fix(api): record the retirement against the release that carries it

v1.38.19 was cut before this change and still answers on the path, so
naming it as the version that removed the route would be wrong in the
published contract from the day it appears.
This commit is contained in:
Marc-André Bombeck committed 2026-09-11 14:39:30 +02:00
1 parent 625763982b
commit 93874af99b
2 files changed
+4 -4

No files matched your search

+3 -3
View File
@@ -20425,9 +20425,9 @@ paths:
deprecated: true
tags:
- Retired
summary: POST /api/auth/check-user — removed in v1.38.19
summary: POST /api/auth/check-user — removed in v1.38.20
description: >-
Removed in v1.38.19. Every request to this path answers 410 Gone, whatever the method and whatever credential it
Removed in v1.38.20. Every request to this path answers 410 Gone, whatever the method and whatever credential it
carries. There is no replacement; the capability is gone rather than moved.
@@ -20443,7 +20443,7 @@ paths:
do not offer a retry.
responses:
"410":
description: The path was removed in v1.38.19 and will not answer again. `meta.errorCode` = `route.retired`,
description: The path was removed in v1.38.20 and will not answer again. `meta.errorCode` = `route.retired`,
`meta.removedIn` carries the version, and `meta.replacedBy` carries the replacement path or null.
content:
application/json:
+1 -1
View File
@@ -146,7 +146,7 @@ export const RETIRED_ROUTES: readonly RetiredRoute[] = [
},
{
path: "/api/auth/check-user",
removedIn: "1.38.19",
removedIn: "1.38.20",
replacedBy: null,
reason:
"Took an email address or a username and answered, to any caller and with no credential at all, whether an account existed here and whether it carried a passkey or a password. It was built to decide which field a sign-in screen shows first, which is not worth telling the world who has an account. Send the credential to POST /api/auth/login or run the passkey ceremony and read the answer; both refuse identically whether or not the account exists.",