LoginSign Up
← Back to all sparks
S

SuperTokens

INFRA · APIS
Velocity2.5

Open-source user authentication and session management for web and mobile.

supertokens.com ↗

SuperTokens is building v12 in canary around one hard problem: migrating existing users

authenticationaccount-linkinguser-migrationsamlcanary-releasesopen-source
◆Current state
The visible releases are all v12.0.x canary builds — no stable v12 in the window. The work concentrates on account linking and a MIGRATED mode for core user directories, with supporting changes for SAML signature-wrapping protection, an activity_log table, and OpenTelemetry span annotations.
◆Where it's heading
The migration-mode thread is the spine here. First new core user directories were allowed to be created as MIGRATED, then the transition into MIGRATED was blocked while inconsistent users exist, then account linking itself was reopened for exploration. That sequence reads as a team discovering that letting a running deployment switch identity models mid-flight is where the correctness risk lives, and adding guardrails before shipping it. Everything else in the window is scaffolding around that: audit-shaped activity logging, tracing annotations, and CI cleanup.
◆Prediction
A stable v12 looks gated on the account-linking and migration-mode work settling; expect further canaries tightening the conditions under which a deployment is allowed to change modes before any general release.

◆Recent moves

  1. 22d ago

    Migration mode blocked while inconsistent users exist

    Adds the guardrail the migration arc had been missing — a deployment can no longer transition into MIGRATED mode while inconsistent users are present — plus continued account-linking exploration and a tracing annotation tweak. This is the safety valve on the riskiest part of the v12 work.

    View source ↗
  2. 1mo ago

    v12.0.4-canary

    A canary bump with no described changes. Routine churn on the v12 pre-release line rather than movement on the account-linking work.

    View source ↗
  3. 1mo ago

    Activity log table put to use

    Starts writing to an activity_log table, alongside a release-workflow fix. Audit-shaped state is a sensible companion to the migration work — it gives operators a record of what changed while identity models are in flux.

    View source ↗
  4. 1mo ago

    SAML signature-wrapping protection added

    Adds protection against SAML XML signature wrapping, a well-known class of assertion-forgery attack. A single-line release, but it hardens the enterprise SSO path that v12 will ship with.

    View source ↗
  5. 1mo ago

    New core user directories can start in MIGRATED mode

    Allows newly created core user directories to be created as MIGRATED — the opening move of the migration-mode sequence that the later canaries then constrain. Read together, the two releases show the feature being designed and fenced in within a month.

    View source ↗