v1.28.0

![logto-changelog-2025-05-26](https://github.com/user-attachments/assets/e24a1975-90a4-44b7-af57-54471c9c78bc)

## Email blocklist policy
We've introduced a comprehensive email blocklist policy system with a dedicated settings page in the Logto console's Security section. This new feature provides granular control over which email addresses can be used for sign-up and account linking.

With this new policy, you can:
- Customize email restrictions through a flexible blocklist system
- Prevent sign-ups or account linking with specific email addresses or domains
- Control email subaddressing (e.g., 'user+tag@example.com')

## Phone number validation and normalization
We've improved phone number handling to ensure consistent format validation and storage:

- Added proper handling for phone numbers with leading zeros in national format
  - Normalizes numbers like +61 (0)2 1234 5678 to +61 2 1234 5678
  - Users can sign in with either format (with or without leading zero)
  - Existing accounts can still use their original phone number format
- Implemented stricter phone number format validation in database
- Fixed phone number format inconsistencies (GitHub issue #7371, thanks for @mrfrase3)

## QQ social connector
We've expanded our social sign-in options by introducing a new QQ social connector specifically designed for web applications, enabling seamless QQ account integration for your users. (Contributed by @yenharvey in #7380)

## OIDC connector
We've updated our OIDC connector configuration to make the `userinfo_endpoint` field optional. The system now intelligently handles user data extraction based on available endpoints, providing a more flexible authentication solution while maintaining OIDC specification compliance.

This update enables:
- Seamless integration with Azure AD B2C SSO applications
- Automatic fallback to `id_token` claims when `userinfo_endpoint` is unavailable
- Full compatibility with standard OIDC providers
- Removal of integration barriers for non-standard OIDC implementations

## Improvements
- Enhanced translation key synchronization to handle empty files during sync process, eliminating manual intervention needs
- Upgraded to `gpt-4.1` as the default translation model for better cost-efficiency
- Improved CAPTCHA configuration visibility in console with persistent toggle display
- Updated CAPTCHA settings navigation to /security/captcha

## Bug fixes
- Added missing CAPTCHA box to identifier sign in form

**Full Changelog**: https://github.com/logto-io/logto/compare/v1.27.0...v1.28