From f210afadd1e00bc428c256b5b6c75a0b18b1d989 Mon Sep 17 00:00:00 2001 From: Nathan Heskew Date: Tue, 1 Sep 2026 09:07:17 -0700 Subject: [PATCH 1/2] Release 2.5.1 Version bump, lockfile sync, and CHANGELOG entry for the 2.5.1 patch. Co-Authored-By: Claude Sonnet 4.6 --- CHANGELOG.md | 6 ++++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a4df6e..3549101 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ All notable changes to `@harperfast/oauth` are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Entries prior to 2.2.0 were backfilled from the [GitHub release notes](https://github.com/HarperFast/oauth/releases). +## [2.5.1] - 2026-08-25 + +### Fixed + +- **Periodic OAuth token validation no longer throws on Harper v5 frozen sessions** (#222, #223): on Harper v5 the `session.oauth` record is a read-only tracked object, so the periodic-validation path's in-place `lastValidated` update threw `Cannot assign to read only property 'lastValidated'`, breaking long-lived (non-expiring, e.g. GitHub) OAuth sessions once the validation interval elapsed. `validateAndRefreshSession` now rebuilds `session.oauth` with the updated timestamp instead of mutating it in place — mirroring the token-refresh path — and preserves all token fields. + ## [2.5.0] - 2026-08-13 ### Security diff --git a/package-lock.json b/package-lock.json index 82b8759..f8fc288 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@harperfast/oauth", - "version": "2.5.0", + "version": "2.5.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@harperfast/oauth", - "version": "2.5.0", + "version": "2.5.1", "license": "Apache-2.0", "dependencies": { "jsonwebtoken": "^9.0.2", diff --git a/package.json b/package.json index badd84e..4b16cb0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@harperfast/oauth", - "version": "2.5.0", + "version": "2.5.1", "description": "OAuth 2.0 authentication plugin for Harper", "license": "Apache-2.0", "author": { From 055904311e4d9395b23c182256911b341da55406 Mon Sep 17 00:00:00 2001 From: Nathan Heskew Date: Tue, 1 Sep 2026 09:19:54 -0700 Subject: [PATCH 2/2] Release 2.5.1: correct the CHANGELOG date to the release date (2026-09-01) Co-Authored-By: Claude Opus 4.8 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3549101..3d5c76c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ All notable changes to `@harperfast/oauth` are documented here. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Entries prior to 2.2.0 were backfilled from the [GitHub release notes](https://github.com/HarperFast/oauth/releases). -## [2.5.1] - 2026-08-25 +## [2.5.1] - 2026-09-01 ### Fixed