logto Releases

This release is primarily focused on security, upgrading the Golang version to v1.25.9 and addressing multiple critical vulnerabilities in OAuth2 Proxy, including authentication bypasses and session fixation attacks.

Apr 14, 2026

The provided text for this release contains only a title and a link to a different repository (kokoro-tts), with no visible changelog details or specific features for logto-io/logto.

Apr 8, 2026

Major feature release adding OAuth 2.0 Device flow, full passkey sign-in experience, adaptive MFA, and comprehensive session and grant management capabilities.

Mar 31, 2026

A maintenance release that focuses on squashing bugs and improving system stability, including fixes for Unix socket handling, logging, and route building, alongside dependency updates.

Mar 23, 2026

This release introduces significant enhancements for OIDC/JWT handling, including configurable signing algorithms, improved CSRF cookie security, session state extensibility with arbitrary claims, and new configuration validation tools.

Mar 18, 2026

This release provides installation instructions for Crawl4AI v0.8.5 via PyPI and Docker, though Docker images are currently in the process of being built.

Mar 18, 2026

A patch release fixing a version mismatch for the @logto/core-kit package to ensure downstream packages receive the correct extended ID token claims exports.

Feb 28, 2026

Introduces the built-in Account Center app, application context in JWT Customizer scripts, and configurable ID token claims.

Feb 28, 2026

This is a security and stability update for oauth2-proxy that upgrades the Go runtime and dependencies to address security vulnerabilities like CVE-2025-68121, while also improving Redis connection configuration and supply chain security.

Feb 26, 2026

This release introduces a new LoRA-based abliteration engine with 4-bit quantization, expands model support to include Vision-Language (VL) models, and enhances optimization workflows with save/resume capabilities and improved memory management.

Feb 14, 2026

This release introduces wildcard redirect URI support for dynamic environments, fine-grained token exchange control per application, and the ability to trust unverified emails for SSO connectors. Additional improvements include a new option to skip required identifiers for social sign-in and enhanced user role API responses.

Jan 30, 2026

This release enhances reCAPTCHA configuration with domain customization and Enterprise checkbox mode options, and expands third-party application support to SPA and native app types. Additional improvements include client IP tracking in passwordless connectors and email/SMS template fallbacks.

Dec 30, 2025

This release focuses on expanding hardware compatibility and model support for the Heretic framework. It introduces new capabilities such as multi-GPU support, Apple Silicon (MPS) optimization, and support for IBM Granite MoE and thinking models, alongside various bug fixes and improvements for data handling.

Dec 10, 2025

This release improves cross-app authentication stability by isolating callbacks per application, introduces a new Identifier.Lockout webhook event, and fixes refresh token TTL to honor the configured 180-day lifespan. Additional fixes include email verification code template selection and case-insensitive SSO domain matching.

Nov 28, 2025

Nov 16, 2025

This release adds Account Center Configuration in Logto Console, introduces MFA Skip Controls API endpoints, and fixes compatibility issues with older Android and browser versions. Additional improvements include audit log enhancements and body-based Personal Access Token APIs.

Oct 31, 2025

This release introduces email and phone MFA support with OTP verification, adds OIDC ui_locales parameter support for language customization, and enables Twilio risk control configuration. Additional features include X connector email address syncing and WebAuthN rpId domain binding fixes.

Sep 30, 2025

Adds the ability to collect user profile information at registration, PBKDF2 support for legacy password verification, and a new generic HTTP SMS connector.

Aug 29, 2025

This release introduces custom model paths and stricter model file validation.

Aug 17, 2025

A minor patch release focused on internal maintenance and CI pipeline stability.

Aug 14, 2025