Changelog Features fb38eae feat: add group add/delete actions to group tree page 39a1bba feat: support popup mode for Captcha providers Bug fixes 0f629eb fix: URL-encode OAuth state on interactive login, consent, prompt, signup and post-logout redirects 1d65427 fix: allow only global admins to change applications' custom HTML f82480a fix: allow org admins to import groups, roles and permissions vi…
Changelog Features d60b5ae feat: add configurable password history check e1aa116 feat: add organization-level defaultTokenFields for new applications d6f2cb6 feat: show device, IP and last active time for each session e7f2799 feat: support app-level dark logo fbacaea feat: support group-level subscriptions ed417c1 feat: support invite-only pricing Bug fixes 3eb9231 fix(web): keep draft rows in key…
Changelog Features 8e48365 feat: fall back to user/list_id in WeCom syncer a61599b feat: support department sync in WeCom syncer Bug fixes 311f4d1 fix(auth): drop the panel card on a phone 0b1a605 fix: keep LDAP auto-sync alive after a connection panic e8db3f9 fix: list all organizations' rows when "All" is selected f886a09 fix: report the real reason when uploading users fails 1f86f4c fix: report…
Changelog Features cc39a93 feat(auth): redesign the sign-in, sign-up and forget pages and fix dark mode d353b15 feat: group release notes by commit type Bug fixes 75420fc fix(apple): use the real name from Sign in with Apple as the display name a2fb878 fix(auth): drop the app name heading from the signup and login pages 93cb910 fix(auth): keep the sign-in query string on the forget and organizatio…
Changelog 3659a08 ci: release from a manually pushed tag instead of semantic-release 0c42632 feat: add OIDC provider type babdb25 feat: add a command palette, bulk row selection and inline form validation 7685f8e feat: lay out console forms in two columns and let list tables hide columns bfe0353 feat: let an LDAP server opt in to password reset b6e2abd feat: mark which groups granted each of a use…
4.0.0 (2026-09-01) Features replace the Ant Design console with the shadcn/ui frontend (38ecc6e) BREAKING CHANGES web/ now holds the shadcn/ui frontend built with Vite. Its build output layout changed from create-react-app's build/static/{js,css} to Vite's build/assets/, so anything serving Casdoor's static files through a CDN or a reverse proxy needs its paths updated. The Ant Design frontend is…
3.164.0 (2026-08-30) Features add missing organization segment to syncer add URL (54df9cc)
3.163.3 (2026-08-30) Bug Fixes do not re-init login theme algorithm from localStorage (#5773) (8931d09)
3.163.2 (2026-08-30) Bug Fixes reject duplicate email and phone before sending signup code (44a81f4)
3.163.1 (2026-08-30) Bug Fixes correct Ukrainian (uk) i18n translations (#5775) (bde0144)
3.163.0 (2026-08-28) Features migrate more code to web2 (bb9a309)
3.162.0 (2026-08-28) Features add MFA setup and captcha to web2 (7fb280b)
3.161.1 (2026-08-27) Bug Fixes migrate the frontend from antd to shadcn/ui in web2 (a96940f)
3.161.0 (2026-08-27) Bug Fixes signinMethods "Hide password" rule not enforced server-side (#5762) (dc88244) Features support SAML IdP-initiated SSO (e2dd9bf)
3.160.1 (2026-08-27) Bug Fixes signinMethods "Hide password" rule not enforced server-side (#5762) (2bfc378)
3.160.0 (2026-08-27) Features respect application theme when computing dark mode (dbfe1c6)
3.159.0 (2026-08-25) Features add enableGroups switch to the LDAP edit page (5f08e4c)
3.158.0 (2026-08-22) Features support Alipay open_id when user_id is absent (e6b2338)
3.157.1 (2026-08-22) Bug Fixes fix MCP proxy auth response, upstream token saving and credential leak (1e22a95) return 401 with WWW-Authenticate for MCP proxy requests (dde6d97)
3.157.0 (2026-08-22) Features look up MCP applications under the admin owner (3a868ed)
3.156.2 (2026-08-21) Bug Fixes let forceLanguage override the signed-in user's language (e052776)
3.156.1 (2026-08-21) Bug Fixes rewrite README and add golangci-lint workflow (1f13f04)
3.156.0 (2026-08-21) Features keep the RFC 8707 resource audience on the refresh_token grant (#5744) (0be103d)
3.155.2 (2026-08-21) Bug Fixes mask more sensitive fields in GetMaskedApplication() (f7bc795)
3.155.1 (2026-08-21) Bug Fixes revoke old OAuth tokens on exclusive signin (5fff543) show WebAuthn credential ID in base64url (4bcba16)
3.155.0 (2026-08-21) Features avoid blank page when the frontend fails to load (8eeb8b9) don't overwrite userAccountControl on AD password reset (3dbb7db)
3.154.4 (2026-08-18) Bug Fixes PostgreSQL queries on token.user column (#5740) (edfbb93)
3.154.3 (2026-08-16) Bug Fixes retry helm chart push on non-fast-forward (03adcaf)
3.154.2 (2026-08-16) Bug Fixes enforce password update and MFA setup on the server side (36c3971)
3.154.1 (2026-08-16) Bug Fixes respect the columns whitelist when an admin updates a user (061c36f)