v0.161.1

Infisical/infisicalv0.161.1Jun 17, 2026by mathnogueira

AI Summary

Focuses on security enhancements like unexportable KMS keys and certificate revocation, along with migrating project templates and secret sharing to new locations. Adds PKI tooling like signer connection helpers and webhook machine auth.

Key Highlights

  • Unexportable flag for KMS keys
  • Certificate revocation using thumbprints
  • PKI Signer connect helper
  • Webhook machine identity authentication
  • Project templates moved to advanced settings

New Features

  • Unexportable KMS keys
  • Thumbprint revocation
  • PKI Signer helper
  • Webhook machine identity auth
  • Project template restructure

Full Release Notes

### Changed
- Allow external account Google Cloud authentication (https://github.com/Infisical/infisical/pull/6890)
- Move project templates to advanced and add external KMS shortcut to new project modal (https://github.com/Infisical/infisical/pull/6879)
- Re-structure organization navigation and move secret sharing to secrets management scope (https://github.com/Infisical/infisical/pull/6870)
- Make GCP IAM token OAuth scopes configurable for dynamic secrets (https://github.com/Infisical/infisical/pull/6849)
- Migrate networking gateway and relay cards to v3 and stabilize sub-tab layout (https://github.com/Infisical/infisical/pull/6838)
- Migrate error page to v3 components (https://github.com/Infisical/infisical/pull/6836)
- Migrate create/link organization group modal to v3 components (https://github.com/Infisical/infisical/pull/6828)
- Only verify SSO emails if the provider reports them unverified (https://github.com/Infisical/infisical/pull/6830)
- Migrate add members to project modal to v3 (https://github.com/Infisical/infisical/pull/6807)
- Add fallback to list only authorized paths on Vault migration (https://github.com/Infisical/infisical/pull/6814)
- Adjust padding when in grid card view on project selection page (https://github.com/Infisical/infisical/pull/6889)
- Refactor secrets buttons (https://github.com/Infisical/infisical/pull/6858)
- Update 404 styling and flavor (https://github.com/Infisical/infisical/pull/6875)
- Change secret request copy on overview page (https://github.com/Infisical/infisical/pull/6796)

### Added
- Use organization ID as ExternalID for certificate manager AWS connections (https://github.com/Infisical/infisical/pull/6883)
- Auto-create a personal organization on sign-up from SSO (https://github.com/Infisical/infisical/pull/6877)
- Add unexportable flag to KMS keys (https://github.com/Infisical/infisical/pull/6848)
- Group certificate resources under a navigation section (https://github.com/Infisical/infisical/pull/6839)
- Add support for revoking certificates using thumbprints (https://github.com/Infisical/infisical/pull/6833)
- Add get-by-id route to webhooks and allow machine identity authentication (https://github.com/Infisical/infisical/pull/6818)
- Add ability to clone certificate profiles (https://github.com/Infisical/infisical/pull/6816)
- Add PKI Signer connect helper (https://github.com/Infisical/infisical/pull/6811)
- Add handlebar templates for permissions (https://github.com/Infisical/infisical/pull/6809)
- Add new template function for Kubernetes operator (https://github.com/Infisical/infisical/pull/6790)
- Add webhook type for triggered honey tokens (https://github.com/Infisical/infisical/pull/6759)
- Implement usage metering pipeline for License Server v2 (https://github.com/Infisical/infisical/pull/6827)
- Revamp PAM checkpoint 4 (https://github.com/Infisical/infisical/pull/6853)
- Revamp PAM checkpoint 2 (https://github.com/Infisical/infisical/pull/6795)
- Fix shadow mismatches in Go and Node.js (https://github.com/Infisical/infisical/pull/6863)
- Ensure only versions under v1 can be made to release in GitHub (https://github.com/Infisical/infisical/pull/6886)
- Document CLI migration guide for Cloudsmith repository transition to [artifacts-cli.infisical.com](http://artifacts-cli.infisical.com/) (https://github.com/Infisical/infisical/pull/6881)
- Add secrets management walkthrough videos to documentation (https://github.com/Infisical/infisical/pull/6788)
- Update README to reflect full product positioning and product lineup (https://github.com/Infisical/infisical/pull/6857)
- Update README to reflect full product positioning and product lineup (https://github.com/Infisical/infisical/pull/6819)

### Fixed
- Add ServiceConfig SCIM endpoint and resolve duplicate user error (https://github.com/Infisical/infisical/pull/6885)
- Validate and normalize generated usernames for dynamic secrets (https://github.com/Infisical/infisical/pull/6878)
- Fix React Select component spread to not overwrite styling (https://github.com/Infisical/infisical/pull/6876)
- Run 5 processBucketEvents in parallel (https://github.com/Infisical/infisical/pull/6869)
- Handle NetScaler certificate sync race conditions when same certificate is used across multiple syncs (https://github.com/Infisical/infisical/pull/6850)
- Preserve certificate subject attributes across ACME issuance and discovery (https://github.com/Infisical/infisical/pull/6845)
- Resolve failing Go parsing for no-verify (https://github.com/Infisical/infisical/pull/6841)
- Add redirects for moved PKI certificate-syncs pages in documentation (https://github.com/Infisical/infisical/pull/6835)
- Bump validation and forbidden modal z-indexes to not compete with v2 modals (https://github.com/Infisical/infisical/pull/6831)
- Resolve email not sending for an edge case in SSO (https://github.com/Infisical/infisical/pull/6826)
- Gate certificate manager request access on request-access permission (https://github.com/Infisical/infisical/pull/6810)
- Fix empty environments on overview page (https://github.com/Infisical/infisical/pull/6847)
- Guard createOnUpdateTrigger in add-certificate-requests migration (https://github.com/Infisical/infisical/pull/6763)
- Guard webauthn down() trigger drop with hasTable check (https://github.com/Infisical/infisical/pull/6707)
- Guard against missing organization row in validateJWT (https://github.com/Infisical/infisical/pull/6694)
- Guard JSON.parse on attacker-controlled RelayState in SAML (https://github.com/Infisical/infisical/pull/6691)
- Show 'Connection Required' instead of 'Expected object, received null' when cancelling new connection dialog (https://github.com/Infisical/infisical/pull/6496)
- 
## New Contributors
* @jaydeep-pipaliya made their first contribution in https://github.com/Infisical/infisical/pull/6707
* @cody9swann made their first contribution in https://github.com/Infisical/infisical/pull/6838
* @Manibharadwaj made their first contribution in https://github.com/Infisical/infisical/pull/6763
* @MohdFaizan097 made their first contribution in https://github.com/Infisical/infisical/pull/6496
* @Vligai made their first contribution in https://github.com/Infisical/infisical/pull/6878

**Full Changelog**: https://github.com/Infisical/infisical/compare/v0.161.0...v0.161.1