backend/v2.5.0 v7.15.0
feder-cr/invisible_dotsMar 3, 2026 → Mar 18, 202615 days between releases
What's New
Version jump to v7.15.0 adds OIDC signing config, CSRF cookie controls, config validation, and Unix socket support.
Breaking Changes
- CSRF cookie expiration validation now uses CSRFExpire instead of Expire, which can change session timeout behavior for existing configurations.
New Features
- OIDC JWT signing algorithms are now configurable.
- CSRF cookies support a SameSite option and proper expiration validation.
- A --config-test flag validates configuration before startup.
- Unix socket file modes can now be configured.
- Session state can be extended with arbitrary claims from the ID Token and upstream IDP user profiles endpoint.
Improvements
- Arbitrary claim support enables additional header values and an extended OAuth2 Proxy UserInfo endpoint.
- Windows binaries are now distributed with the .exe extension.
Bug Fixes
- Fixed the backend logout URL call on sign out.
Upgrade Notes
Review cookie-csrf-expire and session timeout settings because CSRF cookie validation now uses CSRFExpire instead of Expire. Use --config-test to validate configuration before rollout. The release notes do not document a migration path from backend/v2.5.0 to v7.15.0, so treat this as a major upgrade and test OIDC and session behavior thoroughly.
The Two Releases
Hanko 2.5
Mar 3, 2026· 8 months ago
A security-focused release adding user profile attributes, AMR claims to tokens, and extending the `/me` endpoint, plus critical security fixes.
Full release notesv7.15.0
Mar 18, 2026· 7 months ago
A feature-rich release introducing configuration flexibility for OIDC, CSRF cookies, and session claims, alongside Unix socket support.
Full release notes