v2.131.0 v4.12.0
high risk
tanchongmin/strictjsonSep 29, 2026 → Sep 29, 20260 days between releases
What's New
Significant architectural shift: adds OIDC support and security hardening while upgrading React.
Breaking Changes
- React 19.3.0 upgrade may break frontend components.
- Security hardening changes may break existing authentication flows if not configured.
New Features
- OIDC prompt=none support for seamless authorization.
- RFC 9207 iss parameter support in authorization responses.
- Application-level token group format option.
- Max session count for exclusive signin.
Improvements
- Extensive security hardening for OAuth, OIDC, SAML, LDAP, and CAS.
- Upgrade React to 19.3.0 in web application.
- Accept JWT-Standard subject tokens in token exchange.
Bug Fixes
- Add timeout and SSRF guard to SAML and OIDC logout requests.
- Block DSN injection and cross-tenant casbin adapters.
- Block MCP tool allowlist bypass and MicrosoftOnline email takeover.
- Block MFA bypass via required-MFA prompt.
- Block OAuth username binding takeover.
Upgrade Notes
Upgrading to v4.12.0 requires updating React components for React 19.3.0 compatibility. Security hardening changes require review of authentication flows and configuration updates to prevent login failures.
The Two Releases
v2.131.0
Sep 29, 2026· 23 days ago
Adds Apple Keynote chart parsing support and fixes numerous document parsing issues across multiple formats including PDF, Word, PowerPoint, and HTML.
Full release notesv4.12.0
v4.12.0
Sep 29, 2026· 22 days ago
Adds OIDC prompt=none support, upgrades React to 19.3.0, and implements extensive security hardening measures.
Full release notes