v0.30.5

Release Date: 2026-11-02

One account, several sign-ins:

• Linking sign-in methods. A person who signs in with GitHub under one email would get a second account by signing in with Google under another, since a sign-in joins an existing account only by an email its provider is authoritative for. Signed in, they can now open /account/sign-in-methods on the auth host and link the other provider first. Either sign-in then reaches the same account and its work. A sign-in that already has an account of its own is not linked: merging accounts, and removing a sign-in method, are not available yet.
• Safe by default. Linking needs a session for the account that started it, is origin-checked like sign-out, never moves an identity from another account, never creates an account and never changes the account's email. A completed link, and a link the callback refuses, is the security event systemauth.sign_in_method.linked, mapped to OCSF User Management.

It adds no breaking change and no setting: the page is served wherever social login is.

See Linking sign-in methods.