@buildbase/sdk 0.0.73 → 0.0.74

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.0.74] - 2026-09-28
+
+### Fixed
+
+- **A signed-out browser no longer keeps authenticating as the previous user.**
+  `getAuthHeaders()` reads the stored session id on every request and has no
+  view of React auth state, so when hydration decided nobody was signed in the
+  id stayed in storage and kept riding on SDK calls. Both give-up branches now
+  clear it: the one where your `getSession` returns nothing, and the one where
+  the id it returned does not resolve to a profile.
+
+  This matters most where the app's cookie is shorter-lived than the BuildBase
+  session behind it - the Next.js starter sets a 7 day cookie against a 30 day
+  session, so the window opens once a month by design. In it the app renders
+  signed out while the SDK still authenticates as whoever was last signed in,
+  which on a shared browser is one person's session in the next person's tab.
+
+  `signOut` already did this; these paths did not.
+
+  Known limit: the id is read per request, so calls issued before hydration
+  resolves still carry it. Against the starter that is three org-scoped public
+  endpoints (`plans`, `credit-packages`, `settings`) which return the same bytes
+  to everyone; no authenticated request carries it. Closing that window needs
+  requests gated on hydration, which is a behaviour change for every consumer.
+
 ## [0.0.73] - 2026-09-28
 
 ### Added