[ankita10119]

Changes

Path parameters are encoded with encodePathParam, which uses encodeURIComponent and leaves . unchanged. When a path parameter is exactly . or .., URL resolution removes it as a dot segment, so the request (with the Management API token attached) is sent to a different path than the one the method targets. For example, users.roles.list('..') was sent as GET /api/v2/roles, and users.delete('..') as DELETE /api/v2/.

This backports the v7.6.0 fix to 5.x:

• src/management/core/url/encodePathParam.ts: rejects . and .., throwing the error class passed in (or a plain Error). This file is identical to the one in v7.6.0.
• Generated clients in src/management/api/ (101 files): every core.url.encodePathParam(x) call now passes errors.ManagementError as the second argument, as in v7.6.0. This is the only change in these files, so callers get a ManagementError like any other SDK error.
• src/management/tests/unit/url/encodePathParam.test.ts: new unit tests, identical to v7.6.0.

The check runs while the request path is being built, so a rejected call never sends the request. Values such as ..., a.b, auth0|a.b and %2e%2e are unaffected (%2e%2e is encoded as %252e%252e).

No endpoints were added, removed or deprecated. The only behaviour change: a call whose path parameter is exactly . or .. now throws ManagementError instead of being sent to a different endpoint.

Alternatives considered:

• Percent-encoding . as %2E. That doesn't work, because WHATWG URL parsing also treats %2e%2e, .%2e and %2e. as .., so these values are rejected instead.
• Changing only encodePathParam.ts (a 1-file diff). That would throw a plain Error instead of ManagementError. The call-site change keeps the error type consistent with v7.6.0 and with existing instanceof ManagementError handling.

To do before review: bump auth0-legacy to npm:auth0@^4.37.2 (with yarn.lock) once 4.37.2 is published, so the auth0/legacy entrypoint also gets the fix.

References

• Security advisory: GHSA-h4ph-726g-66fc (CVE-2026-126128)
• Same fix on the main line: feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428 (released in v7.6.0)

Testing

New unit tests in src/management/tests/unit/url/encodePathParam.test.ts (18 tests):

• . and .. are rejected, and the provided error class is thrown
• valid values are encoded as before (usr_123, a/b, ..., a..b, %2E%2E, "", numbers, booleans, null, undefined)
• encoded values stay in the path when joined with the base URL

With only the dot-segment check disabled, the 3 rejection tests fail.

Verified locally:

• yarn lint (no new warnings), yarn build (CJS and ESM) and yarn lint:package pass
• Prettier check passes on all changed files
• yarn test: 205/205 suites, 4494 passed. The 1 skipped test is a pre-existing it.skip in tests/management/token-provider.test.ts. The wire tests exercise the changed client methods with normal IDs.
• End-to-end check of the built CJS and ESM output against a local HTTP server using Node's built-in fetch (Node 18.20.8 and 24.0.1), with both a static token and client credentials:
  • unpatched 5.14.1: users.roles.list('..') is sent to GET /api/v2/roles and users.delete('..') to DELETE /api/v2/, with the token
  • patched: .. and . on users.roles.list, users.get, users.delete and roles.get throw ManagementError and nothing is sent; normal IDs such as auth0|a.b are unchanged

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.64%. Comparing base (408ddc2) to head (fc1b0e3).

Additional details and impacted files

@@            Coverage Diff             @@
##               v5    #1441      +/-   ##
==========================================
+ Coverage   89.62%   89.64%   +0.01%     
==========================================
  Files         428      428              
  Lines       19886    19891       +5     
  Branches     9400     9402       +2     
==========================================
+ Hits        17823    17831       +8     
+ Misses       2063     2060       -3     

Flag	Coverage Δ
alltests	89.64% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../management/api/resources/actions/client/Client.ts	88.80% <ø> (ø)
...rces/actions/resources/executions/client/Client.ts	90.69% <ø> (ø)
...sources/actions/resources/modules/client/Client.ts	89.53% <ø> (ø)
...ources/modules/resources/versions/client/Client.ts	90.32% <ø> (ø)
...urces/triggers/resources/bindings/client/Client.ts	89.88% <ø> (ø)
...ources/actions/resources/versions/client/Client.ts	89.83% <ø> (ø)
...esources/anomaly/resources/blocks/client/Client.ts	89.18% <ø> (ø)
...sources/phone/resources/providers/client/Client.ts	88.47% <ø> (ø)
...sources/phone/resources/templates/client/Client.ts	88.35% <ø> (ø)
...sources/branding/resources/themes/client/Client.ts	88.16% <ø> (ø)
... and 92 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.