🤖 I have created a release *beep* *boop*
---


##
[2.171.0](v2.170.0...v2.171.0)
(2025-04-14)


### Features

* add sign in with solana (EIP-4361) support
([#1918](#1918))
([d121546](d121546))
* allow invalid config directories
([#1969](#1969))
([6b842f6](6b842f6))
* allow limiting lifespan of low-aal sessions
([#1942](#1942))
([d7a9ca6](d7a9ca6))
* Block specific outgoing mail servers
([#1971](#1971))
([091aef9](091aef9))
* refactor hooks out of api package
([#1976](#1976))
([c5904c0](c5904c0))
* separate web3 rate limits from other `/token?grant_type=...`
([#1985](#1985))
([8b23382](8b23382))


### Bug Fixes

* explicit permisions on actions
([#1978](#1978))
([06e9ead](06e9ead))
* propagate error when when confirming phone
([#1939](#1939))
([e882b42](e882b42))
* redirects must not be to ip addresses
([#1984](#1984))
([347e23a](347e23a))
* sanitize redirect URL (remove fragment, query) before pattern matching
([#1974](#1974))
([ccf20d7](ccf20d7))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Found nothing vulnerable found in actions, just tightening up the
permissions across all our publicly facing repos.

Not clear why pull_request_target is being used. Ready to revert if
needed

🤖 I have created a release *beep* *boop*
---


##
[2.171.0](supabase/auth@v2.170.0...v2.171.0)
(2025-04-14)


### Features

* add sign in with solana (EIP-4361) support
([supabase#1918](supabase#1918))
([d121546](supabase@d121546))
* allow invalid config directories
([supabase#1969](supabase#1969))
([6b842f6](supabase@6b842f6))
* allow limiting lifespan of low-aal sessions
([supabase#1942](supabase#1942))
([d7a9ca6](supabase@d7a9ca6))
* Block specific outgoing mail servers
([supabase#1971](supabase#1971))
([091aef9](supabase@091aef9))
* refactor hooks out of api package
([supabase#1976](supabase#1976))
([c5904c0](supabase@c5904c0))
* separate web3 rate limits from other `/token?grant_type=...`
([supabase#1985](supabase#1985))
([8b23382](supabase@8b23382))


### Bug Fixes

* explicit permisions on actions
([supabase#1978](supabase#1978))
([06e9ead](supabase@06e9ead))
* propagate error when when confirming phone
([supabase#1939](supabase#1939))
([e882b42](supabase@e882b42))
* redirects must not be to ip addresses
([supabase#1984](supabase#1984))
([347e23a](supabase@347e23a))
* sanitize redirect URL (remove fragment, query) before pattern matching
([supabase#1974](supabase#1974))
([ccf20d7](supabase@ccf20d7))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Found nothing vulnerable found in actions, just tightening up the
permissions across all our publicly facing repos.

Not clear why pull_request_target is being used. Ready to revert if
needed

🤖 I have created a release *beep* *boop*
---


##
[2.171.0](v2.170.0...v2.171.0)
(2025-04-14)


### Features

* add sign in with solana (EIP-4361) support
([#1918](#1918))
([d121546](d121546))
* allow invalid config directories
([#1969](#1969))
([6b842f6](6b842f6))
* allow limiting lifespan of low-aal sessions
([#1942](#1942))
([d7a9ca6](d7a9ca6))
* Block specific outgoing mail servers
([#1971](#1971))
([091aef9](091aef9))
* refactor hooks out of api package
([#1976](#1976))
([c5904c0](c5904c0))
* separate web3 rate limits from other `/token?grant_type=...`
([#1985](#1985))
([8b23382](8b23382))


### Bug Fixes

* explicit permisions on actions
([#1978](#1978))
([06e9ead](06e9ead))
* propagate error when when confirming phone
([#1939](#1939))
([e882b42](e882b42))
* redirects must not be to ip addresses
([#1984](#1984))
([347e23a](347e23a))
* sanitize redirect URL (remove fragment, query) before pattern matching
([#1974](#1974))
([ccf20d7](ccf20d7))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Found nothing vulnerable found in actions, just tightening up the
permissions across all our publicly facing repos.

Not clear why pull_request_target is being used. Ready to revert if
needed

🤖 I have created a release *beep* *boop*
---


##
[2.171.0](v2.170.0...v2.171.0)
(2025-04-14)


### Features

* add sign in with solana (EIP-4361) support
([#1918](#1918))
([d121546](d121546))
* allow invalid config directories
([#1969](#1969))
([6b842f6](6b842f6))
* allow limiting lifespan of low-aal sessions
([#1942](#1942))
([d7a9ca6](d7a9ca6))
* Block specific outgoing mail servers
([#1971](#1971))
([091aef9](091aef9))
* refactor hooks out of api package
([#1976](#1976))
([c5904c0](c5904c0))
* separate web3 rate limits from other `/token?grant_type=...`
([#1985](#1985))
([8b23382](8b23382))


### Bug Fixes

* explicit permisions on actions
([#1978](#1978))
([06e9ead](06e9ead))
* propagate error when when confirming phone
([#1939](#1939))
([e882b42](e882b42))
* redirects must not be to ip addresses
([#1984](#1984))
([347e23a](347e23a))
* sanitize redirect URL (remove fragment, query) before pattern matching
([#1974](#1974))
([ccf20d7](ccf20d7))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>