auth0-deploy-cli 8.33.0 → 8.35.0

package/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.35.0] - 2026-05-22
+
+### Added
+
+- Add `AUTH0_IGNORE_DRY_RUN_FIELDS` config option to exclude specified fields from `--dry-run` diff output per handler type. [#1385]
+- Add hostnames and CIDR fields to network ACL match schema. [#1386]
+- Add `ES384` and `ES512` as valid `dpop_signing_alg` values for OIDC and Okta enterprise connections (GA). [#1391]
+
+### Deprecated
+
+- Deprecate absolute and external file path references in config handlers; a warning is emitted when detected. Support will be removed in a future major version. [#1392]
+
+### Fixed
+
+- Fix keyword markers in themes not being preserved during default export configuration. [#1387]
+
+## [8.34.0] - 2026-05-11
+
+### Added
+
+- Add support for `authorization_policy` on the Auth0 My Account API resource server, enabling ACR (Authentication Context Class Reference) policy configuration via Deploy CLI. [#1381]
+- Add Google Workspace inbound group sync support to directory provisioning configuration. [#1380]
+
+### Fixed
+
+- Fix keyword replacement mappings (e.g. `##ENV##`) not being applied to `theme.json` during import. [#1379]
+
 ## [8.33.0] - 2026-05-05
 
 ### Added
@@ -1764,7 +1791,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1372]: https://github.com/auth0/auth0-deploy-cli/issues/1372
 [#1374]: https://github.com/auth0/auth0-deploy-cli/issues/1374
 [#1375]: https://github.com/auth0/auth0-deploy-cli/issues/1375
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.33.0...HEAD
+[#1379]: https://github.com/auth0/auth0-deploy-cli/issues/1379
+[#1380]: https://github.com/auth0/auth0-deploy-cli/issues/1380
+[#1381]: https://github.com/auth0/auth0-deploy-cli/issues/1381
+[#1385]: https://github.com/auth0/auth0-deploy-cli/issues/1385
+[#1386]: https://github.com/auth0/auth0-deploy-cli/issues/1386
+[#1387]: https://github.com/auth0/auth0-deploy-cli/issues/1387
+[#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
+[#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...HEAD
+[8.35.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.34.0...v8.35.0
+[8.34.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.33.0...v8.34.0
 [8.33.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.32.0...v8.33.0
 [8.32.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.31.0...v8.32.0
 [8.31.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.30.0...v8.31.0

package/lib/context/directory/handlers/actionModules.js

@@ -26,6 +26,9 @@ function parse(context) {
             // It can be a relative path, so we need to handle both cases.
             const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
             if (fs_extra_1.default.existsSync(unixPath)) {
+                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
+                    `Please update your configuration to use paths relative to the config directory. ` +
+                    `Current absolute path used: ["${module.code}"]`);
                 module.code = context.loadFile(unixPath, moduleFolder);
             }
             else {

package/lib/context/directory/handlers/actions.js

@@ -28,6 +28,9 @@ function parse(context) {
             const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
             if (fs_extra_1.default.existsSync(unixPath)) {
                 // If the Unix-style path exists, load the file from that path
+                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
+                    `Please update your configuration to use paths relative to the config directory. ` +
+                    `Current absolute path used: ["${action.code}"]`);
                 action.code = context.loadFile(unixPath, actionFolder);
             }
             else {

package/lib/context/directory/handlers/databases.js

@@ -8,7 +8,7 @@ const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
 const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
-function getDatabase(folder, mappingOpts) {
+function getDatabase(folder, configRoot, mappingOpts) {
     const metaFile = path_1.default.join(folder, 'database.json');
     const metaData = (() => {
         try {
@@ -40,7 +40,14 @@ function getDatabase(folder, mappingOpts) {
                 logger_1.default.warn('Skipping invalid database configuration: ' + name);
             }
             else {
-                database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.join(folder, script), mappingOpts);
+                const resolvedBase = path_1.default.resolve(configRoot);
+                const toLoad = path_1.default.resolve(folder, script);
+                if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
+                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
+                        `Please update your configuration to use paths relative to the config directory. ` +
+                        `Current absolute path used: ["${script}"]`);
+                }
+                database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }
         });
     }
@@ -55,7 +62,7 @@ function parse(context) {
         .map((f) => path_1.default.join(databaseFolder, f))
         .filter((f) => (0, utils_1.isDirectory)(f));
     const databases = folders
-        .map((f) => getDatabase(f, {
+        .map((f) => getDatabase(f, context.filePath, {
         mappings: context.mappings,
         disableKeywordReplacement: context.disableKeywordReplacement,
     }))

package/lib/context/directory/index.js

@@ -73,6 +73,9 @@ class DirectoryContext {
         if (!(0, utils_1.isFile)(toLoad)) {
             // try load not relative to yaml file
             toLoad = f;
+            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
+                `Please update your configuration to use paths relative to the config directory. ` +
+                `Current absolute path used: ["${f}"]`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/index.js

@@ -47,6 +47,9 @@ class YAMLContext {
         if (!(0, utils_1.isFile)(toLoad)) {
             // try load not relative to yaml file
             toLoad = f;
+            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
+                `Please update your configuration to use paths relative to the config directory. ` +
+                `Current absolute path used: ["${f}"]`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.resolve(toLoad), {
             mappings: this.mappings,

package/lib/keywordPreservation.js

@@ -48,17 +48,22 @@ const getPreservableFieldsFromAssets = (asset, keywordMappings, resourceSpecific
             const specificAddress = resourceIdentifiers.reduce((aggregateAddress, resourceIdentifier) => {
                 resourceSpecificIdentifiers[address];
                 if (resourceIdentifier === undefined)
-                    return ''; // See if this specific resource type has an identifier
+                    return aggregateAddress; // See if this specific resource type has an identifier
                 const identifierFieldValue = arrayItem[resourceIdentifier];
                 if (identifierFieldValue === undefined)
-                    return ''; // See if this specific array item possess the resource-specific identifier
+                    return aggregateAddress; // See if this specific array item possess the resource-specific identifier
                 if (aggregateAddress === '') {
                     return `${resourceIdentifier}=${identifierFieldValue}`;
                 }
                 return `${aggregateAddress}||${resourceIdentifier}=${identifierFieldValue}`;
             }, '');
             if (specificAddress.length === 0) {
-                return [];
+                // No identifiers registered: skip. Identifiers registered but absent from item: fall back to positional index.
+                if (resourceIdentifiers.length === 0) {
+                    return [];
+                }
+                const arrayIndex = asset.indexOf(arrayItem);
+                return (0, exports.getPreservableFieldsFromAssets)(arrayItem, keywordMappings, resourceSpecificIdentifiers, `${address}${shouldRenderDot ? '.' : ''}${arrayIndex}`);
             }
             return (0, exports.getPreservableFieldsFromAssets)(arrayItem, keywordMappings, resourceSpecificIdentifiers, `${address}${shouldRenderDot ? '.' : ''}[${specificAddress}]`);
         })

package/lib/tools/auth0/handlers/connections.d.ts

@@ -18,8 +18,12 @@ export declare const schema: {
                 type: string;
                 additionalProperties: boolean;
                 properties: {
+                    api_enable_groups: {
+                        type: string;
+                    };
                     dpop_signing_alg: {
                         type: string;
+                        enum: string[];
                     };
                     token_endpoint_auth_signing_alg: {
                         type: string;
@@ -122,6 +126,22 @@ export declare const schema: {
                         type: string;
                         description: string;
                     };
+                    synchronize_groups: {
+                        type: string;
+                        enum: ("all" | "off" | "selected")[];
+                    };
+                    synchronized_groups: {
+                        type: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                id: {
+                                    type: string;
+                                };
+                            };
+                            required: string[];
+                        };
+                    };
                 };
             };
         };
@@ -131,7 +151,11 @@ export declare const schema: {
 type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
-    directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically'>;
+    directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
+        synchronized_groups?: Array<{
+            id: string;
+        }>;
+    };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
     proposedChanges: CalculatedChanges;
@@ -203,6 +227,16 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
      * Deletes directory provisioning configuration for a connection.
      */
     private deleteConnectionDirectoryProvisioning;
+    /**
+     * Retrieves all synchronized groups for a connection using checkpoint pagination.
+     */
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
+        id: string;
+    }> | null>;
+    /**
+     * Replaces the synchronized groups for a connection (PUT replace-all semantics).
+     */
+    private updateConnectionSynchronizedGroups;
     /**
      * This function processes directory provisioning for create, update, and conflict operations.
      * Directory provisioning is only supported for google-apps strategy connections.

package/lib/tools/auth0/handlers/connections.js

@@ -56,8 +56,12 @@ const connectionOptionsSchema = {
     type: 'object',
     additionalProperties: true,
     properties: {
+        api_enable_groups: {
+            type: 'boolean',
+        },
         dpop_signing_alg: {
             type: 'string',
+            enum: ['ES256', 'ES384', 'ES512', 'Ed25519'],
         },
         token_endpoint_auth_signing_alg: {
             type: 'string',
@@ -141,6 +145,20 @@ exports.schema = {
                         type: 'boolean',
                         description: 'The field whether periodic automatic synchronization is enabled',
                     },
+                    synchronize_groups: {
+                        type: 'string',
+                        enum: Object.values(auth0_1.Management.SynchronizeGroupsEnum),
+                    },
+                    synchronized_groups: {
+                        type: 'array',
+                        items: {
+                            type: 'object',
+                            properties: {
+                                id: { type: 'string' },
+                            },
+                            required: ['id'],
+                        },
+                    },
                 },
             },
         },
@@ -411,6 +429,7 @@ class ConnectionsHandler extends default_1.default {
         const createPayload = {
             mapping: payload.mapping,
             synchronize_automatically: payload.synchronize_automatically,
+            ...(payload.synchronize_groups && { synchronize_groups: payload.synchronize_groups }),
         };
         await this.client.connections.directoryProvisioning.create(connectionId, createPayload);
         logger_1.default.debug(`Created directory provisioning for connection '${connectionId}'`);
@@ -425,6 +444,7 @@ class ConnectionsHandler extends default_1.default {
         const updatePayload = {
             mapping: payload.mapping,
             synchronize_automatically: payload.synchronize_automatically,
+            ...(payload.synchronize_groups && { synchronize_groups: payload.synchronize_groups }),
         };
         await this.client.connections.directoryProvisioning.update(connectionId, updatePayload);
         logger_1.default.debug(`Updated directory provisioning for connection '${connectionId}'`);
@@ -439,6 +459,40 @@ class ConnectionsHandler extends default_1.default {
         await this.client.connections.directoryProvisioning.delete(connectionId);
         logger_1.default.debug(`Deleted directory provisioning for connection '${connectionId}'`);
     }
+    /**
+     * Retrieves all synchronized groups for a connection using checkpoint pagination.
+     */
+    async getConnectionSynchronizedGroups(connectionId) {
+        try {
+            const groups = [];
+            let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
+            for (const g of page.data ?? [])
+                groups.push({ id: g.id });
+            while (page.hasNextPage?.()) {
+                page = await page.getNextPage();
+                for (const g of page.data ?? [])
+                    groups.push({ id: g.id });
+            }
+            return groups;
+        }
+        catch (error) {
+            const errLog = `Unable to fetch synchronized groups for connection '${connectionId}'. `;
+            const statusCode = error?.statusCode;
+            if (statusCode != null && [403, 404, 501].includes(statusCode)) {
+                const bodyMessage = error instanceof auth0_1.ManagementError ? error.body?.message : error.message;
+                logger_1.default.warn(errLog + bodyMessage);
+                return null;
+            }
+            throw error;
+        }
+    }
+    /**
+     * Replaces the synchronized groups for a connection (PUT replace-all semantics).
+     */
+    async updateConnectionSynchronizedGroups(connectionId, groups) {
+        await this.client.connections.directoryProvisioning.set(connectionId, { groups });
+        logger_1.default.debug(`Updated synchronized groups for connection '${connectionId}'`);
+    }
     /**
      * This function processes directory provisioning for create, update, and conflict operations.
      * Directory provisioning is only supported for google-apps strategy connections.
@@ -513,6 +567,20 @@ class ConnectionsHandler extends default_1.default {
                 .map((i) => this.objString(i))
                 .join('\n')}`);
         }
+        // Process synchronized groups for connections where synchronize_groups === 'selected'
+        const connectionsToSyncGroups = [
+            ...directoryConnectionsToCreate,
+            ...directoryConnectionsToUpdate,
+        ].filter((conn) => conn.directory_provisioning_configuration?.synchronize_groups === 'selected' &&
+            conn.directory_provisioning_configuration?.synchronized_groups !== undefined);
+        await this.client.pool
+            .addEachTask({
+            data: connectionsToSyncGroups,
+            generator: (conn) => this.updateConnectionSynchronizedGroups(conn.id, conn.directory_provisioning_configuration.synchronized_groups).catch((err) => {
+                throw new Error(`Failed to update synchronized groups for connection '${conn.id}':\n${err}`);
+            }),
+        })
+            .promise();
     }
     async getType() {
         if (this.existing)
@@ -552,7 +620,17 @@ class ConnectionsHandler extends default_1.default {
                         connection.directory_provisioning_configuration = {
                             mapping: dirProvConfig.mapping,
                             synchronize_automatically: dirProvConfig.synchronize_automatically,
+                            ...(dirProvConfig.synchronize_groups && {
+                                synchronize_groups: dirProvConfig.synchronize_groups,
+                            }),
                         };
+                        if (dirProvConfig.synchronize_groups === 'selected') {
+                            const syncedGroups = await this.getConnectionSynchronizedGroups(con.id);
+                            if (syncedGroups?.length) {
+                                connection.directory_provisioning_configuration.synchronized_groups =
+                                    syncedGroups;
+                            }
+                        }
                     }
                 }
                 return { index, connection };

package/lib/tools/auth0/handlers/default.d.ts

@@ -42,6 +42,13 @@ export default class APIHandler {
         };
         ignoreDryRunFields: APIHandler['ignoreDryRunFields'];
     });
+    /**
+     * Returns the effective `ignoreDryRunFields` for this handler, merging the
+     * handler's hardcoded defaults with any user-supplied entries from the
+     * `AUTH0_IGNORE_DRY_RUN_FIELDS[<type>]` config key. Read lazily so that the
+     * constructor remains free of config-provider invocations.
+     */
+    getEffectiveIgnoreDryRunFields(): string[];
     getClientFN(fn: ApiMethodOverride): Function;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;

package/lib/tools/auth0/handlers/default.js

@@ -88,6 +88,25 @@ class APIHandler {
         this.created = 0;
         this.deleted = 0;
     }
+    /**
+     * Returns the effective `ignoreDryRunFields` for this handler, merging the
+     * handler's hardcoded defaults with any user-supplied entries from the
+     * `AUTH0_IGNORE_DRY_RUN_FIELDS[<type>]` config key. Read lazily so that the
+     * constructor remains free of config-provider invocations.
+     */
+    getEffectiveIgnoreDryRunFields() {
+        let configured = [];
+        try {
+            const map = this.config('AUTH0_IGNORE_DRY_RUN_FIELDS');
+            if (map && Array.isArray(map[this.type])) {
+                configured = map[this.type];
+            }
+        }
+        catch {
+            configured = [];
+        }
+        return [...this.ignoreDryRunFields, ...configured].filter((field, index, allFields) => allFields.indexOf(field) === index);
+    }
     getClientFN(fn) {
         if (typeof fn === 'string') {
             const client = this.client[this.type];
@@ -194,7 +213,7 @@ class APIHandler {
                 // @ts-ignore TODO: investigate what happens when `existing` is null
                 existing,
                 identifiers: this.identifiers,
-                ignoreDryRunFields: this.ignoreDryRunFields,
+                ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
             });
         }
         // if we are not in dry run mode, calculate the changes
@@ -227,7 +246,7 @@ class APIHandler {
             // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
-            ignoreDryRunFields: this.ignoreDryRunFields,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });
     }
     async validate(assets) {

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -150,6 +150,27 @@ export declare const schema: {
                                     minItems: number;
                                     maxItems: number;
                                 };
+                                hostnames: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
+                                connecting_ipv4_cidrs: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
+                                connecting_ipv6_cidrs: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -228,6 +249,27 @@ export declare const schema: {
                                     minItems: number;
                                     maxItems: number;
                                 };
+                                hostnames: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
+                                connecting_ipv4_cidrs: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
+                                connecting_ipv6_cidrs: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                    uniqueItems: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };

package/lib/tools/auth0/handlers/networkACLs.js

@@ -133,6 +133,27 @@ const MatchSchema = {
             minItems: 1,
             maxItems: 10,
         },
+        hostnames: {
+            type: 'array',
+            items: {
+                type: 'string',
+            },
+            uniqueItems: true,
+        },
+        connecting_ipv4_cidrs: {
+            type: 'array',
+            items: {
+                type: 'string',
+            },
+            uniqueItems: true,
+        },
+        connecting_ipv6_cidrs: {
+            type: 'array',
+            items: {
+                type: 'string',
+            },
+            uniqueItems: true,
+        },
     },
     additionalProperties: false,
 };

package/lib/tools/auth0/handlers/resourceServers.js

@@ -117,6 +117,7 @@ class ResourceServersHandler extends default_1.default {
                     'identifier',
                     'id',
                     'is_system',
+                    'authorization_policy',
                 ];
                 const sanitized = {};
                 allowedKeys.forEach((key) => {
@@ -168,6 +169,7 @@ class ResourceServersHandler extends default_1.default {
                 proof_of_possession: update.proof_of_possession,
                 skip_consent_for_verifiable_first_party_clients: update.skip_consent_for_verifiable_first_party_clients,
                 subject_type_authorization: update.subject_type_authorization,
+                authorization_policy: update.authorization_policy,
             };
             return this.client.resourceServers.update(id, updateFields);
         }

package/lib/tools/auth0/handlers/themes.js

@@ -464,6 +464,7 @@ class ThemesHandler extends default_1.default {
             ...options,
             type: 'themes',
             id: 'themeId',
+            identifiers: ['themeId'],
         });
     }
     objString(theme) {

package/lib/types.d.ts

@@ -76,6 +76,9 @@ export type Config = {
     AUTH0_DRY_RUN?: boolean | 'preview';
     AUTH0_DRY_RUN_INTERACTIVE?: boolean;
     AUTH0_DRY_RUN_APPLY?: boolean;
+    AUTH0_IGNORE_DRY_RUN_FIELDS?: {
+        [handlerType: string]: string[];
+    };
     EXCLUDED_PROPS?: {
         [key: string]: string[];
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.33.0",
+  "version": "8.35.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -33,7 +33,7 @@
   "readme": "README.md",
   "homepage": "https://github.com/auth0/auth0-deploy-cli#readme",
   "dependencies": {
-    "@clack/prompts": "1.2.0",
+    "@clack/prompts": "1.3.0",
     "ajv": "^6.12.6",
     "chalk": "5.6.2",
     "auth0": "^5.9.0",