v1.6.8 backend/v2.6.0
feder-cr/invisible_dotsJun 1, 2026 → Jun 5, 20264 days between releases
What's New
Newer release adds inactivity logouts and WebAuthn signature checks; it shares no overlap with v1.6.8's notes.
Breaking Changes
- The version jumps from v1.6.8 to backend/v2.6.0 under a different versioning namespace, and the notes document no migration path, so treat the upgrade as potentially breaking.
- Sessions can now be terminated server-side when no activity is detected, which changes effective session lifetime for existing clients.
- The /sessions/validate response gains an idle_expires_at field, which may break consumers that validate responses against a strict schema.
New Features
- Inactivity logouts that proactively terminate user sessions after a configurable period without activity.
- A new idle_expires_at timestamp returned by /sessions/validate so frontends can warn users before an idle logout.
- WebAuthn credential signature count checking to detect cloned or replayed authenticators.
Improvements
- Frontend dependency bumps including Vue, Prettier, the Vite React plugin, css-loader and Turbo.
- Backend dependency bump of the koanf configuration library.
- Webhook trigger requests now respect a timeout instead of hanging indefinitely.
Bug Fixes
- The email claim is now correctly handled as (*)EmailJWT when reading JWTs.
- Webhook trigger request timeouts are now handled rather than left unhandled.
Upgrade Notes
The two release notes describe largely disjoint feature sets and use different version namespaces, so verify you are upgrading the intended artifact before proceeding. If this is a genuine upgrade, set the new idle-timeout configuration explicitly to preserve current session lifetimes and update any client that strictly parses /sessions/validate responses. Enable the WebAuthn signature count check only after confirming your authenticators report valid counters, since some passkeys always return zero.
The Two Releases
v1.6.8
Jun 1, 2026· 5 months ago
This release introduces cross-platform support via PyEmscripten wheels and updates embedding support for Gemini dimensions.
Full release notesHanko v2.6: Inactivity Logout
Jun 5, 2026· 5 months ago
This release introduces Inactivity Logouts, which allow user sessions to be proactively terminated if no activity is detected. It adds a new configuration option and an `idle_expires_at` timestamp to the session validation endpoint for better frontend integration.
Full release notes