Starstruk Logo MarkStarstruk

v0.157.0

Infisical/infisicalv0.157.0Jan 27, 2026by carlosmonastyrski

AI Summary

Adds PKI approval workflows, user account recovery, and expands project templates to include groups and machine identities with various security improvements.

Key Highlights

  • Introduced PKI approval workflows for certificate management.
  • Implemented user account recovery functionality.
  • Project templates now support groups and machine identities.
  • Added MFA unlock email handling with keystore lockout mechanism.
  • Supported Azure SAML 'Sign assertion only' configuration.

New Features

  • PKI approval workflows
  • User account recovery
  • Project template groups
  • Project template machine identities
  • MFA unlock email handling

Full Release Notes

## What's Changed
* docs: add rate limits section to API reference by @x032205 in https://github.com/Infisical/infisical/pull/5230
* chore(docs): fix typo by @varonix0 in https://github.com/Infisical/infisical/pull/5226
* fix: migration error in read-compat-flag by @akhilmhdh in https://github.com/Infisical/infisical/pull/5232
* improvement(secret-syncs): update max name size to 256 by @x032205 in https://github.com/Infisical/infisical/pull/5215
* feat: added query to remove orphan user org membership by @akhilmhdh in https://github.com/Infisical/infisical/pull/5233
* feat: added cleanup query to remove orphan identity by @akhilmhdh in https://github.com/Infisical/infisical/pull/5237
* feat: add show/hide password toggle to login page by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5241
* feature(project-templates): add groups to templates by @x032205 in https://github.com/Infisical/infisical/pull/5234
* fix(sign-up): implement email notification for existing accounts during signup by @victorvhs017 in https://github.com/Infisical/infisical/pull/5244
* improvement(gateway): introduce safeJWTSchema for identity token validation in gateway cmd deployment by @victorvhs017 in https://github.com/Infisical/infisical/pull/5245
* fix: enable URL sharing for secret approval change requests by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5246
* chore: add CA:true policy constraint to docs by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5231
* fix(organization-invite): add validation for disposable emails by @victorvhs017 in https://github.com/Infisical/infisical/pull/5254
* improvement(mfa): implement MFA unlock email handling with keystore lockout mechanism by @victorvhs017 in https://github.com/Infisical/infisical/pull/5239
* feature: add PKI approval workflows by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5218
* fix: small PKI approvals doc path renaming for clearer trace by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5256
* fix: pki approvals doc references by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5258
* chore: enable identity support for org list endpoint by @sheensantoscapadngan in https://github.com/Infisical/infisical/pull/5259
* feat(agent-sentinel): add gateway support for MCP servers by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/5225
* feat(project-templates): add machine identities by @x032205 in https://github.com/Infisical/infisical/pull/5252
* feat(backend): add sanitized schema generation for analytics views by @maidul98 in https://github.com/Infisical/infisical/pull/5251
* feat: make resource optional in MCP endpoint OAuth flow by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5267
* feat: add select/deselect all tools option for MCP server endpoints by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5266
* fix(vault-migration): handle soft deleted secrets by @varonix0 in https://github.com/Infisical/infisical/pull/5263
* fix(identities-projects): add lock to identity insert and custom rate-limitings for identities and projects creation by @victorvhs017 in https://github.com/Infisical/infisical/pull/5242
* feat: implements user account recovery  by @akhilmhdh in https://github.com/Infisical/infisical/pull/5236
* fix: move ts-node from devDependencies to dependencies for migration support by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5273
* fix(ui): secret field json diff visibility issue by @IgorHorta in https://github.com/Infisical/infisical/pull/5274
* feat(db): add role-based access grants for analytics schema by @maidul98 in https://github.com/Infisical/infisical/pull/5279
* fix: fixes and improvements on PKI CAs by @carlosmonastyrski in https://github.com/Infisical/infisical/pull/5024
* fix: remove project version check from grantProjectAdminAccess by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5272
* improvement(pki): add error tooltip for failed cert requests and restrict actions to issued certificates by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/5283
* fix(pki): disable the policy selector with a message that no policies are available by @saifsmailbox98 in https://github.com/Infisical/infisical/pull/5284
* feat: made organization role api available for identity and external use by @akhilmhdh in https://github.com/Infisical/infisical/pull/5280
* fix(saml): support Azure SAML 'Sign assertion only' configuration by @devin-ai-integration[bot] in https://github.com/Infisical/infisical/pull/5275

## New Contributors
* @devin-ai-integration[bot] made their first contribution in https://github.com/Infisical/infisical/pull/5241
* @IgorHorta made their first contribution in https://github.com/Infisical/infisical/pull/5274

**Full Changelog**: https://github.com/Infisical/infisical/compare/v0.156.3...v0.156.4