9.1.0 (2025-12-14)

Bug Fixes

• Cross-Site Scripting (XSS) via HTML pages for password reset and email verification GHSA-jhgf-2h8h-ggxv (#9985) (3074eb7)

Features

• Add option logLevels.signupUsernameTaken to change log level of username already exists sign-up rejection (#9962) (f18f307)
• Add support for custom HTTP status code and headers to Cloud Function response with Express-style syntax (#9980) (8eeab8d)
• Log more debug info when failing to set duplicate value for field with unique values (#9919) (a23b192)