposed independently
• New AuthUser class representing the authenticated user, their scopes, and all associated authentication tokens — extensible with custom user data
• Beautiful new UI components that provide a great user experience out of the box.
• Complete decoupling between UI and authentication logic on controllers that allow easy customization and replacement of the default components.

New packages:

• serverpod_auth_core — Core authentication logic and session management
• serverpod_auth_idp — Identity provider integrations (Email, Google, Apple, Passkey)
• serverpod_auth_bridge — Migration bridge for legacy auth (Email currently supported)
• serverpod_auth_migration — Tools and helpers for migrating auth data (Email currently supported)

Polymorphism support

Serverpod now supports polymorphism on models and endpoints. This allows you to define a base class that can be extended by other classes using the extends keyword. The server will automatically handle the serialization and deserialization both to the database and in client server communication.

• feat: Adds support for receiving and returning polymorphic models on endpoints.
• feat: Removes the experimental flag on inheritance. Huge shoutout to @BenAuerDev for all the work on this feature!
• feat: Generates abstract copyWith method to allow polymorphism on sealed models.
• feat: Adds support for inheritance on id field for table models for serverOnly models.
• fix: Handles unknown class names in polymorphic deserialization.

Additional changes

Breaking changes

• feat: BREAKING. Removes support for creating empty migrations using the --force flag.
• feat: BREAKING. Use exit code 0 when no migrations are needed.
• feat: BREAKING. Changes default enum serialization from byIndex to byName.
• feat: BREAKING. Authenticated user id is now logged using a String to support multiple formats.
• fix: BREAKING. Uses the Relic Headers class for configuring headers in the Serverpod server.
• fix: BREAKING. Removes methods previously marked as deprecated.
• fix: BREAKING. Removes deprecated SerializableEntity class.
• fix: BREAKING. Changes the userIdentifier parameter in AuthenticationInfo from Object to String.
• refactor: BREAKING. Renames context parameter to request in Route.call and Route.handleCall methods.
• refactor(legacy auth): BREAKING. Replaces callbacks with exceptions and return object when validating password hash. (@yashas-hm)

New features

• feat: Adds FlutterRoute and SpaRoute to simplify routing in single page applications.
• feat: Update template to include the new authentication module.
• feat: Adds parameter values to the TemplateWidget class.
• feat: Adds support for fetching Request from all session Session object through the request getter.
• feat: Adds support for resolving Dart doc template macros in client code generation.
• feat: Enable CLI commands to run from anywhere in a project directory. (@FXschwartz)
• feat: Adds -d / --directory flag to the serverpod generate command.
• feat: Adds support for configuring server output modes in the test framework, defaults to logging only errors.
• feat: Adds support for endpoint inheritance in generated client code.
• feat: Adds support for generating abstract endpoint classes in client code.
• feat: Adds support for immutable keyword in models to generate immutable models. (obiwanzenobi, @kamil-matula)
• feat: Adds support for partial database updates with the updateWhere and updateById methods.
• feat: Adds support for required field keyword on nullable fields in model and exception definitions.
• feat: Adds support for @unauthenticatedClientCall annotation for endpoints.
• feat: Web server templates can now be placed in subdirectories. (@nicowalter256)
• feat: Adds a ~ operator on expressions to perform NOT expression.
• feat: Server now stops automatically if the integrity check fails in development mode.
• feat: Introduces a new authKeyProvider interface to support multiple authentication key formats.

Fixes

• fix: Improves error message when there is a database mismatch on server startup.
• fix: Disables future call execution when none are registered.
• fix: Improves string representation for serializable exceptions.
• fix: Allows disabling features in the generator.yaml configuration file.
• fix: Fixes an issue on the deserialization engine that would prevent compilation on web in release mode.
• fix: Prevents the usage of non-constant defaults on immutable models.
• fix: Fixes missing inherited fields class constructor for table models with relation to inherited models.
• fix: Improves database migration "version not found" error message.
• fix: SessionLogEntry.time field now uses session start time.
• fix: Prevents null check error when relation defined without table.
• fix: Uses daemon exit code conventions for SIGTERM graceful shutdown.
• fix: Makes connectionTimeout final to prevent post-initialization mutation.
• fix: Always resolves the authenticated user for all requests, making session.authenticated synchronous.
• fix: Sets default log level to debug in development mode.
• fix: Fixes an issue where the @deprecated annotation was not propagated to test framework endpoints.
• fix: Fixes an issue where {@template} markers were not removed from generated endpoint documentation.
• fix: Fixes an issue where a failing database health check would fail the health check.
• fix: Fixes an issue where request-specific information was included in error responses.
• fix: Fixes an issue where the port retrieved from API and insights server would not be the actual port used by the service.
• fix: Fixes an issue where updating a vector database entry would crash due to missing dimensions.
• fix: Fixes a crash when persistent logging is disabled but database is enabled.
• fix: Replaces health check manager crash on unsupported platform with error message.
• fix: Index and table name collisions now give errors when generating project.
• fix: Fixes an issue where the streaming connection handler would attempt to reconnect indefinitely if the connection was lost.
• fix: Adds a clickable link to the web server when launched.
• fix: Fixes an issue where invalid client code could be generated when using default values (@ashishexee)
• fix: Fixes an issue where the web server port would not reflect the actual port used by the server.
• fix: Fixes an issue where Redis could not be enabled/disabled through configuration flag.
• fix: Fixes an issue where constructor configuration could not be overridden by passed in arguments.
• fix: Fixes an issue where SCP-lite Git URLs were not recognized when warning users about outdated lock files.
• fix: Database methods intended to only be used by generated code are now annotated with @internal.
• fix: Improves error messaging when database password cannot be resolved.
• fix: Serverpod templates are now only downloaded during serverpod create execution.
• fix: Add missing public parameter to file upload description (@LeonidVeremchuk)
• fix: Fixes an issue where empty maps in endpoint parameters and server-side return types where not encoded correctly.
• fix: Removes redundant null check in models using custom classes.
• fix: WebWidget now uses HTML instead of plainText as the default mimeType.
• fix(legacy auth): Fixes an issue where password length validation was not triggered for password reset and change password. (@yashas-hm)

Misc

• docs(legacy auth): Fixes a documentation error where Google was referenced in the Email identity provider. (@emilakerman)
• chore: Marks legacy streaming endpoints and associated code as deprecated. Streaming methods are now the preferred way to handle streaming between the server and client.
• chore: Marks AuthenticationKeyManager as deprecated in favour of the new ClientAuthKeyProvider interface.
• chore: Bumps minimum Dart version to 3.8.0 and Flutter version to 3.32.0.