--- title: 3.8 Release Notes description: "## Overview Elements 3.8's headline feature is a generic, server-driven [OIDC](https://namazustudios.com/glossary/oidc/) login flow: register any [OIDC](https://namazustudios.com/glossary/oidc/) provider by its discovery URL and get the full authorization-code handshake, including the browser redirect and callback, handled entirely server-side, with no per-provider client…" url: "https://namazustudios.com/docs/releases/3-8-release-notes/" updated: "2026-08-14" category: Releases --- # 3.8 Release Notes ## Overview Elements 3.8's headline feature is a generic, server-driven [OIDC](https://namazustudios.com/glossary/oidc/) login flow: register any [OIDC](https://namazustudios.com/glossary/oidc/) provider by its discovery URL and get the full authorization-code handshake, including the browser redirect and callback, handled entirely server-side, with no per-provider client code. Twitch ships as a fully worked reference provider. Alongside that, this release hardens username handling and closes a collision bug in [User](https://namazustudios.com/glossary/user/) lookup, fixes several [Element](https://namazustudios.com/glossary/element/)-loading/attribute-hierarchy issues, and switches the project's license to MPL 2.0. ## Highlights - **Generic [OIDC](https://namazustudios.com/glossary/oidc/) browser-redirect login** — one integration path for any [OIDC](https://namazustudios.com/glossary/oidc/) provider an admin registers; see [OIDC Login for Thick Clients](oidc-login-for-thick-clients-browser-redirect-flow) and [Setting Up Twitch OIDC Login](setting-up-twitch-oidc-login-backend). - **[OIDC](https://namazustudios.com/glossary/oidc/) provider-configuration admin UI** — providers are now a server-side config change, not a client rebuild. - **Username validation and lookup hardening** — tighter username rules and a fixed lookup collision (see below). - **Deployment editor attribute editing** — set and adjust [Element](https://namazustudios.com/glossary/element/) attributes directly from the deployment editor. - **License change** — Elements is now licensed under MPL 2.0. ## New Features ### Generic [OIDC](https://namazustudios.com/glossary/oidc/) Browser-Redirect Login A full walkthrough lives in [OIDC Login for Thick Clients](oidc-login-for-thick-clients-browser-redirect-flow) and [Setting Up Twitch OIDC Login](setting-up-twitch-oidc-login-backend); the summary: - New `OidcProviderConfiguration` resource and admin console UI (**Auth > [OIDC](https://namazustudios.com/glossary/oidc/) Providers**) for registering providers by discovery URL, replacing the previous hand-seeded default schemes for Google, Apple, and Twitch. - New endpoints driving the full authorization-code flow server-side: `POST /OIDC/Session` to begin an attempt, a provider-facing callback, and `GET /OIDC/Session/{id}` for the client to poll for completion. - Per-provider `successRedirectUrl`/`errorRedirectUrl` are now configured on the provider, not supplied by the client on each request. - [OIDC](https://namazustudios.com/glossary/oidc/) [Profile](https://namazustudios.com/glossary/profile/) claims (`preferred_username`, `given_name`, `family_name`) now backfill `User.displayName`/`firstName`/`lastName` on a new [User](https://namazustudios.com/glossary/user/)'s first login, fail-soft — a malformed or missing claim doesn't fail the login. Every provider's full claim set is also snapshotted into `User.linkedAccountProfiles`, see [Users and Profiles](users-and-profiles). - Fixed a duplicate-key error that could occur on a [User](https://namazustudios.com/glossary/user/)'s very first [OIDC](https://namazustudios.com/glossary/oidc/) login. - **Renames:** `OidcProviderConfiguration.provider` → `name`, `User.preferredUsername` → `displayName`, and the [OIDC](https://namazustudios.com/glossary/oidc/) login attempt's `handle` field → `id`. ### Deployment Editor Attribute Editing The deployment editor can now set and adjust an [Element](https://namazustudios.com/glossary/element/)'s attributes directly, backed by a new `@ElementRequiredAttribute` annotation Elements use to declare which attributes they expect. ## Bug Fixes ### Username Validation and Lookup Collision Usernames are now validated against a dedicated pattern — no whitespace, no control characters, no Unicode formatting characters, 50 characters max — instead of a generic "no whitespace" check. Separately, [User](https://namazustudios.com/glossary/user/) lookup by [name](https://namazustudios.com/glossary/name/)/email no longer falls back to treating the input as a raw database [id](https://namazustudios.com/glossary/id/) except as a last resort at read time, closing a collision where a username that happened to look like a valid [id](https://namazustudios.com/glossary/id/) could resolve to the wrong account. ### [Element](https://namazustudios.com/glossary/element/) Load Ordering and Attribute Hierarchy - Fixed `FilteredServiceLocator` throwing when directory- and Maven-sourced Elements are mixed in the same deployment. - Fixed `GuiceSpiModule` throwing on duplicate [Service](https://namazustudios.com/glossary/service/) bindings. - Fixed [Element](https://namazustudios.com/glossary/element/) load ordering ignoring `@ElementDependency`, which could break deployments that mix `.elm`-packaged and Maven-sourced Elements. - Fixed the attribute merge hierarchy so operator-set attributes take correct precedence. ### Progress API Permission Fix Fixed the progress-update API improperly allowing client-level callers to create or update progress directly; this is now restricted to superusers, with client callers receiving a `501`. Superuser update capability, which had been accidentally removed by an earlier fix, was restored alongside a regression test. ### Admin Console Fixes - Fixed [Element](https://namazustudios.com/glossary/element/) grouping and a [Jakarta](https://namazustudios.com/glossary/jakarta/) RS override issue in the installed-elements view. - Forms that create or edit auth schemes now indicate when a [User](https://namazustudios.com/glossary/user/) level is required, and a stuck "missing attributes" badge in the deployment editor now clears correctly once the missing attributes are added. ## Other Changes - **License change**: Elements is now licensed under the Mozilla Public License 2.0.