tag:github.com,2008:https://github.com/logto-io/logto/releases

Release notes from logto

2026-06-30T07:34:54Z tag:github.com,2008:Repository/378310716/v1.41.0 2026-06-30T13:59:23Z

v1.41.0

<a target="_blank" rel="noopener noreferrer" href="https://private-user-images.githubusercontent.com/5717882/615194722-ef142cde-0547-4a62-b85e-894ea6b48b8e.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQzNDc0OTUsIm5iZiI6MTc4NDM0NzE5NSwicGF0aCI6Ii81NzE3ODgyLzYxNTE5NDcyMi1lZjE0MmNkZS0wNTQ3LTRhNjItYjg1ZS04OTRlYTZiNDhiOGUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI2MDcxOCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNjA3MThUMDM1OTU1WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YmM3Njg0ZDcwYWRiOWY1MWE4MmM2ZDZkMTdkOWFhYzlmM2RjNmFkZTY4OGQ5OTViYTFjOTRjMTI2M2VjZjFiNSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmcmVzcG9uc2UtY29udGVudC10eXBlPWltYWdlJTJGcG5nIn0.G9XGEfpF5MXWbTD6-xfq1X5LBhpYQjJmF6vc6_wTW2Y"><img width="2000" height="1125" alt="image" src="https://private-user-images.githubusercontent.com/5717882/615194722-ef142cde-0547-4a62-b85e-894ea6b48b8e.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3ODQzNDc0OTUsIm5iZiI6MTc4NDM0NzE5NSwicGF0aCI6Ii81NzE3ODgyLzYxNTE5NDcyMi1lZjE0MmNkZS0wNTQ3LTRhNjItYjg1ZS04OTRlYTZiNDhiOGUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI2MDcxOCUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNjA3MThUMDM1OTU1WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9YmM3Njg0ZDcwYWRiOWY1MWE4MmM2ZDZkMTdkOWFhYzlmM2RjNmFkZTY4OGQ5OTViYTFjOTRjMTI2M2VjZjFiNSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmcmVzcG9uc2UtY29udGVudC10eXBlPWltYWdlJTJGcG5nIn0.G9XGEfpF5MXWbTD6-xfq1X5LBhpYQjJmF6vc6_wTW2Y" content-type-secured-asset="image/png" style="max-width: 100%; height: auto; max-height: 1125px;"></a> <h2>Highlights</h2> <ul> <li><strong>App-level access control</strong>: Restrict application access by user, user role, organization, or organization role.</li> <li><strong>Password expiration policy</strong>: Enforce password rotation per tenant and let admins manually expire a user's password.</li> <li><strong>Account Center upgrades</strong>: Sessions, profile, avatar upload, and independent passkey controls are now available.</li> </ul> <h2>New features & enhancements</h2> <h3>App-level access control</h3> <p>Admins can now restrict who can access an application. Access rules support:</p> <ul> <li>User IDs</li> <li>User roles</li> <li>Organizations</li> <li>Organization roles</li> </ul> <p>When a user does not match the configured rules, Logto blocks the sign-in or application access flow with an access denied page.</p> <p>Documentation: <a href="https://docs.logto.io/integrate-logto/app-level-access-control" rel="nofollow">https://docs.logto.io/integrate-logto/app-level-access-control</a></p> <h3>Password expiration policy</h3> <p>Console now supports a per-tenant password expiration policy under Security -> Password policy.</p> <p>Admins can:</p> <ul> <li>Enable password expiration.</li> <li>Configure how many days a password remains valid.</li> <li>Manually expire a specific user's password from the user details page.</li> </ul> <p>When a password expires, the user must reset it through the configured recovery method before password sign-in can continue. SSO and passkey sign-ins are not affected.</p> <p>Legacy users without a recorded password-change time are anchored to the time the policy is enabled, so they receive a full valid period instead of being expired immediately.</p> <h3>Account Center</h3> <p>Account Center now includes:</p> <ul> <li>Session management for reviewing active sessions and connected third-party applications.</li> <li>Profile management and avatar upload.</li> <li>Avatar upload support during collect-profile sign-up.</li> <li>Independent passkey controls separate from MFA.</li> <li>User control for passkey sign-in prompt preference.</li> </ul> <p>The Account Center profile page, custom profile fields at sign-up, and avatar upload endpoints are available as part of the out-of-the-box profile experience.</p> <h3>Username policy</h3> <p>Operators can configure tenant-level username rules from Console -> Sign-in experience -> Sign-up and sign-in -> Advanced options.</p> <p>The policy covers case sensitivity, length bounds, and allowed character types. It is enforced on end-user username writes in sign-up, profile fulfillment, Account Center, and Account API.</p> <p>Switching to case-insensitive usernames is guarded: Logto detects existing usernames that differ only by case and blocks the change until conflicts are resolved.</p> <p>The OIDC <code>preferred_username</code> claim now falls back to the user's <code>username</code> when <code>profile.preferredUsername</code> is unset.</p> <h3>Verification-code and message send controls</h3> <p>Admins can configure verification-code expiration duration and maximum retry attempts in Console Security settings.</p> <p>Logto also adds a system-level per-recipient send rate limit across email/SMS verification and invitation send paths, including Experience, MFA, Account API, Management API, organization invitations, and the legacy interaction API.</p> <p>When a send is throttled, Logto emits a <code>Message.RateLimited</code> webhook event, now selectable in Console webhook settings. Verification-code delivery to unknown recipients is suppressed when registration is disabled to reduce account enumeration risk.</p> <h3>JWT customizer organization context</h3> <p>For organization API resource tokens, the access token JWT customizer now receives <code>context.organization</code> with the target organization's <code>id</code>, <code>name</code>, <code>description</code>, and <code>customData</code>.</p> <p>This lets scripts attach per-organization claims without embedding every organization mapping into every token.</p> <h3>API improvements</h3> <p><code>POST /api/applications/:applicationId/roles</code> is now idempotent. Role IDs that are already attached to the application are ignored instead of returning <code>422 application.role_exists</code>.</p> <p>The endpoint now returns <code>201</code> with <code>{ roleIds, addedRoleIds }</code>, matching the user role assignment API shape.</p> <p>Organization role creation with initial scopes is now transactional, so invalid scope IDs no longer leave partially created roles behind.</p> <h2>Bug fixes & stability</h2> <h3>Security and protocol hardening</h3> <ul> <li>SAML IdP auto-submit forms now escape HTML attribute values and reject non-HTTP(S) action URLs.</li> <li><code>samlify</code> is upgraded to <code>^2.13.0</code>, improving XML escaping in generated SAML assertions.</li> <li>TOTP MFA verification now rejects replayed codes from the same or older time-step counter.</li> <li>OIDC request bodies containing null bytes now return <code>400 invalid_request</code>, and audit log payloads strip null bytes before insertion.</li> <li>Email subaddressing blocklist checks no longer build regular expressions from user-controlled input.</li> <li>Logto Tunnel prevents static file requests from reading outside the configured experience path.</li> </ul> <h3>Experience and Account Center</h3> <ul> <li>Tenant theme, platform, and brand color are applied before hydration to reduce theme flash in sign-in experience and Account Center.</li> <li>Hosted sign-in experience custom CSS is now inlined into server-rendered HTML to prevent a flash of built-in styles.</li> <li>Account Center step-up verification is restricted to user permission verification records.</li> <li>Social identities can be linked in Account Center without password, email, or phone verification when the user has no legacy security verification methods.</li> <li>Console username editing now redirects to Account Center so the required verification flow can complete.</li> </ul> <h3>Compatibility and storage</h3> <ul> <li>Older Safari and iOS 15 no longer crash on startup because of unsupported regex lookbehind syntax.</li> <li>OIDC enterprise connectors can fetch discovery configuration from providers that reject JSON-only response negotiation.</li> <li>Custom UI asset Azure Blob transport failures now map to retryable storage download errors, and upload timeout handling is improved.</li> </ul> <h2>Connectors</h2> <ul> <li><strong>New - SMTP2GO email connector</strong>: Send transactional auth emails through the SMTP2GO send API.</li> <li><strong>QQ connector</strong>: Supports social identity verification with stored redirect URI.</li> <li><strong>SAML connector</strong>: Upgrades <code>samlify</code> and adapts to its stricter return types.</li> <li><strong>Connector Kit</strong>: Exports shared SMTP mailbox parsing and formatting utilities, now also used by MailJunky.</li> </ul> <h2>Self-hosting & OSS notes</h2> <ul> <li><strong><code>CASE_SENSITIVE_USERNAME</code> deprecation</strong>: The environment variable still works as a runtime override, but username case sensitivity should now be configured per tenant through the username policy. It is deprecated and slated for removal in the next major version.</li> </ul> <h2>Contributors</h2> <p>Huge thanks to the community members whose work shipped in this release:</p> <ul> <li><a href="https://github.com/tevass">@tevass</a> - password expiration policy (<a href="https://github.com/logto-io/logto/pull/8643" data-hovercard-type="pull_request" data-hovercard-url="/logto-io/logto/pull/8643/hovercard">#8643</a>)</li> <li><a href="https://github.com/mrprofessor">@mrprofessor</a> - idempotent application role assignment API (<a href="https://github.com/logto-io/logto/pull/8901" data-hovercard-type="pull_request" data-hovercard-url="/logto-io/logto/pull/8901/hovercard">#8901</a>)</li> <li><a href="https://github.com/darcyYe">@darcyYe</a> - custom CSS first-paint fix for hosted sign-in experience (<a href="https://github.com/logto-io/logto/pull/9017" data-hovercard-type="pull_request" data-hovercard-url="/logto-io/logto/pull/9017/hovercard">#9017</a>)</li> </ul> <p>For the complete list of changes, see the <a href="https://github.com/logto-io/logto/blob/master/packages/core/CHANGELOG.md">full changelog</a>.</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/tunnel@0.3.9 2026-06-30T07:35:13Z

@logto/tunnel@0.3.9

<p>@logto/tunnel@0.3.9</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/translate@0.2.15 2026-06-30T07:35:13Z

@logto/translate@0.2.15

<p>@logto/translate@0.2.15</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/shared@3.4.1 2026-06-30T07:35:12Z

@logto/shared@3.4.1

<p>@logto/shared@3.4.1</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/phrases-experience@1.14.0 2026-06-30T07:35:12Z

@logto/phrases-experience@1.14.0

<p>@logto/phrases-experience@1.14.0</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/phrases@1.29.0 2026-06-30T07:35:12Z

@logto/phrases@1.29.0

<p>@logto/phrases@1.29.0</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/integration-tests@1.22.0 2026-06-30T07:35:11Z

@logto/integration-tests@1.22.0

<p>@logto/integration-tests@1.22.0</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/experience@1.20.0 2026-06-30T07:35:11Z

@logto/experience@1.20.0

<p>@logto/experience@1.20.0</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/core-kit@2.11.0 2026-06-30T07:35:13Z

@logto/core-kit@2.11.0

<p>@logto/core-kit@2.11.0</p> silverhand-bot tag:github.com,2008:Repository/378310716/@logto/core@1.41.0 2026-06-30T07:34:53Z

@logto/core@1.41.0

<p>@logto/core@1.41.0</p> silverhand-bot