v12.2.0

12.2.0 (2026-11-04)

Features

• connect: add exchangeToken for RFC 8693 token exchange (#1741) (fbb9a06)
• pipes: Return state from authorizeDataIntegration (#1750) (fcc2777)

Bug Fixes

• events: Remove the unsupported order option from listEvents (#1747) (0222f79)
• Reuse the first page in autoPagination (#1748) (51b6f0b)
• user-management: Reject non-user access tokens in session cookies (#1753) (fab1ea5)

v12.1.0

12.1.0 (2026-10-30)

Features

• pipes: regenerate Pipes from the spec and add finishConnection (#1745) (7e19feb)

Bug Fixes

• detect Bun and Deno before Node (#1744) (432d507)
• widgets: Add missing widget token scopes (#1742) (f8b771d)

v12.0.0

12.0.0 (2026-10-23)

⚠ BREAKING CHANGES

• sso: Make nullable Profile fields nullable instead of optional (#1737)
• events: Add the 28 event types the spec defines but the SDK lacked (#1739)
• Deserialize API timestamps as Date objects (#1736)
• vault: Remove stale duplicate object interfaces (#1738)
• Align enum and nullable types with the API spec (#1735)
• events: Add UnknownEvent to the Event union (#1734)
• admin-portal: Rename adminEmails to itContactEmails (#1730)
• Port DirectorySync to oagen (#1626)
• feature-flags: Evaluate ordered targeting rules (#1717)

Features

• Add widgets:pipes:manage to WidgetScope type (#1609) (aa38974)
• admin-portal: Rename adminEmails to itContactEmails (#1730) (e988e79)
• Deserialize API timestamps as Date objects (#1736) (5457d95)
• events: Add the 28 event types the spec defines but the SDK lacked (#1739) (b9ffc7e)
• events: Add UnknownEvent to the Event union (#1734) (a6b9c3d)
• events: Type agent blueprint, instance and registration events (#1729) (77590af)
• feature-flags: Evaluate ordered targeting rules (#1717) (1b305bd)
• Port DirectorySync to oagen (#1626) (54ce2fa)
• user-management: Add verifyAccessToken (#1733) (893c926)

Bug Fixes

• Align enum and nullable types with the API spec (#1735) (c7687a4)
• directory-sync: Add name to DirectoryUser (#1731) (5fc7c80)
• drop before cursor on follow-up autoPagination requests (#1720) (14d5e40)
• feature-flags: Keep polling when no error listener is attached (#1728) (6b826e3)
• Prevent throwing an error when succesfully whitelisting someone (#1716) (8e4c639)
• reject malformed and future webhook timestamps (#1723) (ad8bff2)
• sso: Make nullable Profile fields nullable instead of optional (#1737) (6d4bf79)
• user-management: Expose nested user on OrganizationMembership (#1732) (b30f7ba)
• vault: Remove stale duplicate object interfaces (#1738) (0d3c887)

v11.0.0

11.0.0 (2026-09-28)

⚠ BREAKING CHANGES

• pipes: Support organization-owned and multiple connections (#1712)

Features

• pipes: Support organization-owned and multiple connections (#1712) (9c3e40d)

v10.14.0

10.14.0 (2026-09-21)

Features

• Add optional issuer option for session token validation (#1694) (02effa7)
• audit-logs: Add Audit Log Retention methods (#1705) (ab1c464)

Bug Fixes

• ci: harden dep-bump workflow against sed injection (#1709) (6e1e1fe)
• encode caller-supplied path parameters in legacy modules (#1710) (1fe77c6)
• keep request timeouts active while reading response bodies (#1711) (26eaed6)
• reject 5-byte LEB128 encodings that overflow uint32 in decodeUInt32 (#1690) (fb303c9)
• session: return refreshed user and impersonator from refresh() (#1708) (855063b)

v10.13.0

10.13.0 (2026-08-31)

Features

• Add Agent Blueprints API support (#1687) (364e223)
• Add Waitlists API support (#1689) (0faa84f)

v10.12.0

10.12.0 (2026-08-27)

Features

• Add IT Contacts API (#1681) (5237aa2)

Bug Fixes

• events: Type Pipes connected account events (#1686) (b880c76)
• Surface the error field and request ID on 422 exceptions (#1656) (2bc92ef)

v10.11.0

10.11.0 (2026-08-21)

Features

• Evaluate custom targets in the feature flags runtime client (#1674) (f30c3fa)

v10.10.0

10.10.0 (2026-08-13)

Features

• expose authentication method on action contexts (#1671) (6739820)

v10.9.0

10.9.0 (2026-07-30)

Features

• Add linkClaimAttemptToExternalUser to Agents module (#1652) (5e4813f)
• Add user API key methods (#1655) (17e41e0)
• Distinguish transient from terminal failures in CookieSession.refresh() (#1663) (2c570a5)

Bug Fixes

• totp on list-path AuthenticationFactor is now optional to match the API (#1665) (53a506b)
• delete requests drop query params passed via {query: ...} (#1668) (08a8a73)