v1.31.0

![logto-changelog-2025-08-28](https://github.com/user-attachments/assets/4fa69a59-9d8f-49d6-b8e3-e5f23b4c5e7f)

## Collect user profile at registration

You can now collect user profile information on the last step of the end-user registration flow.

This lets you extend the basic sign-up form with built-in or custom fields so you can immediately capture attributes you need (e.g. name, gender, birthdate, address, custom preferences) before the new user finishes onboarding.

### How to enable

1. Go to Console > Sign-in Experience > Collect user profile.
2. Add fields:
   - Use built-in basics (Name, Gender, Birthdate, Address, …), or
   - Create custom fields (choose type, label, validation rules, required, etc.).
3. Drag & drop to reorder; the order matches the rendered form.
4. Preview or test by signing up a new user (e.g. in the demo app). A "Tell us about yourself" step appears.
5. Registration completes only after all required fields are filled.

Refer to the [documentation](https://docs.logto.io/end-user-flows/collect-user-profile) for more details.

## PBKDF2 support for legacy password verification

We added PBKDF2 (Password-Based Key Derivation Function 2) support to legacy password verification. This improves compatibility when migrating users whose passwords were originally hashed using PBKDF2. (Credit @karerckor)

Example payload for a migrated user:

```json
{
  "username": "john_doe",
  "primaryEmail": "john.doe@example.com",
  "passwordAlgorithm": "Legacy",
  "passwordDigest": "[\"pbkdf2\", [\"mySalt123\", \"1000\", \"20\", \"sha512\", \"@\"], \"c465f66c6ac481a7a17e9ed5b4e2e7e7288d892f12bf1c95c140901e9a70436e\"]"
}
```

Arguments inside the PBKDF2 tuple:

- salt: user-defined salt value
- iterations: number of iterations (e.g. 1000)
- keylen: derived key length (e.g. 20)
- digest: hash algorithm (e.g. sha512)
- @: placeholder for the input password

Refer to the [documentation](https://docs.logto.io/user-management/user-migration#pbkdf2-support) for more details.

## New HTTP SMS connector

A new generic HTTP SMS connector is introduced (`@logto/connector-http-sms`). It allows sending SMS messages via any provider that exposes an HTTP-based API by configuring request method, URL, headers, body mapping, and success criteria. (Credit @michakfromparis)

Use it when a dedicated built-in SMS connector is not yet available for your provider.

## Thai language support

Added Thai translations for both Logto Console and the sign-in experience. This improves localization coverage for Thai-speaking users.

## Security updates and vulnerability fixes

## New Contributors
* @karerckor made their first contribution in https://github.com/logto-io/logto/pull/7585
* @michakfromparis made their first contribution in https://github.com/logto-io/logto/pull/7510
* @hussamelvani made their first contribution in https://github.com/logto-io/logto/pull/7721

**Full Changelog**: https://github.com/logto-io/logto/compare/v1.30.1...v1.31.0