asgardeo · DonOmalVindula · Sep 8, 2026 · Sep 8, 2026
diff --git a/.changeset/readonly-federated-profile.md b/.changeset/readonly-federated-profile.md
diff --git a/packages/browser/CHANGELOG.md b/packages/browser/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @asgardeo/browser
 
+## 0.7.16
+
+### Patch Changes
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/javascript@0.23.6
+
 ## 0.7.15
 
 ### Patch Changes

diff --git a/packages/browser/package.json b/packages/browser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/browser",
-  "version": "0.7.15",
+  "version": "0.7.16",
   "description": "Browser-specific implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",

diff --git a/packages/express/CHANGELOG.md b/packages/express/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @asgardeo/express
 
+## 0.0.87
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @asgardeo/node@0.0.88
+
 ## 0.0.86
 
 ### Patch Changes

diff --git a/packages/express/package.json b/packages/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/express",
-  "version": "0.0.86",
+  "version": "0.0.87",
   "description": "Express.js implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",

diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md
@@ -1,5 +1,33 @@
 # @asgardeo/i18n
 
+## 0.4.10
+
+### Patch Changes
+
+- [#569](https://github.com/asgardeo/javascript/pull/569)
+  [`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a) Thanks
+  [@DonOmalVindula](https://github.com/DonOmalVindula)! - Render a read-only profile for users whose attributes are
+  owned by an identity provider.
+
+  Asgardeo rejects attribute updates for accounts provisioned from a social or enterprise connection, so the profile
+  used to offer edit controls that always failed with a raw SCIM error.
+
+  - `<UserProfile />` accepts `editable="auto"` in React and Next.js. On Asgardeo it looks up the signed-in user's
+    federated associations and, when the account is linked to a connection, renders the profile read-only with a short
+    note naming the provider. On WSO2 Identity Server, where the same updates succeed, the profile stays editable.
+  - `<UserDropdown />` forwards `editable` to the profile it opens from "Manage profile", so the modal follows the same
+    rule as the page.
+  - `BaseUserProfile` accepts a predicate for `editable`, so applications can decide per user without any lookup, and a
+    `readOnlyNote` to explain why editing is unavailable.
+  - A rejected update is now reported in plain words instead of the raw SCIM error, and switches the profile to
+    read-only for the rest of the session. The Next.js `<UserProfile />` previously ignored update failures entirely.
+  - New API `getMeFederatedAssociations` in `@asgardeo/javascript` and `@asgardeo/react`, plus the `signup`-style texts
+    `user.profile.readonly.federated` and `user.profile.update.not.allowed.error` in all i18n bundles.
+
+  While `auto` is resolving, the profile shows a loading state rather than edit controls it may have to take away;
+  `BaseUserProfile` now renders that state whenever `isLoading` is set, in both inline and popup modes. In popup mode
+  the lookup is deferred until the profile is actually opened.
+
 ## 0.4.9
 
 ### Patch Changes

diff --git a/packages/i18n/package.json b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/i18n",
-  "version": "0.4.9",
+  "version": "0.4.10",
   "description": "Internationalization (i18n) package for Asgardeo JavaScript SDKs.",
   "keywords": [
     "asgardeo",

diff --git a/packages/javascript/CHANGELOG.md b/packages/javascript/CHANGELOG.md
@@ -1,5 +1,37 @@
 # @asgardeo/javascript
 
+## 0.23.6
+
+### Patch Changes
+
+- [#569](https://github.com/asgardeo/javascript/pull/569)
+  [`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a) Thanks
+  [@DonOmalVindula](https://github.com/DonOmalVindula)! - Render a read-only profile for users whose attributes are
+  owned by an identity provider.
+
+  Asgardeo rejects attribute updates for accounts provisioned from a social or enterprise connection, so the profile
+  used to offer edit controls that always failed with a raw SCIM error.
+
+  - `<UserProfile />` accepts `editable="auto"` in React and Next.js. On Asgardeo it looks up the signed-in user's
+    federated associations and, when the account is linked to a connection, renders the profile read-only with a short
+    note naming the provider. On WSO2 Identity Server, where the same updates succeed, the profile stays editable.
+  - `<UserDropdown />` forwards `editable` to the profile it opens from "Manage profile", so the modal follows the same
+    rule as the page.
+  - `BaseUserProfile` accepts a predicate for `editable`, so applications can decide per user without any lookup, and a
+    `readOnlyNote` to explain why editing is unavailable.
+  - A rejected update is now reported in plain words instead of the raw SCIM error, and switches the profile to
+    read-only for the rest of the session. The Next.js `<UserProfile />` previously ignored update failures entirely.
+  - New API `getMeFederatedAssociations` in `@asgardeo/javascript` and `@asgardeo/react`, plus the `signup`-style texts
+    `user.profile.readonly.federated` and `user.profile.update.not.allowed.error` in all i18n bundles.
+
+  While `auto` is resolving, the profile shows a loading state rather than edit controls it may have to take away;
+  `BaseUserProfile` now renders that state whenever `isLoading` is set, in both inline and popup modes. In popup mode
+  the lookup is deferred until the profile is actually opened.
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/i18n@0.4.10
+
 ## 0.23.5
 
 ### Patch Changes

diff --git a/packages/javascript/package.json b/packages/javascript/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/javascript",
-  "version": "0.23.5",
+  "version": "0.23.6",
   "description": "Framework agnostic JavaScript SDK for Asgardeo.",
   "keywords": [
     "asgardeo",

diff --git a/packages/nextjs/CHANGELOG.md b/packages/nextjs/CHANGELOG.md
@@ -1,5 +1,38 @@
 # @asgardeo/nextjs
 
+## 0.3.35
+
+### Patch Changes
+
+- [#569](https://github.com/asgardeo/javascript/pull/569)
+  [`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a) Thanks
+  [@DonOmalVindula](https://github.com/DonOmalVindula)! - Render a read-only profile for users whose attributes are
+  owned by an identity provider.
+
+  Asgardeo rejects attribute updates for accounts provisioned from a social or enterprise connection, so the profile
+  used to offer edit controls that always failed with a raw SCIM error.
+
+  - `<UserProfile />` accepts `editable="auto"` in React and Next.js. On Asgardeo it looks up the signed-in user's
+    federated associations and, when the account is linked to a connection, renders the profile read-only with a short
+    note naming the provider. On WSO2 Identity Server, where the same updates succeed, the profile stays editable.
+  - `<UserDropdown />` forwards `editable` to the profile it opens from "Manage profile", so the modal follows the same
+    rule as the page.
+  - `BaseUserProfile` accepts a predicate for `editable`, so applications can decide per user without any lookup, and a
+    `readOnlyNote` to explain why editing is unavailable.
+  - A rejected update is now reported in plain words instead of the raw SCIM error, and switches the profile to
+    read-only for the rest of the session. The Next.js `<UserProfile />` previously ignored update failures entirely.
+  - New API `getMeFederatedAssociations` in `@asgardeo/javascript` and `@asgardeo/react`, plus the `signup`-style texts
+    `user.profile.readonly.federated` and `user.profile.update.not.allowed.error` in all i18n bundles.
+
+  While `auto` is resolving, the profile shows a loading state rather than edit controls it may have to take away;
+  `BaseUserProfile` now renders that state whenever `isLoading` is set, in both inline and popup modes. In popup mode
+  the lookup is deferred until the profile is actually opened.
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/react@0.25.13
+  - @asgardeo/node@0.0.88
+
 ## 0.3.34
 
 ### Patch Changes

diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/nextjs",
-  "version": "0.3.34",
+  "version": "0.3.35",
   "description": "Next.js implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",

diff --git a/packages/node/CHANGELOG.md b/packages/node/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @asgardeo/node
 
+## 0.0.88
+
+### Patch Changes
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/javascript@0.23.6
+
 ## 0.0.87
 
 ### Patch Changes

diff --git a/packages/node/package.json b/packages/node/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/node",
-  "version": "0.0.87",
+  "version": "0.0.88",
   "description": "Node.js runtime specific implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",

diff --git a/packages/nuxt/CHANGELOG.md b/packages/nuxt/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @asgardeo/nuxt
 
+## 0.2.9
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @asgardeo/browser@0.7.16
+  - @asgardeo/node@0.0.88
+  - @asgardeo/vue@0.4.9
+
 ## 0.2.8
 
 ### Patch Changes

diff --git a/packages/nuxt/package.json b/packages/nuxt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/nuxt",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Nuxt module for Asgardeo - Authentication and Identity Management",
   "author": "WSO2",
   "license": "Apache-2.0",

diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
@@ -1,5 +1,38 @@
 # @asgardeo/react
 
+## 0.25.13
+
+### Patch Changes
+
+- [#569](https://github.com/asgardeo/javascript/pull/569)
+  [`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a) Thanks
+  [@DonOmalVindula](https://github.com/DonOmalVindula)! - Render a read-only profile for users whose attributes are
+  owned by an identity provider.
+
+  Asgardeo rejects attribute updates for accounts provisioned from a social or enterprise connection, so the profile
+  used to offer edit controls that always failed with a raw SCIM error.
+
+  - `<UserProfile />` accepts `editable="auto"` in React and Next.js. On Asgardeo it looks up the signed-in user's
+    federated associations and, when the account is linked to a connection, renders the profile read-only with a short
+    note naming the provider. On WSO2 Identity Server, where the same updates succeed, the profile stays editable.
+  - `<UserDropdown />` forwards `editable` to the profile it opens from "Manage profile", so the modal follows the same
+    rule as the page.
+  - `BaseUserProfile` accepts a predicate for `editable`, so applications can decide per user without any lookup, and a
+    `readOnlyNote` to explain why editing is unavailable.
+  - A rejected update is now reported in plain words instead of the raw SCIM error, and switches the profile to
+    read-only for the rest of the session. The Next.js `<UserProfile />` previously ignored update failures entirely.
+  - New API `getMeFederatedAssociations` in `@asgardeo/javascript` and `@asgardeo/react`, plus the `signup`-style texts
+    `user.profile.readonly.federated` and `user.profile.update.not.allowed.error` in all i18n bundles.
+
+  While `auto` is resolving, the profile shows a loading state rather than edit controls it may have to take away;
+  `BaseUserProfile` now renders that state whenever `isLoading` is set, in both inline and popup modes. In popup mode
+  the lookup is deferred until the profile is actually opened.
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/i18n@0.4.10
+  - @asgardeo/browser@0.7.16
+
 ## 0.25.12
 
 ### Patch Changes

diff --git a/packages/react/package.json b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/react",
-  "version": "0.25.12",
+  "version": "0.25.13",
   "description": "React implementation of Asgardeo JavaScript SDK.",
   "keywords": [
     "asgardeo",

diff --git a/packages/vue/CHANGELOG.md b/packages/vue/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @asgardeo/vue
 
+## 0.4.9
+
+### Patch Changes
+
+- Updated dependencies
+  [[`9a156a9`](https://github.com/asgardeo/javascript/commit/9a156a948a0a3c36f504954e1b87a6ef39f13d3a)]:
+  - @asgardeo/i18n@0.4.10
+  - @asgardeo/browser@0.7.16
+
 ## 0.4.8
 
 ### Patch Changes

diff --git a/packages/vue/package.json b/packages/vue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@asgardeo/vue",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Vue 3 SDK for Asgardeo - Authentication and Identity Management",
   "keywords": [
     "asgardeo",