v19.3.0 version/2026.2.7
facebook/astryxSep 9, 2026 → Sep 9, 20260 days between releases
What's New
Security hardening and policy engine updates in the newer release
Breaking Changes
- Dropped curl and runit from lifecycle/container
New Features
- Improved policy engine filtering
- Enhanced identification stage security with dynamic captcha keys
- Multiple security patches applied
Improvements
- Avoids DNS resolution in fqdn_rand function
- use constant-time comparison in SecretKeyFilter
- Bumped Django from 5.2.16 to 5.2.17
- return the intended status code from error views for all request methods
Bug Fixes
- fix scim changed detection for nested attributes
- handle unsupported HTTP method
Upgrade Notes
Ensure your deployment configuration no longer depends on curl or runit in the lifecycle/container. Review the security backports applied to group hierarchy, email recipients, SAML, and secrets.
The Two Releases
19.3.0 (September 9, 2026)
Sep 9, 2026· 1 month ago
This release introduces View Transition animations, Fragment Refs, and a new `browser()` API for React DOM to handle server-side rendering boundaries, alongside performance improvements for transitions.
Full release notesRelease 2026.2.7
Sep 9, 2026· 1 month ago
Bug fixes and security hardening including removal of unnecessary components, policy engine improvements, and multiple security backports.
Full release notes