serverpod_auth_core_client

• fix: Fixes Google Sign-In accepting an access token minted for a different OAuth client that could be used to takeover an account.
• fix: Fixes improper neutralization of string values in Serverpod's ORM that exposes SQL injection from user input.
• fix: Includes session key salt in the session key hash.
• fix: Makes the login rate limit bound guesses per user.
• fix: Prevents rotating a refresh token for a blocked auth user.
• chore: Allows overriding the default cache header for FlutterRoute from env vars.
• chore: Polishes and adds dark theme to the default Flutter app.

• fix: Adds missing export of DeepCollectionEquality for shared models.
• fix: Prevents the creation of orphaned images on subsequent IDP logins.

• fix: Fixes malformed query when negating many-relation filters.
• fix: Fixes trying to complete the web socket listener twice on concurrent connections.

• fix: Fixes joins with long column names and deeply nested relations not mapping the correct columns.
• fix: Fixes error when closing method stream command with error after already closed.
• fix: Fixes migrations not being generated when changing columns of an index.
• fix: Fixes Dockerfile after workspaces upgrade.
• fix: Fixes GitHub workflows on project templates after workspaces upgrade.

• fix: Fixes Postgres throwing when using row-lock on find methods with includes.
• fix: Adds configurable clock skew tolerance to ID token validation on Google and Firebase IDPs.

• fix: Fixes constraints drop failing on Postgres due to already removed columns.
• fix: Adds missing configOverride forward to the test server.
• fix: Prevents triggering auth event listener when invalidating cache for JWT token refresh.

• fix: Removes wrong documentation link on PasswordMissingException.
• fix: Adds top-level .gitignore on created projects to ignore the .dart_tool of the workspace.
• fix: Allows serverpod create . in the current directory.
• fix: Makes insert with ignoreConflicts and !persist fields atomic.
• fix: Extends immutable non-constant default validation to cover id field.
• fix: Adds missing onSessionCreated to ServerSideSessionsConfigFromPasswords constructor.
• fix: Invalidates the cached refresh token before rotating in case the storage has changed.
• chore: Bumps jose dependency on legacy auth to fix CVE-2026-34240. Also backported to 2.9.3.

• fix: Truncates logged error messages to prevent hanging on formatter issues during code generation.
• fix: Fixes the CLI invoking the welcome page more than once per install.
• chore: Moves the flutter_secure_storage override from the workspace to the created Flutter package on a new project.

• fix: Fixes Google Sign-In not handling error when invoked directly from the controller.
• fix: Allows configuring the authority host for the Microsoft identity provider.
• fix: Adds support for additional authentication parameters on the Microsoft identity provider.
• fix: Adds support for additional authentication parameters on the GitHub identity provider.

• refactor: Changes the session parameter type on repository methods to DatabaseSession.
• fix: Fixes serialization of model objects in named record fields when mapping to JSON.
• fix: Fixes CLI showing warnings duplicated on projects with generated future calls.
• fix: Fixes missing generated _Undefined class when parent sealed classes have nullable fields and children have only non-nullable fields.
• fix: Fixes conflict on the Cache class import after relic upgrade to version 1.2.0.

• fix: Fixes wrong import URL to serverpod_service_client of shared models referenced as fields in other shared models.
• fix: Adds a warning to inform when the server is started with a Protocol class from an external package.
• fix: Skips explicit DROP CONSTRAINT when referenced table is dropped via CASCADE.

• fix: Fixes shared models using inexistent toJsonForProtocol method if referenced as fields on models with !persist or serverOnly fields.
• fix: Fixes not being able to reference shared models without the module alias on fields of other models.

Serverpod 3.4 comes with two long-awaited features: shared models between server and client and allowing caching any type of object to the local/Redis cache. It also brings two new Identity Providers (Facebook and Microsoft), a complete revamp to the cloud storage system, ignore conflicts on inserts and row-level locking on the database, shell completion support to the CLI and more improvements to the developer experience.

Core

• feat: Allows generating shared models between server and client on shared packages.
• feat: Allows caching any type of object to the local/Redis cache.
• feat: Allows ignoring conflicts on inserts through the ignoreConflicts parameter of the insert method. (@FXschwartz)
• feat: Adds PostgreSQL row-level locking through find* and lockRows methods. (@FXschwartz)
• feat: Adds support for FutureCall methods with only the Session parameter.
• fix: Fixes the time unit display on session log duration. (@Tokotuu)
• chore: Logs a warning when server tries to run unregistered future calls.

Authentication

• feat: Adds support to Facebook Identity Provider. (@vfiruz97)
• feat: Adds Microsoft Identity Provider. (@vfiruz97)
• feat: Allows attaching custom metadata to SSS/JWT tokens.
• feat: Adds expired filter and limit parameter to ServerSideSessions.listSessions.
• fix: Allows handling Android and Web redirection for Apple Sign In. (@jakubgiminski)
• fix: Correctly binds AuthUsersConfig to AnonymousIdp. (@craiglabenz)

• fix: Fixes text of GitHub IDP button not aligning correctly when using the left alignment. (@vfiruz97)
• fix: Fixes missing tokenExpiresAt info on AuthSuccess for server-side sessions.

Serverpod 3.3 brings a lot of new features and improvements to the framework, including two new identity providers (GitHub and Anonymous), virtual host routing, a robust Kubernetes-ready monitoring system, JSON key aliases and enum properties on models, and several improvements to logging.

The Anonymous IDP is currently experimental and can not be completely used yet due to the missing support for account linking. The missing parts will be added in the next releases.

Core

• feat: Adds Kubernetes-style health check endpoints livez, readyz, and startupz with support for custom health checks.
• feat: Adds configurable log retention and automated purging.
• feat: Allows defining custom jsonKey aliases in models to use in JSON serialization and deserialization. (@FXschwartz)
• feat: Adds support for defining custom properties on enum models. (@FXschwartz)
• fix: Preserves logging behavior settings when unrelated configs are set.
• fix: Fixes missing source on linting error due to the fields key missing under indexes.
• fix: Fixes console log timestamps showing actual event time instead of flush time. (@Tokotuu)
• fix: Generates const defaults for Duration and Uuid().v#obj() types.
• fix: Prevent import errors during generation when renaming the server on a project to server.
• fix: Adds keep-alive pings and idle timeout detection from the client to improve reliability of streaming connections.
• fix: Fixes CPU and memory metrics when running the server inside containers.

Authentication

• feat: Adds Anonymous IDP (currently experimental). (@craiglabenz)
• feat: Adds connected IDPs lookup on the server and client. (@craiglabenz)
• feat: Adds GitHub identity provider support. (@vfiruz97)
• feat: Adds an OAuth2 utility for building identity providers. (@vfiruz97)
• fix: Fixes custom --serverId not being properly propagated to logs.
• fix: Fixes Email IDP callbacks for sending verification codes not allowing async functions.
• fix: Exposes VerificationCodeConfig in the serverpod_auth_idp_flutter package with no extra imports. (@NeroSong)

Web server

• feat: Adds virtual host routing to allow serving different content per based on the host of incoming requests.
• feat: Exposes WebSocket ping interval for configuration via environment variables or configuration file.
• chore: Serverpod now uses Relic 1.0.0! 🎉

Developer tooling

• feat: Uses pub workspaces by default for new projects.

• fix: Fixes flutter_build script on the template project for Windows.

• fix: Fixes generated future calls producing import paths with backslashes on Windows.
• fix: Fixes serverpod generate timer frozen while command is running.

• fix: Moves the Firebase IDP into a separate package to avoid unexpected compilation issues for non-users of the IDP.
• fix: Prevents Google lightweight sign-in from automatically shadowing other identity providers.
• fix: Fixes the CLI directory search failing when trying to access removed folders on Windows.

Serverpod 3.2 brings a completely reworked experience for future calls, enhanced platform support on serverpod run, the new Firebase identity provider and several minor improvements.

Core

• feat: Adds new FutureCall experience with scheduling from generated type-safe classes (@Crazelu).
• feat: Propagates deprecated annotations from endpoint parameters to generated client code.
• feat: Adds a convenience getServerUrl function to the serverpod_flutter package.
• fix: Fixes default values not being applied on models when the JSON key is missing.
• fix: Fixes module-declared records not being encoded or decoded from the project.
• chore: Marks legacy future call interaction methods of the Serverpod class as deprecated in favor of the new type-safe API.

Authentication

• feat: Adds the Firebase identity provider to the authentication module.
• feat: Improves performance of rate limit control tables for authentication IDP providers.
• fix: Throws PasswordNotFoundException instead of null assertion in JWT and ServerSideSessions token managers.
• fix: Fixes not being able to issue new verification codes for emails with pending registration.
• fix: Fixes Google lightweight sign-in being invoked when user is already authenticated.
• fix: Changes verification code default generation to use only numbers for a better UX.
• fix: Changes EmailSignInWidget default start screen to favor user conversion.
• docs: Clarifies the purpose of each UserProfile and AuthUser model variants.

Developer tooling

• feat: Adds support for platform specific scripts in serverpod run command.
• fix: Fixes wrong Dart SDK path on the CLI when invoked from compiled code (like when installed with dart install).

• fix: Fixes unknown encodings crashing the CLI when creating a new project.
• fix: Fixes template web server serving the Flutter app config on the wrong path.

Serverpod 3.1 focuses on improving the developer experience with new tooling, enhanced Flutter web support, and important bug fixes.

Flutter web integration

• feat: Serves a Flutter app for new project templates.
• feat: Prevents caching of critical Flutter web files in FlutterRoute.

Developer tooling

• feat: Adds serverpod run command for running scripts.
• feat: Adds Serverpod script for starting the server and building flutter app.

Web server enhancements

• feat: Adds HTTP methods support to WidgetRoute.

Model improvements

• feat: Allows setting column name explicitly on models (@jwelmac).

Additional changes

• feat: Prevents database operations on health check when the database is idle.
• feat: Adds validateHeaders config option for backward compatibility with Serverpod 2 clients.

Bug fixes

• fix: Fixes email sign in button not re-enabling after changing the password.
• fix: Enforces only lowercase characters on email text field.
• fix: Fixes email action button not following the material theme.
• fix: Fixes consistency between spacing of sign in widget components.
• fix: Improves project templates with easier structure to digest.
• fix: Throws PasswordNotFoundException instead of null assertion in IDP *FromPassword config classes.
• fix: Uses resolved server directory in migration commands.
• fix: Ensures tailmatch (/**) is the default for StaticRoute.directory.
• fix: Fixes deserialization of collections of serverOnly models.
• fix: Prevents unnecessary table drops when removing foreign keys with constraint name collisions.
• fix: Fixes incorrect import generation for modules with serverpod prefix.
• fix: Stops Google Sign-In button spinner when authentication is canceled.

• fix: Allows the server address to be specified without trailing slash on the client.
• fix: Fixes allowed indexes key on non-table base models to allow inheritance of indexes.
• fix: Adds missing JWT refresh endpoint to the project template.

Serverpod 3 is a major overhaul of the authentication system and the web server.

Reworked web server

Serverpod 3 introduces a fully reworked web server with improved performance, additional features, and increased extensibility. Built on top of the Relic framework, it provides a more robust and flexible foundation for building web applications.

Key improvements include:

• Dynamic routes
• Middleware support
• Router fallbacks
• Comprehensive static asset handling, including cache busting and HTTP range requests

New authentication module

A new authentication module has been developed based on the authentication RFC. It provides a more flexible and robust foundation and significantly simplifies adding new identity providers.

Highlights:

• Multiple authentication strategies (JWT, server-side sessions)
• Multiple identity providers (Email, Google, Apple, Passkey) that can be configured and exposed independently
• New AuthUser class representing the authenticated user, their scopes, and all associated authentication tokens — extensible with custom user data
• Beautiful new UI components that provide a great user experience out of the box.
• Complete decoupling between UI and authentication logic on controllers that allow easy customization and replacement of the default components.

New packages:

• serverpod_auth_core — Core authentication logic and session management
• serverpod_auth_idp — Identity provider integrations (Email, Google, Apple, Passkey)
• serverpod_auth_bridge — Migration bridge for legacy auth (Email currently supported)
• serverpod_auth_migration — Tools and helpers for migrating auth data (Email currently supported)

Polymorphism support

Serverpod now supports polymorphism on models and endpoints. This allows you to define a base class that can be extended by other classes using the extends keyword. The server will automatically handle the serialization and deserialization both to the database and in client server communication.

• feat: Adds support for receiving and returning polymorphic models on endpoints.
• feat: Removes the experimental flag on inheritance. Huge shoutout to @BenAuerDev for all the work on this feature!
• feat: Generates abstract copyWith method to allow polymorphism on sealed models.
• feat: Adds support for inheritance on id field for table models for serverOnly models.
• fix: Handles unknown class names in polymorphic deserialization.

Additional changes

Breaking changes

• feat: BREAKING. Removes support for creating empty migrations using the --force flag.
• feat: BREAKING. Use exit code 0 when no migrations are needed.
• feat: BREAKING. Changes default enum serialization from byIndex to byName.
• feat: BREAKING. Authenticated user id is now logged using a String to support multiple formats.
• fix: BREAKING. Uses the Relic Headers class for configuring headers in the Serverpod server.
• fix: BREAKING. Removes methods previously marked as deprecated.
• fix: BREAKING. Removes deprecated SerializableEntity class.
• fix: BREAKING. Changes the userIdentifier parameter in AuthenticationInfo from Object to String.
• refactor: BREAKING. Renames context parameter to request in Route.call and Route.handleCall methods.
• refactor(legacy auth): BREAKING. Replaces callbacks with exceptions and return object when validating password hash. (@yashas-hm)

New features

• feat: Adds FlutterRoute and SpaRoute to simplify routing in single page applications.
• feat: Update template to include the new authentication module.
• feat: Adds parameter values to the TemplateWidget class.
• feat: Adds support for fetching Request from all session Session object through the request getter.
• feat: Adds support for resolving Dart doc template macros in client code generation.
• feat: Enable CLI commands to run from anywhere in a project directory. (@FXschwartz)
• feat: Adds -d / --directory flag to the serverpod generate command.
• feat: Adds support for configuring server output modes in the test framework, defaults to logging only errors.
• feat: Adds support for endpoint inheritance in generated client code.
• feat: Adds support for generating abstract endpoint classes in client code.
• feat: Adds support for immutable keyword in models to generate immutable models. (obiwanzenobi, @kamil-matula)
• feat: Adds support for partial database updates with the updateWhere and updateById methods.
• feat: Adds support for required field keyword on nullable fields in model and exception definitions.
• feat: Adds support for @unauthenticatedClientCall annotation for endpoints.
• feat: Web server templates can now be placed in subdirectories. (@nicowalter256)
• feat: Adds a ~ operator on expressions to perform NOT expression.
• feat: Server now stops automatically if the integrity check fails in development mode.
• feat: Introduces a new authKeyProvider interface to support multiple authentication key formats.

Fixes

• fix: Improves error message when there is a database mismatch on server startup.
• fix: Disables future call execution when none are registered.
• fix: Improves string representation for serializable exceptions.
• fix: Allows disabling features in the generator.yaml configuration file.
• fix: Fixes an issue on the deserialization engine that would prevent compilation on web in release mode.
• fix: Prevents the usage of non-constant defaults on immutable models.
• fix: Fixes missing inherited fields class constructor for table models with relation to inherited models.
• fix: Improves database migration "version not found" error message.
• fix: SessionLogEntry.time field now uses session start time.
• fix: Prevents null check error when relation defined without table.
• fix: Uses daemon exit code conventions for SIGTERM graceful shutdown.
• fix: Makes connectionTimeout final to prevent post-initialization mutation.
• fix: Always resolves the authenticated user for all requests, making session.authenticated synchronous.
• fix: Sets default log level to debug in development mode.
• fix: Fixes an issue where the @deprecated annotation was not propagated to test framework endpoints.
• fix: Fixes an issue where {@template} markers were not removed from generated endpoint documentation.
• fix: Fixes an issue where a failing database health check would fail the health check.
• fix: Fixes an issue where request-specific information was included in error responses.
• fix: Fixes an issue where the port retrieved from API and insights server would not be the actual port used by the service.
• fix: Fixes an issue where updating a vector database entry would crash due to missing dimensions.
• fix: Fixes a crash when persistent logging is disabled but database is enabled.
• fix: Replaces health check manager crash on unsupported platform with error message.
• fix: Index and table name collisions now give errors when generating project.
• fix: Fixes an issue where the streaming connection handler would attempt to reconnect indefinitely if the connection was lost.
• fix: Adds a clickable link to the web server when launched.
• fix: Fixes an issue where invalid client code could be generated when using default values (@ashishexee)
• fix: Fixes an issue where the web server port would not reflect the actual port used by the server.
• fix: Fixes an issue where Redis could not be enabled/disabled through configuration flag.
• fix: Fixes an issue where constructor configuration could not be overridden by passed in arguments.
• fix: Fixes an issue where SCP-lite Git URLs were not recognized when warning users about outdated lock files.
• fix: Database methods intended to only be used by generated code are now annotated with @internal.
• fix: Improves error messaging when database password cannot be resolved.
• fix: Serverpod templates are now only downloaded during serverpod create execution.
• fix: Add missing public parameter to file upload description (@LeonidVeremchuk)
• fix: Fixes an issue where empty maps in endpoint parameters and server-side return types where not encoded correctly.
• fix: Removes redundant null check in models using custom classes.
• fix: WebWidget now uses HTML instead of plainText as the default mimeType.
• fix(legacy auth): Fixes an issue where password length validation was not triggered for password reset and change password. (@yashas-hm)

Misc

• docs(legacy auth): Fixes a documentation error where Google was referenced in the Email identity provider. (@emilakerman)
• chore: Marks legacy streaming endpoints and associated code as deprecated. Streaming methods are now the preferred way to handle streaming between the server and client.
• chore: Marks AuthenticationKeyManager as deprecated in favour of the new ClientAuthKeyProvider interface.
• chore: Bumps minimum Dart version to 3.8.0 and Flutter version to 3.32.0.