Starstruk Logo MarkStarstruk

v3.267.0 backend/v3.1.0

high risk

teamhanko/hankoOct 1, 2026 → Oct 1, 20260 days between releases

What's New

Older tag is a Pulumi release, not Hanko; Hanko v3.1.0 adds Organizations/Roles but changes client IP default.

Breaking Changes

  • Client IP resolution now defaults to 'direct' instead of 'x_forwarded_for', so deployments behind a reverse proxy or load balancer must explicitly reconfigure this setting or risk incorrect IP-based behavior.

New Features

  • Organization and Role management APIs allow grouping users into tenant-scoped organizations with per-membership role assignments.
  • Custom claim definitions and mapping let applications surface SAML/OIDC identity provider attributes as claims.
  • Session lifecycle webhook events enable reacting to session creation and termination.
  • Tenant-scoped user IDs change how user identity is keyed across tenants.
  • A static passcode generator is now available.

Improvements

  • User import flows were reworked for better handling of bulk identity data.
  • Organizations, memberships, and role bindings are consistently scoped to their Hanko tenant.
  • Session validation responses now expose organization memberships and roles, reducing extra lookups.
  • Role checks can be performed directly against a session via a dedicated endpoint.

Bug Fixes

  • A rate limit bypass vulnerability was closed.
  • Several additional security issues were addressed in this release.

Upgrade Notes

The older tag referenced here belongs to the Pulumi project, so no genuine Hanko-to-Hanko delta can be derived; treat v3.1.0 as a baseline rather than an incremental upgrade. If Hanko sits behind a proxy, explicitly set client IP resolution back to x_forwarded_for before deploying, and audit any code that assumes globally unique user IDs now that IDs are tenant-scoped.

The Two Releases

v3.267.0

v3.267.0

Oct 1, 2026· 21 days ago

Pulumi v3.267.0 addresses critical bug fixes in the CLI regarding template cloning and Python plugin installation.

Full release notes
backend/v3.1.0

Hanko v3.1

Oct 1, 2026· 21 days ago

Hanko v3.1 introduces Organizations and Roles for B2B applications, Custom Claims and Mapping for identity providers, session lifecycle webhooks, and security fixes.

Full release notes