release: v0.14.0

[jason-famedly]

[0.14.0] - 2026-09-16

General Notes

Major refactoring work has gone into this release. Please test before using in a production environment.

Any configuration that included user_id_path in either subsection of the OAuth settings can now remove it as it was
never used, is no longer supported and will be ignored. The bug where no User ID parts of any claims from OAuth allowed
login has been fixed.

If you have multiple jwt_* or enc_jwt_* declared in the same subsection this is now an error. Order of priority is:
(1) raw config declaration, (2) jwt|enc_jwt file, (and for enc_jwt only, 3) the enc_jwt endpoint

Note: The prior behavior of ignoring unknown configuration changes will change in the future. Check your configuration
for options that do not actually exist in advance.

Miscellaneous Tasks

• bump: Pin publish wheel workflow to a proper commit hash (#95) (Jason Little)
• chore: add tests for registered resources, configs and claims validator (#104) (Soyoung Kim)
• chore: move resources and auth classes into dedicated files (#94) (Soyoung Kim)
• chore: refactor auth checker functions to deduplicate repeated code (#97) (Soyoung Kim)
• chore: refactor http auth (#100) (Soyoung Kim)
• chore: refactor claims validator (#99) (Soyoung Kim)
• chore: refactor config classes (#101) (Soyoung Kim)
• chore: remove duplicated linting in ci, git ignore coverage files and fixes related to new linting (#91) (Soyoung Kim)
• chore: update documentation (#103) (Soyoung Kim)
• chore: use module api to set displayname (#92) (Soyoung Kim)
• chore: use proper exception class (#98) (Soyoung Kim)
• chore: use uv as the dependencies installer (#90) (FrenchGithubUser)
• deps: remove pin on jwcrypto and fix tests to use a proper length token (#87) (Jason Little)

Features

• feat: Allow a returned claim to have a list of alternative fully qualified user ids to check on login. Experimental. (#107) (Jason Little)
• feat: config accepts only one jwk source (#102) (Soyoung Kim)
• feat: drop config option user_id_path (#105) (Soyoung Kim)

Bugfixes

• fix: jwk set and enc jwk now parse string and dict format (#104) (Soyoung Kim)
• fix: reject oauth logins when neither token references a user id (#106) (FrenchGithubUser)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.95%. Comparing base (ef39c4f) to head (6e4a215).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #108   +/-   ##
=======================================
  Coverage   85.95%   85.95%           
=======================================
  Files          13       13           
  Lines         954      954           
  Branches      174      174           
=======================================
  Hits          820      820           
  Misses         82       82           
  Partials       52       52           

Files with missing lines	Coverage Δ
synapse_token_authenticator/token_authenticator.py	73.38% <100.00%> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ef39c4f...6e4a215. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[FrenchGithubUser]

Also, add a warning for something like "OAuth configs relying on username_type alone now reject all logins, one of the tokens must supply localpart_path or fq_uid_path"