[ankita10119]

Changes

Path parameters are encoded with encodePathParam, which uses encodeURIComponent and leaves . unchanged. When a path parameter is exactly . or .., URL resolution removes it as a dot segment, so the request (with the Management API token attached) is sent to a different path than the one the method targets. For example, users.roles.list('..') was sent as GET /api/v2/roles, and users.delete('..') as DELETE /api/v2/.

Fix (backport of v7.6.0):

• src/management/core/url/encodePathParam.ts: rejects . and .., throwing the error class passed in (or a plain Error). This file is identical to the one in v7.6.0.
• Generated clients in src/management/api/ (101 files): every core.url.encodePathParam(x) call now passes errors.ManagementError as the second argument, as in v7.6.0. This is the only change in these files, so callers get a ManagementError like any other SDK error.
• src/management/tests/unit/url/encodePathParam.test.ts: new unit tests, identical to v7.6.0.

The check runs while the request path is being built, so a rejected call never sends the request. Values such as ..., a.b, auth0|a.b and %2e%2e are unaffected (%2e%2e is encoded as %252e%252e).

auth0/legacy fix:

• package.json / yarn.lock: auth0-legacy bumped from npm:auth0@^4.37.1 to npm:auth0@^4.37.2. 4.37.2 contains the same fix for the v4 client, so upgrading to this release also fixes the auth0/legacy entrypoint, even for users with an existing lockfile. The lockfile also gains a jose@^4.13.2 entry, which auth0@4.37.x depends on and which was previously missing.

Release workflow (so a 5.x release doesn't become the default install):

• .github/actions/npm-publish/action.yml: the npm dist-tag for stable versions changed from latest to legacy-v5, so publishing 5.x no longer replaces 7.x as npm install auth0.
• .github/actions/release-create/action.yml:
  • added make_latest: false, so the 5.x GitHub release isn't marked as the repo's Latest release
  • bumped softprops/action-gh-release from de2c0eb (Nov 2022, no make_latest input, Node 16) to 5be0e66 (v2.4.2), the same pin used on v4. The older version would silently ignore make_latest.

No endpoints were added, removed or deprecated. The only SDK behaviour change: a call whose path parameter is exactly . or .. now throws ManagementError instead of being sent to a different endpoint.

Alternatives considered:

• Percent-encoding . as %2E. That doesn't work, because WHATWG URL parsing also treats %2e%2e, .%2e and %2e. as .., so these values are rejected instead.
• Changing only encodePathParam.ts (a 1-file diff). That would throw a plain Error instead of ManagementError. The call-site change keeps the error type consistent with v7.6.0 and with existing instanceof ManagementError handling.

References

• Security advisory: GHSA-h4ph-726g-66fc (CVE-2026-126128)
• Same fix on the main line: feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428 (released in v7.6.0)
• v4 fix: fix: reject dot-segment path parameters #1440 (released in v4.37.2)
• npm 11 pin already on v5: fix: pin npm to ^11 to avoid broken npm@12 bundled dependencies #1367

Testing

New unit tests in src/management/tests/unit/url/encodePathParam.test.ts (18 tests):

• . and .. are rejected, and the provided error class is thrown
• valid values are encoded as before (usr_123, a/b, ..., a..b, %2E%2E, "", numbers, booleans, null, undefined)
• encoded values stay in the path when joined with the base URL

With only the dot-segment check disabled, the 3 rejection tests fail.

Verified locally:

• yarn install --frozen-lockfile passes with the updated lockfile, and auth0-legacy resolves to 4.37.2. Its yarn.lock hashes match the 4.37.2 publish log.
• yarn lint (no new warnings), yarn build (CJS and ESM) and yarn lint:package pass
• Prettier check passes on all changed files
• yarn test: 205/205 suites, 4494 passed. The 1 skipped test is a pre-existing it.skip in tests/management/token-provider.test.ts. The wire tests exercise the changed client methods with normal IDs.
• End-to-end check of the built output against a local HTTP server using Node's built-in fetch (Node 18.20.8 and 24.0.1):
  • unpatched 5.14.1: users.roles.list('..') is sent to GET /api/v2/roles and users.delete('..') to DELETE /api/v2/, with the token
  • patched main client (CJS and ESM): .. and . on users.roles.list, users.get, users.delete and roles.get throw ManagementError and nothing is sent; normal IDs such as auth0|a.b are unchanged
  • patched auth0/legacy: users.getRoles({ id: '..' }) and users.delete({ id: '..' }) throw InvalidPathParameterError and nothing is sent; normal IDs are unchanged

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.64%. Comparing base (408ddc2) to head (60ee346).

Additional details and impacted files

@@            Coverage Diff             @@
##               v5    #1441      +/-   ##
==========================================
+ Coverage   89.62%   89.64%   +0.01%     
==========================================
  Files         428      428              
  Lines       19886    19891       +5     
  Branches     9400     9759     +359     
==========================================
+ Hits        17823    17831       +8     
+ Misses       2063     2060       -3     

Flag	Coverage Δ
alltests	89.64% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../management/api/resources/actions/client/Client.ts	88.80% <ø> (ø)
...rces/actions/resources/executions/client/Client.ts	90.69% <ø> (ø)
...sources/actions/resources/modules/client/Client.ts	89.53% <ø> (ø)
...ources/modules/resources/versions/client/Client.ts	90.32% <ø> (ø)
...urces/triggers/resources/bindings/client/Client.ts	89.88% <ø> (ø)
...ources/actions/resources/versions/client/Client.ts	89.83% <ø> (ø)
...esources/anomaly/resources/blocks/client/Client.ts	89.18% <ø> (ø)
...sources/phone/resources/providers/client/Client.ts	88.47% <ø> (ø)
...sources/phone/resources/templates/client/Client.ts	88.35% <ø> (ø)
...sources/branding/resources/themes/client/Client.ts	88.16% <ø> (ø)
... and 92 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[harshithRai]

LGTM! pending auth0-legacy bump post v4 patch. Approving

[harshithRai]

Looks good!
+1