0.15.7

BreakingAll backendsDeprecation

OAuth client_secret_ref requires migration to encrypted storage

In 0.15.7, the OAuth reconciler reads the referenced environment variable, encrypts its value into client_secret_encrypted, removes client_secret_ref from the stored spec, and attempts to delete the environment variable. Direct runtime lookup through client_secret_ref is removed. See #155.

Migration

Before the context-bound credential upgrade, check for stored OAuth specs containing only client_secret_ref. Keep each referenced global project environment variable available through the first upgraded startup.
Startup imports the accepted baseline into context-bound client_secret_encrypted and removes client_secret_ref from the spec. It retains the source variable. If startup fails because a referenced variable is missing, restore the required baseline value before retrying; the upgraded API does not serve requests until migration succeeds.
Verify that the stored spec contains client_secret_encrypted and test its OAuth flow. Remove a retained source variable only after checking that no other consumers need it.
After startup import completes, use the extension editor or seal the secret for its target context for new configurations. Reference-only specs submitted later have no reconciler conversion path. See the credential migration instructions and OAuth configuration.

On releases before the context-bound upgrade, keep the variable available until the OAuth reconciler converts the spec. That reconciler attempts to delete the variable after conversion, so move other consumers to their own secret first. Those releases log Failed to migrate client_secret_ref on failure and allow correction through their extension editor.