Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: exceptionless/Exceptionless
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v8.10.0
Choose a base ref
...
head repository: exceptionless/Exceptionless
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v8.10.1
Choose a head ref
  • 1 commit
  • 13 files changed
  • 2 contributors

Commits on Nov 5, 2026

  1. Hotfix 8.10.1: Fix MCP sign-in for self-registered clients (#2722) 

    * Patch System.Security.Cryptography.Pkcs for .NET advisories (#2662)

(cherry picked from commit 71e779d)

* Fix build failures from vulnerable MessagePack dependency (#2671)

* Patch MessagePack dependency to restore secure builds

* Include remaining MessagePack 2.5 security fixes

(cherry picked from commit fa3590a)

* Explain OAuth client scope consent errors (#2638)

* Explain OAuth client scope consent failures

* Revalidate consent state when the authorization query changes

* Exercise live OAuth administrator consent and refresh flow

* Clarify validated OAuth consent controls and reuse problem messages

* Use concrete membership collection in OAuth regression test

* Address OAuth consent error handling review

(cherry picked from commit 731b471)

* Let users grant every scope to self-registered OAuth clients

MCP clients request every scope discovery advertises, but a dynamically
registered client was stored without stacks:write. Consent rejected the
whole request with invalid_scope, so the client could never be approved.

A self-registered client chooses its own scopes and could register again
with all of them, so that list restricts nothing. Those clients may now
request any supported scope, and the user's consent limits the grant.
Scopes an administrator saved stay enforced: consent offers only the
allowed ones and the final authorization request is still strict.

(cherry picked from commit 190f6d7)

* Adapt consent browser tests to the 8.10 application paths

The consent tests from #2638 assume the Svelte application at the site
root, which landed after 8.10. Point the mocked consent test at /next and
remove the live consent test, which also depends on metadata routes and
API origin handling this branch does not have. Remove the validation test
cases that depend on a validation change from #2608 and format the file.

* Keep administrator settings when client metadata changes

A metadata refresh overwrote an administrator's saved settings and reset
UpdatedByUserId, which made the application count as self-registered and
lifted its scope restriction. Skip the refresh once an administrator has
saved the application.

(cherry picked from commit 6690fdb)

* Fix website build Deno compatibility (#2599)

---------

Co-authored-by: Blake Niemyjski <bniemyjski@gmail.com>
    @ejsmith @niemyjski
    ejsmith and niemyjski authored Nov 5, 2026
    Configuration menu
    Copy the full SHA
    698830e View commit details
    Browse the repository at this point in the history
Loading
⌂ 换网址