release: v0.14.1

[jason-famedly]

[0.14.1] - 2026-09-18

This release is to fix a problem in the Publish CI workflow. There is no functional difference compared to the prior
release, v0.14.0. The changelog from that release is copied below

[0.14.0] - 2026-09-17

General Notes

Major refactoring work has gone into this release. Please test before using in a production environment.

Any configuration that included user_id_path in either subsection of the OAuth settings can now remove it as it was
never used, is no longer supported and will be ignored. A potential bug where OAuth related claims that did not
contain relevant data for verifying a User ID would sometimes allow login when username_type was declared has been
fixed. OAuth configs relying only on username_type alone now reject all logins, one of the claims must supply
localpart_path or fq_uid_path.

If you have multiple jwk_* or enc_jwk* declared in the same subsection this is now an error.

An experimental setting has been added that can allow for a list of fully qualified MXID values to be compared against
in an OAuth related claim. Look for alternative_fq_uids_path in the README.md file. This is not recommended for
general use at this time.

Note: The prior behavior of ignoring unknown configuration changes will change in the future. Check your configuration
for options that do not actually exist in advance.

Miscellaneous Tasks

• bump: Pin publish wheel workflow to a proper commit hash (#95) (Jason Little)
• chore: add tests for registered resources, configs and claims validator (#104) (Soyoung Kim)
• chore: move resources and auth classes into dedicated files (#94) (Soyoung Kim)
• chore: refactor auth checker functions to deduplicate repeated code (#97) (Soyoung Kim)
• chore: refactor http auth (#100) (Soyoung Kim)
• chore: refactor claims validator (#99) (Soyoung Kim)
• chore: refactor config classes (#101) (Soyoung Kim)
• chore: remove duplicated linting in ci, git ignore coverage files and fixes related to new linting (#91) (Soyoung Kim)
• chore: update documentation (#103) (Soyoung Kim)
• chore: use module api to set displayname (#92) (Soyoung Kim)
• chore: use proper exception class (#98) (Soyoung Kim)
• chore: use uv as the dependencies installer (#90) (FrenchGithubUser)
• deps: remove pin on jwcrypto and fix tests to use a proper length token (#87) (Jason Little)

Features

• feat: Allow a returned claim to have a list of alternative fully qualified user ids to check on login. Experimental. (#107) (Jason Little)
• feat: config accepts only one jwk source (#102) (Soyoung Kim)
• feat: drop config option user_id_path (#105) (Soyoung Kim)

Bugfixes

• fix: jwk set and enc jwk now parse string and dict format (#104) (Soyoung Kim)
• fix: reject oauth logins when neither token references a user id (#106) (FrenchGithubUser)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.95%. Comparing base (04a5866) to head (6accce2).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #109   +/-   ##
=======================================
  Coverage   85.95%   85.95%           
=======================================
  Files          13       13           
  Lines         954      954           
  Branches      174      174           
=======================================
  Hits          820      820           
  Misses         82       82           
  Partials       52       52           

Files with missing lines	Coverage Δ
synapse_token_authenticator/token_authenticator.py	73.38% <100.00%> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 04a5866...6accce2. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.