Add a phone number while setting up SMS MFA​

Until now, SMS MFA setup needed a phone already on the account. With signup.verificationMethod: 'email' (or a social signup) there is none, so a user forced into MFA setup who picked SMS hit PHONE_REQUIRED and had no way forward short of finishing sign-in another way and editing their profile.

Dates now say which timezone they're in​

Notification email timestamps ({{timestampFormatted}}) rendered a bare date and time with nothing to say whether it was the recipient's time, the server's, or UTC:

When: 11 Sept 2026, 1:47 pm

Sign in with Microsoft​

@nauth-toolkit/social-microsoft adds Entra ID (formerly Azure AD). A Microsoft 365 subscription is Entra ID, so "sign in with Microsoft" and "SSO against our M365 tenant" are the same OIDC flow — there is no separate SSO product to integrate with. One config value decides which population can sign in.

nauth migrations connected without TLS​

Schema migrations run on their own DataSource, built from your connection settings so that your migrations are never touched. It copied your credentials — host, port, user, password, database, extra — but not ssl. Every migration run since the isolated DataSource shipped therefore opened an unencrypted connection, on both Postgres and MySQL, regardless of the TLS settings on your own pool.

Social users could not set a password on NestJS​

POST /auth/social/set-password answered 500 AuthService is not available on every NestJS deployment, for as long as the route has existed. Express and Fastify were fine.

Your own GeoIP mirror​

MaxMind rate-limits its download API per licence key. Run enough containers and every one of them downloads on boot, the budget runs out, and the instances that lose start with no geolocation data — which quietly disables adaptive MFA risk factors rather than failing loudly.

Point the toolkit at a copy you control instead. No MaxMind credentials are involved at all:

client.admin.setPassword() could not succeed​

The frontend SDK posted the target user as identifier; the route has always expected sub. Unknown fields are stripped before validation runs, so every call came back as a 400 complaining about sub — a field the caller never sent.

Someone can change your phone number and switch off your MFA​

Changing a phone number is more destructive than it looks. nauth-toolkit clears the verified flag, deletes every SMS MFA device bound to the old number, and — if SMS was the last factor — switches MFA off entirely.

Until this release, none of that reached the account owner. It was recorded in the audit table and nowhere else.

Security​

This release contains several security fixes across the core, the NestJS adapter and the Angular client. Upgrading to v0.7.0 is strongly recommended.

Fixed​

• MySQL returned numbers where the API promises booleans. If you run nauth on MySQL, responses could contain "isActive": 1 instead of true, and any code comparing such a field strictly — yours or the toolkit's — silently took the wrong branch. Postgres was never affected.