Skip to content

storyden

v1.26.10 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo Communication & Email
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

discussion-board discussion-forum forum forum-application forum-site forum-software
+1 more
forums

Affected surfaces

auth

Summary

AI summary

Adds DCR and CIMD integration enabling seamless third‑party OAuth2 connections, such as ChatGPT linking to Storyden.

Changes in this release

Feature Medium

Adds Client ID Metadata Document (CIMD) support for stable client lookup.

Adds Client ID Metadata Document (CIMD) support for stable client lookup.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds OAuth authorization server metadata endpoint per RFC 8414.

Adds OAuth authorization server metadata endpoint per RFC 8414.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds protected resource metadata support per RFC 9728.

Adds protected resource metadata support per RFC 9728.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds OIDC nonce to the authorization code flow for security.

Adds OIDC nonce to the authorization code flow for security.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds background cleanup job for unused DCR clients.

Adds background cleanup job for unused DCR clients.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Feature Medium

Adds OAuth2 Dynamic Client Registration (DCR) support.

Adds OAuth2 Dynamic Client Registration (DCR) support.

Source: llm_adapter@2026-06-11

Confidence: low

 —
Feature Low

Implements RFC 7591 Dynamic Client Registration (DCR) support for pre‑registered clients.

Implements RFC 7591 Dynamic Client Registration (DCR) support for pre‑registered clients.

Source: granite4.1:30b@2026-06-11-audit

Confidence: low

 —
Bugfix Medium

Delivers OAuth authorize errors via redirect instead of opaque responses.

Delivers OAuth authorize errors via redirect instead of opaque responses.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Bugfix Medium

Revokes refresh‑token family on reuse to prevent token replay.

Revokes refresh‑token family on reuse to prevent token replay.

Source: llm_adapter@2026-06-11

Confidence: high

 —
Full changelog

A mini release with a big bunch of boring OAuth2 things (that actually unlock a bunch of cool things!)

Auth Acronym Soup

OAuth2, OIDC, DCR and CIMD... I think that's all of them? Anyway, this is mostly for wiring your Storyden instance up to MCP clients and other third party integrations. Outside of integrating Storyden with your own software and systems, this also lets you grant access to the MCP to ChatGPT, Claude and other SaaS agents:

So what are DCR and CIMD? These essentially allow third parties such as ChatGPT share information with Storyden and vice versa so they can handshake the OAuth2 setup process a bit more smoothly. The end result is a simple "Connect" button click, grant permissions and get going.

DCR and CIMD are early, enable at your own risk. CIMD is also not a finalised standard so the spec (and thus Storyden's implementation) are subject to change.

For example, setting up a Storyden instance's MCP server in ChatGPT is literally:

  1. Paste your URL
  2. Click "Create"
  3. Click "Sign in with "

This is the magic of DCR and CIMD working together. DCR lets ChatGPT create an OAuth2 client ahead of time via /oauth/register and CIMD lets Storyden look up the stable client ID of ChatGPT as well as other metadata.

You can read more about DCR and CIMD support in the documentation.

Related commits:

  • add RFC 8414 OAuth authorization server metadata endpoint by @Southclaws in https://github.com/Southclaws/storyden/pull/751
  • implement rfc 9728 protected resource metadata by @Southclaws in https://github.com/Southclaws/storyden/pull/760
  • Implement RFC 7591 OAuth 2.0 Dynamic Client Registration by @Southclaws in https://github.com/Southclaws/storyden/pull/759
  • Add background cleanup job for unused DCR clients by @Southclaws in https://github.com/Southclaws/storyden/pull/761
  • add Client ID Metadata Document (CIMD) support by @Southclaws in https://github.com/Southclaws/storyden/pull/758
  • revoke refresh-token family on reuse by @Southclaws in https://github.com/Southclaws/storyden/pull/765
  • deliver OAuth authorize errors via redirect by @Southclaws in https://github.com/Southclaws/storyden/pull/763
  • add OIDC nonce to the authorization code flow by @Southclaws in https://github.com/Southclaws/storyden/pull/764

Full Changelog: https://github.com/Southclaws/storyden/compare/v1.26.9...v1.26.10

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track storyden

Get notified when new releases ship.

Sign up free

About storyden

With a fresh new take on traditional bulletin board forum software, Storyden is a modern, secure and extensible platform for building communities.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]