C
v3.145.0
3.145.0 (2026-08-09) Features create record on save instead of on Add click (8b6b978)
Identity
A
2.4.0-rc.18
Security-dependency release on top of 2.4.0-rc.17. Dependency fix cel-go bumped 0.28.1 → v0.29.2, clearing GHSA-gcjh-h69q-9w9g (CVSS 6.3, affects >=0.22.0,<=0.28.1). It reached us transitively through openfga. The advisory: ext.NativeTypes(ParseStructTag("json")) does not honour JSON's skip directive, so a field tagged json:"-" becomes readable through a CEL expression as dyn(obj)["-"]. This was a…
Z
v4.16.3
4.16.3 (2026-08-07) Bug Fixes telemetry: record route patterns instead of request paths on HTTP metrics (#12557) (beffd5e), closes #9286 #9523 #11435 #12315 #12556 #9286 #9523 #11435
A
2.4.0-rc.17
Follows 2.4.0-rc.16 with one security fix that missed that build. Email verification: one decision core, and empty-subject tokens refused (#755) The GraphQL and REST verify-email paths had drifted apart twice, each time because the same decision was implemented in two places. The second drift is the one users hit: a verification click that landed on the MFA setup screen returned before email_verif…
A
2.4.0-rc.16
First RC containing the full 2.4.0 pre-release security audit. rc.15 was tagged but never produced an image — its build was cancelled, and it was cut from a commit predating the audit work — so this is the first usable RC of that work. Security The 22-finding pre-release audit (#748, #751) and the phone-only account fixes (#753). Highlights: nOAuth defense — a social login whose provider does not…
A
2.4.0-rc.15
Breaking change — --encryption-key At-rest encryption no longer silently derives from --jwt-secret. A deployment using an asymmetric JWT algorithm (RS*/ES*) with no --jwt-secret will refuse to start until --encryption-key is set. HMAC deployments (HS256/HS384/HS512) are unaffected — the key still falls back to --jwt-secret. ./authorizer \ --jwt-type=RS256 \ --jwt-private-key="$(cat jwt-private.pem…
A
Version 202632added Custom Token Exchange - Session Delegation is now available in Open Ea
Version 202632added Custom Token Exchange - Session Delegation is now available in Open Early AccessCopied to clipboard We're excited to announce that Auth0 now supports Session Delegation via Custom Token Exchange. This release is available to all Enterprise, B2B Professional, and B2C Professional customers. Session Delegation builds on Custom Token Exchange's delegated authorization model to cov…
C
v3.144.0
3.144.0 (2026-08-06) Features move casbin group rules on user rename (cdd805c)
S
v12.0.10
What's Changed fix: saml hardening by @tamassoltesz in #1356 Full Changelog: v12.0.9...v12.0.10
C
v3.143.0
3.143.0 (2026-08-06) Bug Fixes clear captcha input when refreshing inline captcha (1ee6deb) Features delete by original owner and name when canceling add (9bdde95)
C
v3.142.0
3.142.0 (2026-08-06) Features add properties field to product (c94305f)
S
v11.4.7
What's Changed fix: hardening signature validation (backport to 11.4) by @tamassoltesz in #1357 Full Changelog: v11.4.6...v11.4.7
S
v12.0.9
What's Changed ci: backport workflow by @tamassoltesz in #1317 ci: backport workflow by @tamassoltesz in #1318 fix: re-enable stress-test seeding assertions and allow manual dispatch by @supertokens-agent-runner[bot] in #1339 test: measure the scale-sensitive query paths in the 1M-user stress suite by @supertokens-agent-runner[bot] in #1340 test: surface pg_stat_statements in stress-test summary,…
S
v11.3.7
What's Changed fix: hardening signature validation (backport to 11.3) by @tamassoltesz in #1358 Full Changelog: v11.3.6...v11.3.7
O
v1.18.3
What's Changed Fixed Fixed experimental weighted_graph_check intermittently returning false when evaluating relations that cross two or more distinct recursive TTUs which share the same tupleset relation. #3244 Full Changelog: v1.18.2...v1.18.3
O
v1.18.2
What's Changed Added Extended experimental weighted_graph_check diagnostic logging to cover the wildcard_with_exclusion and userset_with_exclusion shapes: the log now fires when v2 Check rejects one of these shapes and Check falls back to v1, and when v2 Check is skipped entirely because the weighted graph fails to build. These logs surface authorization models that may be affected by a future v1…
W
Pipes Token ProxyCall third-party APIs on behalf of your users without handling their acce
Pipes Token ProxyCall third-party APIs on behalf of your users without handling their access tokens. Read more
W
August 6, 2026Pipes Token ProxyCall third-party APIs on behalf of your users without handl
August 6, 2026Pipes Token ProxyCall third-party APIs on behalf of your users without handling their access tokens.Read more
A
added Google Workspace Directory Sync for Groups - Now in General Availability!Copied to c
added Google Workspace Directory Sync for Groups - Now in General Availability!Copied to clipboard We’re excited to announce that support for Group and Group Membership in Google Workspace Inbound Directory Sync is now Generally Available (GA) for all Auth0 customers! What’s new: Paginated Dashboard UI: Tenant admins can now easily browse, filter, and search groups from their Google Workspace dire…
W
iOS SDKWorkOS iOS SDK is now available. Read more
iOS SDKWorkOS iOS SDK is now available. Read more
W
August 5, 2026iOS SDKWorkOS iOS SDK is now available.Read more
August 5, 2026iOS SDKWorkOS iOS SDK is now available.Read more
C
v3.141.0
3.141.0 (2026-08-04) Features add configurable record retention days per organization (8799cfe)
A
Release 2026.8.0-rc6
See https://next.goauthentik.io/docs/releases/2026.8 What's Changed stages/authenticator_validate: fix intermittnetly failing throttling test (cherry-pick #24568 to version-2026.8) by @authentik-cherry-pick[bot] in #24708 ci: sentry-release needs access to metadata. (cherry-pick #24710 to version-2026.8) by @authentik-cherry-pick[bot] in #24711 Full Changelog: version/2026.8.0-rc5...version/2026.8…
A
2.4.0-rc.14
What's Changed fix: MFA enrolment state in settings + OAuth provider contract audit by @lakhansamani in #740 Full Changelog: 2.4.0-rc.13...2.4.0-rc.14
A
Release 2026.8.0-rc5
See https://next.goauthentik.io/docs/releases/2026.8 What's Changed ci: release publish: fix image attestation by @rissson in #24706 Full Changelog: version/2026.8.0-rc4...version/2026.8.0-rc5
A
Release 2026.8.0-rc4
See https://next.goauthentik.io/docs/releases/2026.8 What's Changed website/docs: fix sidebar titles and ordering (cherry-pick #24051 to version-2026.8) by @authentik-cherry-pick[bot] in #24700 ci: release publish: fix metadata parsing by @rissson in #24703 Full Changelog: version/2026.8.0-rc3...version/2026.8.0-rc4
C
Casbin v3.11.0
3.11.0 (2026-08-03) This GitHub release is a draft helper for packaging and release notes. Features feat: quote CSV fields containing commas in SavePolicy (f64a3c0) feat: auto release snapshot versions now (#1728) (16b0c89) feat: add .asf.yaml and DISCLAIMER (#1710) (0985085) Fixes fix: pass domains in ConditionalRoleManager transitive link check (1571e4f) fix: update repo path in README (52c2b03)…
A
Release 2026.8.0-rc3
See https://next.goauthentik.io/docs/releases/2026.8 What's Changed lib/sync/outgoing: allow discovery to be deactivated (cherry-pick #24667 to version-2026.8) by @authentik-cherry-pick[bot] in #24678 website/docs: Mark the release notes for 2026.8 as 'beta' (cherry-pick #24682 to version-2026.8) by @authentik-cherry-pick[bot] in #24686 ci: release tag: add validation that the workflow was started…
C
v3.140.1
3.140.1 (2026-08-03) Bug Fixes increase Provider.Scopes column size to varchar(200) (fffa920)
C
v3.11.0-snapshot.7
3.11.0-snapshot.7 (2026-06-23) Fixes fix: pass domains in ConditionalRoleManager transitive link check (1571e4f)