auth0-deploy-cli 8.42.0 → 8.44.0

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.44.0] - 2026-08-26
+
+### Added
+
+- Support `third_party_client_access` and `cross_app_access_resource_app` on clients and connections. [#1471]
+
+### Fixed
+
+- Warn on path traversal in file references and fix double-path resolution in YAML connections handler. [#1477]
+- Strip `form_submission_mode` and `form_submission_behavior` from `bruteForceProtection` on export and import. [#1476]
+- Include empty credentials for custom phone provider on import and export to prevent 400 errors. [#1474]
+- Preserve keyword placeholder strings for all email provider credentials. [#1470]
+- Preserve `idpinitiated.enabled:false` on SAML connection export instead of emitting `undefined_clientId`. [#1465]
+- Apply 429 backoff to organization connection writes to prevent rate-limit failures. [#1464]
+- Resolve dry-run reporting bugs across multiple asset types. [#1462]
+- Skip organization PATCH when no top-level properties have changed. [#1461]
+- Sort `attackProtection` arrays on export to prevent spurious diffs. [#1460]
+
+## [8.43.0] - 2026-08-12
+
+### Added
+
+- Add org-to-app entitlement (EA) support for organizations. [#1454]
+- Support full group metadata for Google Workspace directory sync (GA). [#1456]
+
+### Fixed
+
+- Create phone templates on import instead of skipping when they have no ID. [#1457]
+- Address path traversal vulnerability and false warnings in config file handlers. [#1449]
+- Exclude org-scoped roles from tenant export by filtering `type='tenant'`. [#1453]
+- Strip read-only field from roles to fix export/import round-trip. [#1445]
+
 ## [8.42.0] - 2026-07-30
 
 ### Added
@@ -1907,7 +1939,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1436]: https://github.com/auth0/auth0-deploy-cli/issues/1436
 [#1437]: https://github.com/auth0/auth0-deploy-cli/issues/1437
 [#1438]: https://github.com/auth0/auth0-deploy-cli/issues/1438
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...HEAD
+[#1445]: https://github.com/auth0/auth0-deploy-cli/issues/1445
+[#1449]: https://github.com/auth0/auth0-deploy-cli/issues/1449
+[#1453]: https://github.com/auth0/auth0-deploy-cli/issues/1453
+[#1454]: https://github.com/auth0/auth0-deploy-cli/issues/1454
+[#1456]: https://github.com/auth0/auth0-deploy-cli/issues/1456
+[#1457]: https://github.com/auth0/auth0-deploy-cli/issues/1457
+[#1460]: https://github.com/auth0/auth0-deploy-cli/issues/1460
+[#1461]: https://github.com/auth0/auth0-deploy-cli/issues/1461
+[#1462]: https://github.com/auth0/auth0-deploy-cli/issues/1462
+[#1464]: https://github.com/auth0/auth0-deploy-cli/issues/1464
+[#1465]: https://github.com/auth0/auth0-deploy-cli/issues/1465
+[#1470]: https://github.com/auth0/auth0-deploy-cli/issues/1470
+[#1471]: https://github.com/auth0/auth0-deploy-cli/issues/1471
+[#1474]: https://github.com/auth0/auth0-deploy-cli/issues/1474
+[#1476]: https://github.com/auth0/auth0-deploy-cli/issues/1476
+[#1477]: https://github.com/auth0/auth0-deploy-cli/issues/1477
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...HEAD
+[8.44.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...v8.44.0
+[8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
 [8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
 [8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0

package/lib/context/defaults.d.ts

@@ -6,4 +6,11 @@ export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
 export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function eventStreamDefaults(eventStreams: any[], config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any[];
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+export declare function sortAttackProtectionArrays(attackProtection: AttackProtection): AttackProtection;
 export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -6,6 +6,7 @@ exports.phoneTemplatesDefaults = phoneTemplatesDefaults;
 exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
 exports.eventStreamDefaults = eventStreamDefaults;
+exports.sortAttackProtectionArrays = sortAttackProtectionArrays;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
 // env vars arrive as strings, so check both forms
@@ -22,45 +23,57 @@ function emailProviderDefaults(emailProvider, config) {
     // Add placeholder for credentials as they cannot be exported
     const { name } = updated;
     if (apiKeyProviders.includes(name)) {
-        updated.credentials = {
-            api_key: `##${name.toUpperCase()}_API_KEY##`,
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                api_key: `##${name.toUpperCase()}_API_KEY##`,
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'smtp') {
-        // This is to mask smtp_user to '##SMTP_USER##'
-        if (updated.credentials && 'smtp_user' in updated.credentials) {
-            delete updated.credentials.smtp_user;
+        // If credentials is a keyword placeholder string (e.g. @@SMTP_CREDENTIALS@@), preserve it as-is.
+        // The `in` operator requires an object and would throw a TypeError on a string.
+        if (typeof updated.credentials !== 'string') {
+            // This is to mask smtp_user to '##SMTP_USER##'
+            if (updated.credentials && 'smtp_user' in updated.credentials) {
+                delete updated.credentials.smtp_user;
+            }
+            updated.credentials = {
+                smtp_host: '##SMTP_HOSTNAME##',
+                smtp_port: '##SMTP_PORT##',
+                smtp_user: '##SMTP_USER##',
+                smtp_pass: '##SMTP_PASS##',
+                ...(updated.credentials || {}),
+            };
         }
-        updated.credentials = {
-            smtp_host: '##SMTP_HOSTNAME##',
-            smtp_port: '##SMTP_PORT##',
-            smtp_user: '##SMTP_USER##',
-            smtp_pass: '##SMTP_PASS##',
-            ...(updated.credentials || {}),
-        };
     }
     if (name === 'ses') {
-        updated.credentials = {
-            accessKeyId: '##SES_ACCESS_KEY_ID##',
-            secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
-            region: '##SES_AWS_REGION##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                accessKeyId: '##SES_ACCESS_KEY_ID##',
+                secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
+                region: '##SES_AWS_REGION##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'azure_cs') {
-        updated.credentials = {
-            connectionString: '##AZURE_CS_CONNECTION_KEY##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                connectionString: '##AZURE_CS_CONNECTION_KEY##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'ms365') {
-        updated.credentials = {
-            tenantId: '##MS365_TENANT_ID##',
-            clientId: '##MS365_CLIENT_ID##',
-            clientSecret: '##MS365_CLIENT_SECRET##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                tenantId: '##MS365_TENANT_ID##',
+                clientId: '##MS365_CLIENT_ID##',
+                clientSecret: '##MS365_CLIENT_SECRET##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     return updated;
 }
@@ -87,6 +100,12 @@ function phoneProviderDefaults(phoneProvider) {
             auth_token: `##${name.toUpperCase()}_AUTH_TOKEN##`,
         };
     }
+    else if (name === 'custom') {
+        // The `custom` provider has no exportable secrets, but the API requires a
+        // `credentials` object on import even when empty. Emit an empty object so
+        // exported configs round-trip cleanly.
+        updated.credentials = {};
+    }
     return updated;
 }
 function phoneTemplatesDefaults(phoneTemplate) {
@@ -193,6 +212,31 @@ function eventStreamDefaults(eventStreams, config) {
         };
     });
 }
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+function sortAttackProtectionArrays(attackProtection) {
+    const sortArraysDeep = (value) => {
+        if (Array.isArray(value)) {
+            const isPrimitiveArray = value.every((item) => item === null || typeof item !== 'object');
+            if (isPrimitiveArray) {
+                value.sort();
+            }
+            else {
+                value.forEach(sortArraysDeep);
+            }
+            return;
+        }
+        if (value && typeof value === 'object') {
+            Object.values(value).forEach(sortArraysDeep);
+        }
+    };
+    sortArraysDeep(attackProtection);
+    return attackProtection;
+}
 function attackProtectionDefaults(attackProtection, config) {
     if (isExportSecrets(config))
         return attackProtection;

package/lib/context/directory/handlers/actionModules.js

@@ -20,20 +20,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
         if (module.code) {
-            // The `module.code` can be a file path. It needs to be loaded.
-            // It can be a relative path, so we need to handle both cases.
-            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${module.code}"]`);
-                module.code = context.loadFile(unixPath, moduleFolder);
-            }
-            else {
-                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
+            const normalizedCode = module.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${module.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            module.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -22,21 +22,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const actionFolder = path_1.default.join(tools_1.constants.ACTIONS_DIRECTORY, `${action.name}`);
         if (action.code) {
-            // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
-            const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                // If the Unix-style path exists, load the file from that path
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${action.code}"]`);
-                action.code = context.loadFile(unixPath, actionFolder);
-            }
-            else {
-                // Otherwise, load the file from the context's file path
-                action.code = context.loadFile(path_1.default.join(context.filePath, action.code), actionFolder);
+            const normalizedCode = action.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${action.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            action.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return action;
     });

package/lib/context/directory/handlers/attackProtection.js

@@ -65,7 +65,7 @@ async function dump(context) {
         return;
     const files = attackProtectionFiles(context.filePath);
     fs_extra_1.default.ensureDirSync(files.directory);
-    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtection, context.config);
+    const maskedAttackProtection = (0, defaults_1.sortAttackProtectionArrays)((0, defaults_1.attackProtectionDefaults)(attackProtection, context.config));
     if (maskedAttackProtection.botDetection) {
         (0, utils_1.dumpJSON)(files.botDetection, maskedAttackProtection.botDetection);
     }

package/lib/context/directory/handlers/branding.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 function parse(context) {
     const brandingDirectory = path_1.default.join(context.filePath, tools_1.constants.BRANDING_DIRECTORY);
@@ -31,7 +32,14 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(definition.body);
-        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.join(brandingTemplatesFolder, ...normalizedPathArray), {
+        const resolvedBodyFile = path_1.default.resolve(brandingTemplatesFolder, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.filePath);
+        if (!resolvedBodyFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${definition.body}" resolves to "${resolvedBodyFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
+        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedBodyFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,
         });

package/lib/context/directory/handlers/clients.js

@@ -20,9 +20,15 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         if (client.custom_login_page) {
-            const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
-            if ((0, utils_1.isFile)(htmlFileName)) {
-                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedLoginPage = path_1.default.resolve(clientsFolder, client.custom_login_page);
+            if ((0, utils_1.isFile)(resolvedLoginPage)) {
+                if (!resolvedLoginPage.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Path "${client.custom_login_page}" resolves to "${resolvedLoginPage}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
+                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(resolvedLoginPage, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,
                 });

package/lib/context/directory/handlers/connections.js

@@ -23,11 +23,17 @@ function parse(context) {
         });
         if (connection.strategy === 'email') {
             (0, utils_1.ensureProp)(connection, 'options.email.body');
-            const htmlFileName = path_1.default.join(connectionsFolder, connection.options.email.body);
-            if (!(0, utils_1.isFile)(htmlFileName)) {
-                throw new Error(`Passwordless email template purportedly located at ${htmlFileName} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedHtmlFile = path_1.default.resolve(connectionsFolder, connection.options.email.body);
+            if (!(0, utils_1.isFile)(resolvedHtmlFile)) {
+                throw new Error(`Passwordless email template purportedly located at ${resolvedHtmlFile} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
             }
-            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            if (!resolvedHtmlFile.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${connection.options.email.body}" resolves to "${resolvedHtmlFile}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedHtmlFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             });

package/lib/context/directory/handlers/databases.js

@@ -41,11 +41,11 @@ function getDatabase(folder, configRoot, mappingOpts) {
             }
             else {
                 const resolvedBase = path_1.default.resolve(configRoot);
-                const toLoad = path_1.default.resolve(folder, script);
+                const toLoad = path_1.default.resolve(folder, script.replace(/\\/g, '/'));
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                        `Please update your configuration to use paths relative to the config directory. ` +
-                        `Current absolute path used: ["${script}"]`);
+                    logger_1.default.warn(`Path "${script}" resolves to "${toLoad}" which is outside the config directory "${resolvedBase}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/handlers/emailTemplates.js

@@ -34,6 +34,15 @@ function parse(context) {
             logger_1.default.warn(`Skipping email template file ${meta.body} as missing the corresponding '.json' file`);
             return [];
         }
+        if (meta.body !== undefined) {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedTemplatePath = path_1.default.resolve(templateFilePath);
+            if (!resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Email template body path "${meta.body}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+        }
         return {
             ...meta,
             body: (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${hook.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/prompts.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = require("fs-extra");
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 const getPromptsDirectory = (filePath) => path_1.default.join(filePath, tools_1.constants.PROMPTS_DIRECTORY);
 const getPromptsSettingsFile = (promptsDirectory) => path_1.default.join(promptsDirectory, 'prompts.json');
@@ -46,9 +47,16 @@ function parse(context) {
             const screensObject = screensArray[0];
             acc[promptName] = Object.entries(screensObject).reduce((screenAcc, [screenName, items]) => {
                 screenAcc[screenName] = items.reduce((insertionAcc, { name, template }) => {
-                    const templateFilePath = path_1.default.join(promptsDirectory, template);
-                    insertionAcc[name] = (0, utils_1.isFile)(templateFilePath)
-                        ? (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {
+                    const configRoot = path_1.default.resolve(context.filePath);
+                    const resolvedTemplatePath = path_1.default.resolve(promptsDirectory, template);
+                    if ((0, utils_1.isFile)(resolvedTemplatePath) &&
+                        !resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                        logger_1.default.warn(`Prompt partial template "${template}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                            `This will be blocked as an error in the next major release. ` +
+                            `Move the file inside your config directory.`);
+                    }
+                    insertionAcc[name] = (0, utils_1.isFile)(resolvedTemplatePath)
+                        ? (0, tools_1.loadFileAndReplaceKeywords)(resolvedTemplatePath, {
                             mappings: context.mappings,
                             disableKeywordReplacement: context.disableKeywordReplacement,
                         }).trim()

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${rule.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,14 +68,13 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const basePath = path.join(this.filePath, folder);
-        let toLoad = path.join(basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path.sep)) {
+            logger_1.default.warn(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/handlers/attackProtection.js

@@ -27,7 +27,7 @@ async function dump(context) {
     }
     const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
-        attackProtection: maskedAttackProtection,
+        attackProtection: (0, defaults_1.sortAttackProtectionArrays)(maskedAttackProtection),
     };
 }
 const attackProtectionHandler = {

package/lib/context/yaml/handlers/branding.js

@@ -18,9 +18,16 @@ async function parse(context) {
     const parsedTemplates = templates.map((templateDefinition) => {
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(templateDefinition.body);
         const markupFile = path_1.default.join(context.basePath, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedMarkupFile = path_1.default.resolve(markupFile);
+        if (!resolvedMarkupFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${templateDefinition.body}" resolves to "${resolvedMarkupFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         return {
             template: templateDefinition.template,
-            body: (0, tools_1.loadFileAndReplaceKeywords)(markupFile, {
+            body: (0, tools_1.loadFileAndReplaceKeywords)(resolvedMarkupFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),

package/lib/context/yaml/handlers/clients.js

@@ -21,7 +21,10 @@ async function parse(context) {
                 if (client.custom_login_page) {
                     const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
                     if ((0, utils_1.isFile)(htmlFileName)) {
-                        client.custom_login_page = context.loadFile(htmlFileName);
+                        // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                        // Passing htmlFileName (which already includes basePath) would cause double resolution
+                        // when basePath is a relative path (e.g. when AUTH0_INPUT_FILE is a relative path).
+                        client.custom_login_page = context.loadFile(path_1.default.join(tools_1.constants.CLIENTS_DIRECTORY, client.custom_login_page));
                     }
                 }
                 return client;

package/lib/context/yaml/handlers/connections.js

@@ -26,7 +26,9 @@ async function parse(context) {
                         logger_1.default.error(missingTemplateErrorMessage);
                         throw new Error(missingTemplateErrorMessage);
                     }
-                    connection.options.email.body = context.loadFile(htmlFileName);
+                    // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                    // Passing htmlFileName (which already includes basePath) would cause double resolution.
+                    connection.options.email.body = context.loadFile(path_1.default.join(tools_1.constants.CONNECTIONS_DIRECTORY, connection.options.email.body));
                 }
                 return connection;
             }),

package/lib/context/yaml/handlers/flows.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { flows: null };
     const parsedFlows = flows.map((flow) => {
         const flowFile = path_1.default.join(context.basePath, flow.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFlowFile = path_1.default.resolve(flowFile);
+        if (!resolvedFlowFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Flow body file "${flow.body}" resolves to "${resolvedFlowFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFlowBody = (0, utils_1.loadJSON)(flowFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/forms.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { forms: null };
     const parsedForms = forms.map((form) => {
         const formFile = path_1.default.join(context.basePath, form.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFormFile = path_1.default.resolve(formFile);
+        if (!resolvedFormFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Form body file "${form.body}" resolves to "${resolvedFormFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFormBody = (0, utils_1.loadJSON)(formFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/prompts.js

@@ -19,7 +19,13 @@ const loadScreenRenderers = (context, screenRenderArray) => {
         Object.entries(screens).forEach(([, fileName]) => {
             const filePath = fileName;
             try {
-                const rendererFile = path_1.default.join(context.basePath, filePath);
+                const configRoot = path_1.default.resolve(context.basePath);
+                const rendererFile = path_1.default.resolve(context.basePath, filePath);
+                if (!rendererFile.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Screen renderer file "${filePath}" resolves to "${rendererFile}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
                 const rendererData = (0, utils_1.loadJSON)(rendererFile, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,