# Release Notes

Browse our release notes for detailed information on the latest features, bug fixes, and improvements in FusionAuth.

> For the index of this section of the site, see [llms.txt](https://4002.18-224-161-104.sslip.io/docs/llms.txt)

For the best experience, always upgrade to the latest version of FusionAuth. For more information about upgrading, see our [Upgrade FusionAuth Guide](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md).

For a high-level overview of changes in each release, see the [Release Updates topic on our Blog](https://4002.18-224-161-104.sslip.io/blog/category/release-updates.md).

Jump to a release versionJump to a version...1.69.41.69.31.69.21.69.11.69.01.68.0 (Intelligent Kamfa)1.67.11.67.01.66.01.65.0 (Tenant Manager SSO Tasmanian Mountain Skink)1.64.11.64.0 (Secret Shibe)1.63.0 (Proof Pangolin)1.62.11.62.0 (Refined Reindeer)1.61.21.61.11.61.0 (Flexible Fox)1.60.21.60.11.60.0 (Prompt Param Piranha)1.59.11.59.0 (Identity Ibex)1.58.31.58.21.58.11.58.0 (Delegation Dolphin)1.57.11.57.0 (Webhook Wombat)1.56.0 (SSO Snake)1.55.1 (Holiday Hippo)1.54.0 (Express Free Trial (EFT) Elephant)1.53.31.53.21.53.11.53.0 (Lambda Llama)1.52.11.52.0 (Passkey Platypus)1.51.21.51.11.51.0 (Theming Toucan)1.50.11.50.0 (Scopes Salamander)1.49.21.49.1 (Bugfix Beluga)1.48.31.48.21.48.11.48.0 (Webhook Walrus)1.47.11.47.0 (Performance Panther)1.45.41.43.21.46.0 (Octagonal Ocelot)1.45.31.45.21.45.11.45.0 (Dapper Duck)1.44.01.43.11.43.01.42.11.42.01.41.31.41.21.41.11.41.01.40.21.40.11.40.01.39.01.38.11.38.01.37.21.37.11.37.01.36.81.36.71.36.61.36.51.36.41.36.31.36.21.36.11.36.01.35.01.34.11.34.01.33.01.32.11.32.01.31.01.30.21.30.11.30.01.29.41.29.31.29.21.29.11.29.01.28.11.28.01.27.21.27.11.27.01.26.11.26.01.25.01.24.01.23.31.23.21.23.11.23.01.22.21.22.11.22.01.21.01.20.11.20.01.19.81.19.71.19.61.19.51.19.41.19.31.19.21.19.11.19.01.18.81.18.71.18.61.18.51.18.41.18.31.18.21.18.11.18.01.17.51.17.41.17.31.17.21.17.11.17.01.16.11.16.01.16.01.15.81.15.71.15.61.15.51.15.41.15.31.15.21.15.11.15.01.14.01.13.21.13.11.13.01.12.01.11.01.10.11.10.01.9.21.9.11.9.01.8.1 RC11.8.0 RC11.7.41.7.31.7.21.7.11.7.01.6.01.5.01.4.01.3.11.3.01.2.21.2.11.2.01.1.11.1.01.0.181.0.171.0.161.0.151.0.141.0.13

Show only these categoriesTheme UpgradeNew FeatureEnhancementKnown IssueDeprecatedFixSecurityInternalSDKBreaking ChangeDatabase Migration

## Version 1.69.4

14 October 2026

[Security](#security--cjmh)

Fixed multiple security vulnerabilities that could result in account takeover, privilege escalation, authentication bypass, or exposure of sensitive information. We have no evidence or customer reports indicating these vulnerabilities have been exploited. We recommend all customers upgrade as soon as possible.

## Version 1.69.3

28 September 2026

[Fix](#since-1-69-2--fix--q970)

Fixed an issue with the [Passwordless APIs](https://4002.18-224-161-104.sslip.io/docs/apis/passwordless/start-passwordless-login.md) where non-encoded query parameters cause an `HTTP 403` error on `/confirmation-required` pages.

This issue only affected customers who:

*   modified templates in a way that removed `value?url` from the state list used to build the URL.
*   used the APIs to build an `/oauth2/passwordless` link without encoding the query parameters.

Since: [1.69.2](#version-1-69-2)

## Version 1.69.2

14 September 2026

[Known Issue](#v-1-69-3--known-issue--nzqw)

When using the [Passwordless APIs](https://4002.18-224-161-104.sslip.io/docs/apis/passwordless/start-passwordless-login.md), non-encoded query parameters cause an `HTTP 403` error on `/confirmation-required` pages.

This issue only affects customers who:

*   modified templates in a way that removed `value?url` from the state list used to build the URL.
*   use the APIs to build an `/oauth2/passwordless` link without encoding the query parameters.

To work around this issue, manually URL encode all query parameters before sending them to `/oauth2/passwordless`.

[Security](#security--5djz)

Fixes a critical security issue that could result in account takeover.

## Version 1.69.1

1 September 2026

[Fix](#fix--e5x6)

Fixed an issue affecting some FusionAuth Cloud deployments.

## Version 1.69.0

18 August 2026

[Breaking Change](#breaking-change--ctab)

Tightened restrictions around which keys may be used to verify JWTs and SAML payloads. You **must update your configuration before upgrading to `1.69.0`** if your instance meets any of the following criteria:

*   you have recently rotated JWT signing keys according to the [key rotation documentation](https://4002.18-224-161-104.sslip.io/docs/operate/secure/key-rotation.md)
*   you use an external [SAML](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers/overview-samlv2.md) or [JWT](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers/external-jwt.md) Identity Provider (IdP) that rotates signing keys
*   you use [FusionAuth as a SAML IdP](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/saml.md) with required signing of authentication or logout requests and have rotated keys recently

For a full list of required changes, see the [migration guide](https://4002.18-224-161-104.sslip.io/docs/operate/troubleshooting/1-69-0-migration-guide.md).

[New Feature](#new-feature--issue-3504--2b1v)

Added an AI Agent Entity type. This entity type has one permission, `call`, which allows something to call the agent.

[3504](https://github.com/FusionAuth/fusionauth-issues/issues/3504)

[New Feature](#new-feature--issue-3162--oc21)

Added a webhook that captures creation of, updates to, and deletion of Entities.

[3162](https://github.com/FusionAuth/fusionauth-issues/issues/3162)

[Enhancement](#enhancement--cgow)

Added explicit parameters to tenants, applications, and IDPs to support key rotation. See [the 1.69.0 migration guide](https://4002.18-224-161-104.sslip.io/docs/operate/troubleshooting/1-69-0-migration-guide.md) for more information. This also changes this recommended key rotation process. See the [key rotation documentation](https://4002.18-224-161-104.sslip.io/docs/operate/secure/key-rotation.md) for more information.

[Enhancement](#enhancement--issue-2807--qmbw)

Added events to the [Audit Log](https://4002.18-224-161-104.sslip.io/docs/apis/audit-logs.md) that capture adding a user to a group and removing a user from a group.

[2807](https://github.com/FusionAuth/fusionauth-issues/issues/2807)

[Enhancement](#enhancement--issue-3209--li32)

Added support for overriding the SAML v2 service provider (SP) EntityId using **`identityProvider.issuer`** on standard SAML v2 identity providers (IdPs).

When configured, FusionAuth uses this value as the SP EntityId and expects the same value in the SAML assertion Audience.

[3209](https://github.com/FusionAuth/fusionauth-issues/issues/3209)

[Enhancement](#enhancement--issue-3485--8b4z)

Added a link from self-service account edit back to the source application. Advanced themes used to have to add a backlink manually, and simple themes dead-ended; now your users don't have to close the tab, they can return to your app.

[3485](https://github.com/FusionAuth/fusionauth-issues/issues/3485)

[Enhancement](#enhancement--issue-3542--87ha)

Added support for sending a pre-hashed password to FusionAuth when changing a user's password with the [User API](https://4002.18-224-161-104.sslip.io/docs/apis/users/change-password.md). Use the `passwordFieldType` field to specify a `hashed` value, then pass values for `user.encryptionScheme`, `user.factor`, `user.password`, and `user.salt`. The [Import API](https://4002.18-224-161-104.sslip.io/docs/apis/users/import.md) already supports this configuration.

[3542](https://github.com/FusionAuth/fusionauth-issues/issues/3542)

[Enhancement](#enhancement--issue-1383--7dlu)

Added support for the `iss` OAuth 2.0 Authorization Server Issuer Identification standard, [RFC 9207](https://datatracker.ietf.org/doc/html/rfc9207).

[1383](https://github.com/FusionAuth/fusionauth-issues/issues/1383)

[Theme Upgrade](#theme-upgrade--2q6x)

Updated the default theme templates to correctly display labels for [custom form fields](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/advanced-registration-forms.md#custom-form-fields). If you maintain a customized advanced theme, see [Advanced Theme Upgrade Notes](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade.md) for the required changes.

[Fix](#since-1-68-0--fix--issue-3523--xpsi)

Fixed an issue where the Impossible Travel [Risk Signal](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/risk-signals.md) always returned status `LOW` if the instance had not yet fetched the IP geolocation dataset. Now, the signal does not report any value if the dataset has not yet been fetched.

Since: [1.68.0](#version-1-68-0)

[3523](https://github.com/FusionAuth/fusionauth-issues/issues/3523)

[Fix](#since-1-68-0--fix--issue-3533--odsz)

Fixed an issue that could prevent a user from completing a registration missing required fields for a [social IdP](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers.md).

Since: [1.68.0](#version-1-68-0)

[3533](https://github.com/FusionAuth/fusionauth-issues/issues/3533)

[Fix](#since-1-68-0--fix--issue-3538--2a5h)

Fixed an issue that could prevent a custom form field label from appearing on a registration form.

Since: [1.68.0](#version-1-68-0)

[3538](https://github.com/FusionAuth/fusionauth-issues/issues/3538)

[Fix](#since-1-50-1--fix--issue-2743--vrov)

Fixed an issue that could prevent a inactive IdP from displaying correctly in the Admin UI.

Since: [1.50.1](#version-1-50-1)

[2743](https://github.com/FusionAuth/fusionauth-issues/issues/2743)

[Fix](#since-1-57-0--fix--issue-3089--ls8e)

Fixed an issue where User MFA method validation did not check for duplicates when providing an `id` for the method. This allowed a user to add the same email account or phone number multiple times.

Since: [1.57.0](#version-1-57-0)

[3089](https://github.com/FusionAuth/fusionauth-issues/issues/3089)

[Fix](#since-1-53-0--fix--issue-3222--2blz)

Fixed an issue where a Generic Connector configured with a Login Validation Lambda would *always* fail on first login for each user with `Unexpected FusionAuth error`.

Since: [1.53.0](#version-1-53-0)

[3222](https://github.com/FusionAuth/fusionauth-issues/issues/3222)

[Fix](#since-1-68-0--fix--issue-3525--ncaz)

Fixed an issue where enabling "Email Plus content" on a consent failed to send an email with an error: `Cannot read field "baseURL" because "tenant" is null`.

Since: [1.68.0](#version-1-68-0)

[3525](https://github.com/FusionAuth/fusionauth-issues/issues/3525)

[Fix](#since-1-67-1--fix--issue-3508--3hrd)

Fixed an issue where, in account self-service, clicking the Change password repeatedly would disconnect the toggle state from the password change section visibility.

Since: [1.67.1](#version-1-67-1)

[3508](https://github.com/FusionAuth/fusionauth-issues/issues/3508)

[Fix](#since-1-63-0--fix--issue-3384--svcn)

Fixed an issue where the default Enterprise User SCIM schema `meta.location` field contains a duplicate path segment, making it invalid.

Since: [1.63.0](#version-1-63-0)

[3384](https://github.com/FusionAuth/fusionauth-issues/issues/3384)

[Fix](#since-1-63-0--fix--issue-3385--vrko)

Fixed an issue where the SCIM Group schema did not mark `displayName` as required, even though the specification requires it.

Since: [1.63.0](#version-1-63-0)

[3385](https://github.com/FusionAuth/fusionauth-issues/issues/3385)

[Fix](#since-1-61-0--fix--issue-3273--99l9)

Fixed an issue where SCIM Group reconciliation deleted manually-assigned Group roles during the Microsoft Entra ID provisioning cycle.

Since: [1.61.0](#version-1-61-0)

[3273](https://github.com/FusionAuth/fusionauth-issues/issues/3273)

[Fix](#since-1-40-0--fix--issue-3268--b9q9)

Fixed an issue where the Admin UI displayed keys that could not be used for the current task in the key dropdown (e.g. the JWT signing key dropdown would display a public key). Selecting an invalid key resulted in a validation error.

Since: [1.40.0](#version-1-40-0)

[3268](https://github.com/FusionAuth/fusionauth-issues/issues/3268)

[Fix](#since-1-61-0--fix--issue-3462--4ewu)

Fixed an issue where the `PATCH /api/application/{id}` API returned an error for applications whose name is duplicated across Tenants.

Since: [1.61.0](#version-1-61-0)

[3462](https://github.com/FusionAuth/fusionauth-issues/issues/3462)

[Fix](#fix--issue-3531--3aah)

Improved the performance of the User consents database when many consents are present.

[3531](https://github.com/FusionAuth/fusionauth-issues/issues/3531)

[Fix](#fix--issue-3513--twaq)

Fixed multiple gaps and inaccuracies in the [FusionAuth OpenAPI spec](https://4002.18-224-161-104.sslip.io/docs/apis/openapi.md).

[3513](https://github.com/FusionAuth/fusionauth-issues/issues/3513)

[Fix](#fix--issue-3538--8v4f)

Fixed an issue where custom form field labels were not displayed on the Account, OAuth2 Register, and OAuth2 Complete Registration pages.

[3538](https://github.com/FusionAuth/fusionauth-issues/issues/3538)

[Security](#security--gn5m)

Fixed a known Denial of Service (DoS) issue.

[Security](#security--ppe1)

Fixed a denial of service attack in Prime MVC.

[Security](#security--fx4k)

Fixed denial of service attack in java-http.

[Security](#security--sk6i)

Fixed a privilege escalation vulnerability wherein a `theme_manager` could escape the template sandbox and execute code on the host.

[Security](#security--b5yk)

Fixed an issue where an authorization code could be used more than once in limited circumstances.

[Security](#security--skal)

Fixed an issue where the WebAuthn verification pipeline did not correctly check the relying party.

[Security](#security--dv0k)

Fixed an issue where the Admin UI search interface did not fully sanitize certain query characters.

[Security](#security--35c8)

Fixed an issue where less-privileged roles such as `email_template_manager` could access information about recent logins.

[SDK](#sdk--6uwe)

Released [React SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/react-sdk.md) `2.7.0` with support for [Demonstrating Proof-of-Possession (DPoP)](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/dpop.md).

[SDK](#sdk--mjer)

Released [Angular SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/angular-sdk.md) `2.1.0` with support [Demonstrating Proof-of-Possession (DPoP)](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/dpop.md).

[SDK](#sdk--nt30)

Released [Vue SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/vue-sdk.md) `1.4.0` with support for [Demonstrating Proof-of-Possession (DPoP)](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/dpop.md).

[Internal](#internal--issue-3522--pdn1)

Updated the following dependencies:

Java:

*   JVM `21.0.11_10` -> `25.0.3_9`
*   `com.fasterxml.jackson.core:jackson-core` `2.21.4` -> `2.21.5`
*   `com.fasterxml.jackson.core:jackson-databind` `2.21.4` -> `2.21.5`
*   `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor` `2.21.4` -> `2.21.5`
*   `com.inversoft:inversoft-database` `0.10.3` -> `0.10.4`
*   `io.fusionauth:java-http` `1.4.1` -> `1.4.2`
*   `org.jsoup:jsoup` `1.21.2` -> `1.23.1`
*   `org.postgresql:postgresql` `42.7.11` -> `42.7.12`
*   `org.primeframework:prime-mvc` `5.10.4` -> `5.11.2`

Javascript:

*   `cli/node_modules/brace-expansion` `1.1.15` -> `1.1.18`
*   `jshint/node_modules/brace-expansion` `1.1.15` -> `1.1.18`

[3522](https://github.com/FusionAuth/fusionauth-issues/issues/3522)

## Version 1.68.0 (Intelligent Kamfa)

30 June 2026

[Breaking Change](#breaking-change--bgrr)

The [Retrieve Recovery Codes](https://4002.18-224-161-104.sslip.io/docs/apis/two-factor/retrieve-recovery-codes.md) endpoint (`GET /api/user/two-factor/recovery-code/{userId}`) (deprecated since `1.64.0`), now always returns an empty list. Because recovery codes are now hashed at rest, they can no longer be retrieved in plaintext after creation.

If you need to provide a user access to their recovery codes, use the [Generate Recovery Codes](https://4002.18-224-161-104.sslip.io/docs/apis/two-factor/generate-recovery-codes.md) API (`POST /api/user/two-factor/recovery-code/{userId}`) to generate a new set.

[Fix](#since-1-66-0--fix--issue-3503--motc)

Fixed an issue where [Connectors configured for a specific domain in a Tenant](https://4002.18-224-161-104.sslip.io/docs/lifecycle/migrate-users/connectors.md#connector-policies) could be called for users outside of that domain.

Because this fix restores functionality to previously non-functioning domain configurations, **check your Connectors to ensure they have the correct domains** before upgrading.

If you upgrade and cannot access a Connector, check your domain settings -- you may have previously configured them incorrectly, but not noticed since domain configuration was not functional.

Since: [1.66.0](#version-1-66-0)

[3503](https://github.com/FusionAuth/fusionauth-issues/issues/3503)

[New Feature](#new-feature--issue-3502--uybf)

Introduced [Intelligent MFA](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/contextual-multi-factor.md#intelligent-mfa), which uses a collection of signals to trigger MFA challenges for users based on the unique risk level of a given login attempt.

[3502](https://github.com/FusionAuth/fusionauth-issues/issues/3502)

[New Feature](#new-feature--4bjj)

To support Intelligent MFA, added three new MFA lifecycle webhooks:

*   [User Two-Factor Challenge](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/events/user/user-two-factor-challenge.md)
*   [User Two-Factor Failed Attempt](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/events/user/user-two-factor-failed-attempt.md)
*   [User Two-Factor Success](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/events/user/user-two-factor-success.md)

[New Feature](#new-feature--issue-457--s67f)

Email and message templates can now build links using the new `baseUrl` [variable](https://4002.18-224-161-104.sslip.io/docs/messengers/template-reference.md), instead of hard-coding a URL.

[457](https://github.com/FusionAuth/fusionauth-issues/issues/457)

[New Feature](#new-feature--issue-3473--2hzp)

Created the [MFA Deleter](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/types/roles.md#the-mfa_deleter-role) role, a granular permission that enables a user to remove an MFA method from a user account without full FusionAuth administrator permissions.

[3473](https://github.com/FusionAuth/fusionauth-issues/issues/3473)

[Enhancement](#enhancement--iedb)

When importing users via the [Import Users API](https://4002.18-224-161-104.sslip.io/docs/apis/users/import.md) with plaintext recovery codes, FusionAuth will now hash each code during import. For large imports containing many users with recovery codes, this will increase import time.

To avoid this overhead, you may pre-hash recovery codes before import and provide `twoFactor.recoveryCodeEncryptionScheme` and `twoFactor.recoveryCodeWorkFactor` alongside the pre-hashed values in `twoFactor.recoveryCodes`. For more information, see the [Import Users API](https://4002.18-224-161-104.sslip.io/docs/apis/users/import.md).

[Enhancement](#enhancement--issue-2739--tdxp)

Users can now specify a custom name when adding a two-factor method. This helps to disambiguate during MFA method selection and management. You can rename existing methods using the API or self-service.

[2739](https://github.com/FusionAuth/fusionauth-issues/issues/2739)

[Known Issue](#v-1-69-0--known-issue--via-3525--vl8x)

Enabling "Email Plus content" on a consent fails to send an email with an error: `Cannot read field "baseURL" because "tenant" is null`.

Resolved in version [1.69.0](#version-1-69-0) via [3525](https://github.com/FusionAuth/fusionauth-issues/issues/3525).

[Known Issue](#v-1-69-0--known-issue--via-3523--9l6b)

The Impossible Travel [Risk Signal](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/risk-signals.md) always reports status `LOW` if the instance has not yet fetched the IP geolocation dataset.

Resolved in version [1.69.0](#version-1-69-0) via [3523](https://github.com/FusionAuth/fusionauth-issues/issues/3523).

[Known Issue](#v-1-68-0--known-issue--dphd)

A user may be unable to complete a registration missing required fields for a [social IdP](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers.md).

[Fix](#v-1-68-0--fix--via-3538--p6kj)

Custom form field labels may not appear correctly on registration forms.

Resolved in version [1.68.0](#version-1-68-0) via [3538](https://github.com/FusionAuth/fusionauth-issues/issues/3538).

[Fix](#fix--issue-3323--9v1f)

When creating an Application in an instance with only a single Tenant, FusionAuth no longer displays a Tenant dropdown with a single entry. Instead, the application automatically uses the only Tenant.

[3323](https://github.com/FusionAuth/fusionauth-issues/issues/3323)

[Fix](#since-1-52-0--fix--issue-3519--2n1t)

Fixed an issue where supplying a value of any type other than a `long` for instant fields (e.g. `insertInstant`) returned a `500` status code.

Since: [1.52.0](#version-1-52-0)

[3519](https://github.com/FusionAuth/fusionauth-issues/issues/3519)

[Fix](#since-1-67-0--fix--issue-3517--u471)

Fixed an issue where users that lacked the privilege to remove an MFA method (e.g. `user_manager`) would see a (non-functional) **Delete** button for MFA methods on the User Management page of the Admin UI.

Since: [1.67.0](#version-1-67-0)

[3517](https://github.com/FusionAuth/fusionauth-issues/issues/3517)

[Fix](#since-1-66-0--fix--issue-3497--lfn0)

Changed the default Tenant issuer from `acme.com`, which is not a valid URL, to the public base URL (which ought to be a valid URL).

Since: [1.66.0](#version-1-66-0)

[3497](https://github.com/FusionAuth/fusionauth-issues/issues/3497)

[Fix](#since-1-62-1--fix--issue-3311--sgjt)

Fixed an issue with the SCIM `PATCH` `/api/scim/resource/v2/Users` endpoint where re-activating a deactivated user could fail and return a `400` status code.

Since: [1.62.1](#version-1-62-1)

[3311](https://github.com/FusionAuth/fusionauth-issues/issues/3311)

[Fix](#since-1-57-1--fix--issue-3109--qdxv)

Hosted login pages now display errors produced by the login validation lambda before presenting an MFA challenge to the user.

Since: [1.57.1](#version-1-57-1)

[3109](https://github.com/FusionAuth/fusionauth-issues/issues/3109)

[Fix](#fix--issue-3394--gptz)

Fixed an issue where, on the OAuth2 logout page, `registeredLogoutURLs` and `currentUser` were empty or null.

[3394](https://github.com/FusionAuth/fusionauth-issues/issues/3394)

[Security](#security--ns3t)

FusionAuth now hashes [MFA recovery codes](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/multi-factor-authentication.md#recovery-codes) at rest using `salted-pbkdf2-hmac-sha256`, the same algorithm used by default for password hashing. Existing recovery codes will continue to work without interruption. Their codes will be migrated to the hashed format automatically when they next regenerate their codes.

[SDK](#sdk--puww)

Released [Swift SDK for iOS](https://4002.18-224-161-104.sslip.io/docs/sdks/swift-sdk.md) `1.3.0` with support for iOS `26.5.x`.

[SDK](#sdk--qwf7)

Released [Kotlin SDK for Android](https://4002.18-224-161-104.sslip.io/docs/sdks/android-sdk.md) `1.2.0` with support for Android API Level `36`.

[SDK](#sdk--uaev)

Released [React SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/react-sdk.md) `2.6.0` with support for React `19.2.x`.

[SDK](#sdk--lq0l)

Released [Angular SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/angular-sdk.md) `2.0.0` with support for Angular `22.0.x`.

[SDK](#sdk--u4zw)

Released [Vue SDK](https://4002.18-224-161-104.sslip.io/docs/sdks/vue-sdk.md) `1.3.0` with support for Vue `3.5.x`.

[Internal](#internal--issue-3480--wubn)

Updated the following dependencies:

Java:

*   `com.fasterxml.jackson.core:jackson-core`: `2.21.1` -> `2.21.4`
*   `com.fasterxml.jackson.core:jackson-databind`: `2.21.1` -> `2.21.4`
*   `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor`: `2.21.1` -> `2.21.4`
*   `com.inversoft:inversoft-license`: `4.15.0` -> `4.16.0`
*   `com.inversoft:jackson5`: `3.0.1` -> `3.1.0`
*   `io.fusionauth:fusionauth-usage-stats-common`: `0.10.0` -> `0.13.0`
*   `org.ow2.asm:asm`: `9.5.0` -> `9.10.1`
*   `org.primeframework:prime-mvc`: `5.10.2` -> `5.10.4`

Javascript:

*   `@rolobits/is-human-cadence`: added `1.5.1`
*   `balanced-match`: removed (was `1.0.2`)
*   `brace-expansion`: removed (was `1.1.13`)
*   `cli/node_modules/balanced-match`: added `1.0.2`
*   `cli/node_modules/brace-expansion`: added `1.1.15`
*   `codemirror`: `5.65.20` -> `5.65.21`
*   `jshint/node_modules/balanced-match`: added `1.0.2`
*   `jshint/node_modules/brace-expansion`: added `1.1.15`

[3480](https://github.com/FusionAuth/fusionauth-issues/issues/3480)

## Version 1.67.1

8 June 2026

[Known Issue](#v-1-69-0--known-issue--via-3508--oj6m)

In account self-service, clicking the Change password repeatedly can disconnect the toggle state from the password change section visibility.

Resolved in version [1.69.0](#version-1-69-0) via [3508](https://github.com/FusionAuth/fusionauth-issues/issues/3508).

[Security](#since-1-2-0--security--issue-3500--de95)

Fixed a security issue where unbounded Refresh Token accumulation could cause an out-of-memory/500 Internal Server Error, resulting in a denial of service. Upgrading is recommended for deployments that have self-service registration enabled.

Since: [1.2.0](#version-1-2-0)

[3500](https://github.com/FusionAuth/fusionauth-issues/issues/3500)

## Version 1.67.0

1 June 2026

[New Feature](#new-feature--issue-1767--v8mn)

Added support for [RFC 8707](https://datatracker.ietf.org/doc/html/rfc8707), which introduces resource scoping for tokens produced by [OAuth endpoints](https://4002.18-224-161-104.sslip.io/docs/apis/oauth.md). Use the `authorizedResourceUris` field to configure a list of valid resources in an application. Then, when using the [Authorization Code Grant flow](https://4002.18-224-161-104.sslip.io/articles/login-authentication-workflows/webapp/oauth-authorization-code-grant-sessions-refresh-tokens-cookies.md), specify resources for a token using the `resource` parameter. To see the resource scoping for a token, check the `aud` claim of the token.

[1767](https://github.com/FusionAuth/fusionauth-issues/issues/1767)

[Enhancement](#enhancement--issue-3423--xjoz)

Added the `userId` field to the [generic messenger](https://4002.18-224-161-104.sslip.io/docs/messengers/generic-messenger.md) payload, simplifying user identification when sending an MFA code.

[3423](https://github.com/FusionAuth/fusionauth-issues/issues/3423)

[Enhancement](#enhancement--issue-3470--u802)

Added the `code` field to the [generic messenger](https://4002.18-224-161-104.sslip.io/docs/messengers/generic-messenger.md) payload, making it easier to access *just* the MFA code, rather than slicing the code out of a larger string that also includes text.

[3470](https://github.com/FusionAuth/fusionauth-issues/issues/3470)

[Known Issue](#v-1-68-0--known-issue--issue-3517--uahc)

Users that lack the privilege to remove an MFA method (e.g. `user_manager`) see a (non-functional) **Delete** button for MFA methods on the User Management page of the Admin UI.

[3517](https://github.com/FusionAuth/fusionauth-issues/issues/3517)

[Fix](#since-1-46-0--fix--issue-2357--cm9o)

Fixed an issue where federated users were not prompted to configure MFA on initial login, even when MFA is required. However, on subsequent logins, FusionAuth would force these users to configure MFA when MFA was required.

Since: [1.46.0](#version-1-46-0)

[2357](https://github.com/FusionAuth/fusionauth-issues/issues/2357)

[Fix](#since-1-62-1--fix--issue-3338--lg0k)

Fixed an issue where calling the [Update a Tenant API](https://4002.18-224-161-104.sslip.io/docs/apis/tenants/update-a-tenant.md) via the `PATCH` HTTP method with the `content-type: application/merge-patch+json` header returned a `500` status code.

Since: [1.62.1](#version-1-62-1)

[3338](https://github.com/FusionAuth/fusionauth-issues/issues/3338)

[Fix](#since-1-59-0--fix--issue-3401--3y02)

Fixed an issue where setting `user.passwordChangeRequired` to `true` on a user with no current password appeared successful in the Admin UI and returned a `200` status code in the API while leaving the value `false` (and as a result, never prompted the user to change their password).

Since: [1.59.0](#version-1-59-0)

[3401](https://github.com/FusionAuth/fusionauth-issues/issues/3401)

[Fix](#since-1-64-1--fix--issue-3454--ctmi)

Fixed an issue where, when [modifying an existing Form Field](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/advanced-registration-forms.md#modifying-an-existing-form-field), the Admin UI displayed a (required) Consent dropdown that was not actually part of the form.

Since: [1.64.1](#version-1-64-1)

[3454](https://github.com/FusionAuth/fusionauth-issues/issues/3454)

[Fix](#since-1-66-0--fix--issue-3465--xgrq)

Fixed an issue where, when [modifying a Form Field](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/advanced-registration-forms.md#modifying-an-existing-form-field), Firefox displayed an error in the console and failed to expand the left-side navigation to show the current page.

Since: [1.66.0](#version-1-66-0)

[3465](https://github.com/FusionAuth/fusionauth-issues/issues/3465)

[Internal](#internal--issue-3461--im1p)

Updated the following Java dependencies:

*   `JVM` `21.0.4_7` -> `21.0.11_10`
*   `com.inversoft:inversoft-license` `4.12.0` -> `4.15.0`
*   `org.postgresql:postgresql` `42.7.7` -> `42.7.11`
*   `org.primeframework:prime-mvc` `5.10.0` -> `5.10.2`

[3461](https://github.com/FusionAuth/fusionauth-issues/issues/3461)

## Version 1.66.0

5 May 2026

[Breaking Change](#breaking-change--issue-3452--7m2h)

In `1.65.0`, we hardened endpoint security by requiring global API keys for endpoints that impact a FusionAuth installation beyond the scope of a single tenant.

Unfortunately, we didn't harden our [webhook endpoints](https://4002.18-224-161-104.sslip.io/docs/apis/webhooks.md) this way, despite them deserving the fix. This remedies that error.

As a result, these endpoints:

*   no longer accept tenant-scoped API keys
*   respond with a `401` error code whenever a user provides the `X-FusionAuth-TenantId` header
*   no longer support the top-level `tenantId` property in [Kickstart](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/development/kickstart.md) configurations

This impacts the following endpoints:

*   `/api/webhook`
*   `/api/system/webhook-attempt-log`
*   `/api/system/webhook-event-log`
*   `/api/system/webhook-event-log/search`
*   `/api/webhook/search`

[3452](https://github.com/FusionAuth/fusionauth-issues/issues/3452)

[Known Issue](#v-1-67-0--known-issue--via-3465--ly2w)

When [modifying a Form Field](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/advanced-registration-forms.md#modifying-an-existing-form-field), Firefox displays an error in the console and fails to expand the left-side navigation to show the current page. You can still manually expand the left-side navigation, and the page remains functional. Sorry Firefox users!

Resolved in version [1.67.0](#version-1-67-0) via [3465](https://github.com/FusionAuth/fusionauth-issues/issues/3465).

[Known Issue](#v-1-68-0--known-issue--issue-3497--71gh)

The default Tenant issuer, `acme.com`, is not a valid URL. When configuring a Tenant, set the issuer to your FusionAuth instance's public base URL (e.g. `http://localhost:9011` for local deployments).

[3497](https://github.com/FusionAuth/fusionauth-issues/issues/3497)

[Known Issue](#v-1-68-0--known-issue--issue-3503--y4k3)

Connectors configured for a specific domain in a Tenant may be called for users outside of that domain.

[3503](https://github.com/FusionAuth/fusionauth-issues/issues/3503)

[Fix](#fix--pxl2)

Fixed a cosmetic issue in our Lambda editor: code comments were previously rendered orange-red. Comments are now rendered as gray to de-emphasize them.

[Fix](#fix--9jhu)

Improved advanced theme validation in the Admin UI:

*   Added checks for missing messages. Previously, if a theme lacked messages, but included all required templates, it would not be flagged for requiring an update.
*   The theme editor now associates error messages with template sections.

## Version 1.65.0 (Tenant Manager SSO Tasmanian Mountain Skink)

30 April 2026

[Breaking Change](#breaking-change--issue-3450--m51h)

Made the linking strategy of an enabled identity provider immutable, to prevent users from inadvertently breaking an existing provider. To change the linking strategy for an enabled identity provider, disable the provider, make your change, then re-enable the provider.

[3450](https://github.com/FusionAuth/fusionauth-issues/issues/3450)

[Breaking Change](#breaking-change--issue-3452--8fau)

To harden security, removed access via tenant-scoped API keys to endpoints that impact a FusionAuth installation beyond the scope of a single tenant (e.g. [/api/key/generate/ endpoint](https://4002.18-224-161-104.sslip.io/docs/apis/keys/generate-a-key.md)). To access these endpoints, you must now use a global API key.

As a result, these endpoints:

*   no longer accept tenant-scoped API keys
*   respond with a `401` error code whenever a user provides the `X-FusionAuth-TenantId` header
*   no longer support the top-level `tenantId` property in [Kickstart](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/development/kickstart.md) configurations

For a full list of APIs that now require a global API key, see [API Endpoints Guarded by API Keys](https://4002.18-224-161-104.sslip.io/docs/reference/api-endpoints.md).

[3452](https://github.com/FusionAuth/fusionauth-issues/issues/3452)

[New Feature](#new-feature--issue-3189--fz71)

Introduced self-service single-sign on (SSO) configuration from [Tenant Manager](https://4002.18-224-161-104.sslip.io/docs/lifecycle/manage-users/tenant-manager.md). Now, tenant manager administrators can configure SSO for their tenant entirely within tenant manager.

[3189](https://github.com/FusionAuth/fusionauth-issues/issues/3189)

[New Feature](#new-feature--issue-3283--w3xv)

Added [custom favicons](https://4002.18-224-161-104.sslip.io/docs/theme/simple-theme-editor.md#favicon) for hosted login pages using simple themes.

[3283](https://github.com/FusionAuth/fusionauth-issues/issues/3283)

[New Feature](#new-feature--issue-1303--r445)

Introduced a voice option for [multi-factor authentication (MFA)](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/multi-factor-authentication.md), allowing users to receive a code via audio instead of text.

[1303](https://github.com/FusionAuth/fusionauth-issues/issues/1303)

[New Feature](#new-feature--issue-3446--p45n)

Introduced a declarative way to reconcile identities across identity providers: [attribute mappings](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers.md#attribute-mappings). You must use this alternative to reconcile lambdas to use self-service SSO in Tenant Manager.

[3446](https://github.com/FusionAuth/fusionauth-issues/issues/3446)

[New Feature](#new-feature--issue-3447--wbn9)

Created a new [API for testing identity provider configurations](https://4002.18-224-161-104.sslip.io/docs/apis/identity-providers/test.md), and a UI in [Tenant Manager](https://4002.18-224-161-104.sslip.io/docs/lifecycle/manage-users/tenant-manager.md) that uses this API for visual testing. Use these tests to verify an identity provider configuration before enabling an identity provider.

[3447](https://github.com/FusionAuth/fusionauth-issues/issues/3447)

[Enhancement](#enhancement--issue-3448--onza)

Added a [self-service option for applications](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/complete-registration.md) that allows users to complete an existing (but incomplete) registration, but does not allow entirely new users to create a new registration.

[3448](https://github.com/FusionAuth/fusionauth-issues/issues/3448)

[Enhancement](#enhancement--issue-3449--3r2w)

Added the `auditLog.tenantId` field to the [Audit Logs API](https://4002.18-224-161-104.sslip.io/docs/apis/audit-logs.md), which provides the ability to filter audit logs by tenant using the API and in [Tenant Manager](https://4002.18-224-161-104.sslip.io/docs/lifecycle/manage-users/tenant-manager.md).

[3449](https://github.com/FusionAuth/fusionauth-issues/issues/3449)

[Enhancement](#enhancement--issue-3441--eu4u)

In the Admin UI, added a new **Help** section to the left-hand nav, containing links to a new **Get Started** section and the FusionAuth Documentation.

[3441](https://github.com/FusionAuth/fusionauth-issues/issues/3441)

[Fix](#fix--issue-3422--orj2)

Improved the performance of `PATCH` and `PUT` calls to `/api/identity-provider` for deployments with thousands of tenants or applications. Additionally, this release of the Go and Java client libraries adds opt-in retry support with exponential backoff for these APIs.

[3422](https://github.com/FusionAuth/fusionauth-issues/issues/3422)

[Fix](#since-1-63-0--fix--issue-3386--sw67)

Fixed a race condition where concurrent `PATCH` calls to `/api/identity-provider/{id}` could *all* return status code `200`, but only one modification would persist. Now, only one call will succeed, and all others will return status code `409`.

Since: [1.63.0](#version-1-63-0)

[3386](https://github.com/FusionAuth/fusionauth-issues/issues/3386)

[Fix](#since-1-63-0--fix--issue-3396--pl8s)

Fixed a broken link in Reactor that should have linked users to find their license key in their FusionAuth account.

Since: [1.63.0](#version-1-63-0)

[3396](https://github.com/FusionAuth/fusionauth-issues/issues/3396)

[Fix](#since-1-62-1--fix--issue-3324--lz5i)

Fixed an issue where image URLs were obscured while viewing IdP configuration.

Since: [1.62.1](#version-1-62-1)

[3324](https://github.com/FusionAuth/fusionauth-issues/issues/3324)

[Fix](#since-1-62-1--fix--issue-3327--sz5g)

Fixed an issue where `GET` requests to `/api/jwt/issue` could produce a JWT for a user without firing the [JWT Populate lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md), for users registered for one application, when requesting a token for an application for which the user is not registered.

Since: [1.62.1](#version-1-62-1)

[3327](https://github.com/FusionAuth/fusionauth-issues/issues/3327)

[Fix](#since-1-56-0--fix--issue-3382--ff87)

Fixed an issue where the Admin UI failed to display embedded maps.

Since: [1.56.0](#version-1-56-0)

[3382](https://github.com/FusionAuth/fusionauth-issues/issues/3382)

[Fix](#since-1-60-0--fix--issue-3438--6xsf)

Fixed an issue where Reactor and license data could be lost when migrating to a new version of FusionAuth.

Since: [1.60.0](#version-1-60-0)

[3438](https://github.com/FusionAuth/fusionauth-issues/issues/3438)

[Fix](#since-1-64-1--fix--issue-3442--ps0s)

Improved the performance and reliability of background jobs in multi-node clusters, reducing load by a factor of 3-9x.

Since: [1.64.1](#version-1-64-1)

[3442](https://github.com/FusionAuth/fusionauth-issues/issues/3442)

[Fix](#since-1-62-0--fix--issue-3436--ioo0)

Fixed a [FreeMarker](https://freemarker.apache.org/) exception that previously displayed when viewing keys without an algorithm in Key Master.

Since: [1.62.0](#version-1-62-0)

[3436](https://github.com/FusionAuth/fusionauth-issues/issues/3436)

[Fix](#fix--gp7c)

In the FusionAuth .NET Core Client, fixed [an issue](https://github.com/FusionAuth/fusionauth-netcore-client/issues/183) where enumeration-based values like `sendSetPasswordIdentityType()` incorrectly defaulted to `email` when omitted. The client now omits the value entirely from requests instead of using a default value.

[Security](#security--yzsk)

Fixed an issue where global API keys could be hidden by marking them as internal.

[Security](#security--q8hd)

Tightened security of endpoints that should be only callable by internal API keys, to ensure they are not callable with regular API keys.

[Security](#security--d4uj)

Fixed a race condition that could apply the wrong FIPS mode when bootstrapping a new cluster where nodes have different FIPS settings.

[Security](#security--e0oe)

Fixed an issue where the `/api/cache/reload` endpoint was accessible to any super-admin API key, not just internal API keys.

[Security](#security--aofu)

Fixed a flaw in the "Forgot password" flow to that could be used to enumerate registered email addresses using the cookies in the HTTP response.

[Security](#security--nmgu)

Fixed an issue where a tenant-scoped API key could be used to add an identity provider to an application in a separate tenant.

[Security](#security--nw8i)

Removed shell access from the `fusionauth` user account in the Docker install to better align with the principle of lease privilege.

[Security](#security--6bwh)

Fixed a potential directory traversal issue that could expose files stored outside the web root folder.

[Internal](#internal--issue-3390--pj58)

Updated the following dependencies:

Java:

*   `com.inversoft:inversoft-api-authentication` `0.32.1` -> `0.33.0`
*   `com.inversoft:inversoft-scheduler` `0.3.0` -> `0.4.0`
*   `com.inversoft:restify` `4.3.0` -> `4.4.0`
*   `io.fusionauth:java-http` `1.4.0` -> `1.4.1`
*   `org.apache.kafka:kafka-clients` `3.9.1` -> `3.9.2`
*   `org.primeframework:prime-mvc` `5.9.0` -> `5.10.0`

Javascript:

*   `@ctrl/tinycolor` **removed** (was `4.2.0`)
*   `@floating-ui/core` **removed** (was `1.7.4`)
*   `@floating-ui/dom` **removed** (was `1.7.5`)
*   `@floating-ui/utils` **removed** (was `0.2.10`)
*   `@fusionauth/typescript-client` **removed** (was `1.62.0`)
*   `@lit-labs/ssr-dom-shim` **removed** (was `1.5.1`)
*   `@lit/react` **removed** (was `1.0.8`)
*   `@lit/reactive-element` **removed** (was `2.1.2`)
*   `@shoelace-style/animations` **removed** (was `1.2.0`)
*   `@shoelace-style/localize` **removed** (was `3.2.1`)
*   `@shoelace-style/shoelace` **removed** (was `2.20.1`)
*   `@types/react` **removed** (was `19.2.13`)
*   `@types/trusted-types` **removed** (was `2.0.7`)
*   `brace-expansion` `1.1.12` -> `1.1.13`
*   `composed-offset-position` **removed** (was `0.0.6`)
*   `csstype` **removed** (was `3.2.3`)
*   `lit` **removed** (was `3.3.2`)
*   `lit-element` **removed** (was `4.2.2`)
*   `lit-html` **removed** (was `3.3.2`)
*   `lodash` `4.17.23` -> `4.18.1`
*   `node-fetch` **removed** (was `2.7.0`)
*   `qr-creator` **removed** (was `1.0.0`)
*   `tr46` **removed** (was `0.0.3`)
*   `webidl-conversions` **removed** (was `3.0.1`)
*   `whatwg-url` **removed** (was `5.0.0`)

[3390](https://github.com/FusionAuth/fusionauth-issues/issues/3390)

## Version 1.64.1

3 April 2026

[Fix](#fix--issue-3424--g5df)

Fixed an issue where, during a password change, FusionAuth may have failed to detect that a new password was included in a data breach.

[3424](https://github.com/FusionAuth/fusionauth-issues/issues/3424)

[Fix](#v-1-67-0--fix--via-3454--p64v)

When [modifying an existing Form Field](https://4002.18-224-161-104.sslip.io/docs/lifecycle/register-users/advanced-registration-forms.md#modifying-an-existing-form-field), the Admin UI displays a (required) **Consent** dropdown that was not actually part of the form. As a workaround, you can safely ignore the dropdown: saving the form works without selecting an option.

Resolved in version [1.67.0](#version-1-67-0) via [3454](https://github.com/FusionAuth/fusionauth-issues/issues/3454).

[Known Issue](#v-1-65-0--known-issue--via-3442--hdjh)

You may sometimes see spurious `INFO`\-level log messages with the following form:

```plaintext
io.fusionauth.api.service.system.NodeService - Node [...] with address [...] removed because it has not checked in for the last [74] seconds. Bye node.
```

This log message is inaccurate and does not indicate a broken connection between nodes. To remove this log (and benefit from multi-node performance improvements), upgrade to version `1.65.0`.

Resolved in version [1.65.0](#version-1-65-0) via [3442](https://github.com/FusionAuth/fusionauth-issues/issues/3442).

## Version 1.64.0 (Secret Shibe)

19 March 2026

[New Feature](#new-feature--issue-1629--lnmm)

Introduced [Lambda Secrets](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas.md#secrets), secure storage for highly sensitive values like app passwords and API keys that can be accessed from lambda functions.

[1629](https://github.com/FusionAuth/fusionauth-issues/issues/1629)

[Known Issue](#known-issue--issue-3284--ohct)

When upgrading to FusionAuth `1.62.0` or higher, when saving a theme, the Theme Editor UI cheerfully indicates that *a* template lacks one or more keys. Unfortunately, this error message does not indicate *which* template lacks the keys.

[3284](https://github.com/FusionAuth/fusionauth-issues/issues/3284)

[Enhancement](#enhancement--issue-1029--7uhr)

Added the [Proof Key for Code Exchange (PKCE) signifier](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers/overview-oidc.md#proof-key-for-code-exchange) to the [OpenID Connect (OIDC) Discovery](https://openid.net/specs/openid-connect-discovery-1_0-final.html#RFC5785) document so clients can dynamically find FusionAuth OAuth endpoints.

[1029](https://github.com/FusionAuth/fusionauth-issues/issues/1029)[1177](https://github.com/FusionAuth/fusionauth-issues/issues/1177)

[Enhancement](#enhancement--issue-2589--eeu8)

Added the ability to use a code for [one-time password email login](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/one-time-passwords.md) in addition to magic links.

[2589](https://github.com/FusionAuth/fusionauth-issues/issues/2589)

[Enhancement](#enhancement--issue-3050--sa80)

Added the ability to customize page titles when using a [custom simple theme](https://4002.18-224-161-104.sslip.io/docs/theme/simple-theme-editor.md) using message keys.

[3050](https://github.com/FusionAuth/fusionauth-issues/issues/3050)

[Enhancement](#enhancement--issue-2997--thanks-rinkledink--ahwg)

Added the [User](https://4002.18-224-161-104.sslip.io/docs/apis/users.md) `passwordChangeRequired` field to the search index to enable Elasticsearch queries. This makes it easier to count and view users who need to perform a password reset, but have not yet reset their password.

Thanks to [@rinkledink](https://github.com/rinkledink)!

[2997](https://github.com/FusionAuth/fusionauth-issues/issues/2997)

[Deprecated](#deprecated--sznf)

**Retrieve Two-Factor Recovery Codes API**

`GET /api/user/two-factor/recovery-code/{userId}` is deprecated and will be removed in a future version of FusionAuth. To provide access to a user's recovery codes, [generate new recovery codes](https://4002.18-224-161-104.sslip.io/docs/apis/two-factor/generate-recovery-codes.md) and deliver those.

[Fix](#since-1-62-0--fix--issue-3320--gkd1)

Fixed an issue where the phone verification page displayed a label without a message.

Since: [1.62.0](#version-1-62-0)

[3320](https://github.com/FusionAuth/fusionauth-issues/issues/3320)

[Fix](#since-1-61-0--fix--issue-3381--9xae)

Fixed an issue where long-running Admin UI requests could sometimes duplicate actions.

Since: [1.61.0](#version-1-61-0)

[3381](https://github.com/FusionAuth/fusionauth-issues/issues/3381)

[Fix](#since-1-62-0--fix--issue-3307--ktt4)

Fixed an issue where the SCIM `GET /api/scim/resource/v2/Groups` endpoint failed with a `500` error when one of the groups in the response contains a large number of users.

Since: [1.62.0](#version-1-62-0)

[3307](https://github.com/FusionAuth/fusionauth-issues/issues/3307)

[Fix](#fix--issue-3364--3f3g)

Standardized inconsistent title casing of headings in the Admin UI.

[3364](https://github.com/FusionAuth/fusionauth-issues/issues/3364)

[Fix](#since-1-62-0--fix--issue-3326--pgaa)

In the Admin UI, linked users always show an error when you view the linked account at Users -> Manage -> Linked accounts -> View .

Since: [1.62.0](#version-1-62-0)

[3326](https://github.com/FusionAuth/fusionauth-issues/issues/3326)

[Fix](#since-1-62-0--fix--issue-3362--dpj4)

Fixed an issue where, in the Admin UI, the Twilio or Generic Messenger **send test message** button always produced an unexpected error.

Since: [1.62.0](#version-1-62-0)

[3362](https://github.com/FusionAuth/fusionauth-issues/issues/3362)

[Fix](#since-1-59-0--fix--issue-3287--iuis)

Fixed an issue where connectors did not allow login via username or email when the connector returned a different username or email from what the request provided.

Since: [1.59.0](#version-1-59-0)

[3287](https://github.com/FusionAuth/fusionauth-issues/issues/3287)

[Fix](#since-1-60-0--fix--issue-3317--1zgs)

The `id_token_hint` field of the `oauth2/logout` endpoint was incompatible with Id tokens generated in `1.59.x` and earlier. The `oauth2/logout` endpoint is once again backwards-compatible with those tokens.

Since: [1.60.0](#version-1-60-0)

[3317](https://github.com/FusionAuth/fusionauth-issues/issues/3317)

[Fix](#since-1-63-0--fix--issue-3374--18ik)

Fixed a rare issue where maintenance mode errors could appear in the FusionAuth logs while maintenance mode was not active.

Since: [1.63.0](#version-1-63-0)

[3374](https://github.com/FusionAuth/fusionauth-issues/issues/3374)

[Fix](#since-1-64-0--fix--issue-3366--9pi4)

Fixed a rare issue where a version upgrade could deactivate a configured license.

Since: [1.64.0](#version-1-64-0)

[3366](https://github.com/FusionAuth/fusionauth-issues/issues/3366)

[Fix](#fix--issue-3036--1pp2)

Fixed an issue where FusionAuth could get stuck in a Maintenance Mode Failed state when a leftover `test_create_table` database table already existed.

[3036](https://github.com/FusionAuth/fusionauth-issues/issues/3036)

[Internal](#internal--issue-3354--fr7y)

Updated the following dependencies:

Java:

*   `com.fasterxml.jackson.core:jackson-annotations` 2.19.2 -> 2.21.0
*   `com.fasterxml.jackson.core:jackson-core` 2.19.2 -> 2.21.1
*   `com.fasterxml.jackson.core:jackson-databind` 2.19.2 -> 2.21.1
*   `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor` 2.19.2 -> 2.21.1
*   `com.inversoft:inversoft-license` 4.10.0 -> 4.12.0
*   `com.inversoft:inversoft-maintenance-mode` 0.25.2 -> 0.25.3

Javascript:

*   `cli/node_modules/minimatch` 3.1.2 -> 3.1.5
*   `jshint/node_modules/minimatch` 3.0.8 -> 3.1.5

[3354](https://github.com/FusionAuth/fusionauth-issues/issues/3354)

## Version 1.63.0 (Proof Pangolin)

26 February 2026

[Theme Upgrade](#theme-upgrade--ipjy)

To use the new show password toggle for password input fields, you must add new macros to your theme. See [Upgrade an Advanced Theme](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade-advanced-theme.md) for additional information about the upgrade process. See [Advanced Theme Upgrade Notes](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade.md) for details on updating an existing advanced theme specific to this release.

[Breaking Change](#breaking-change--issue-3292--i9pv)

Removed the deprecated (since `1.50.0`) User API JWT authentication method, `retrieveUserViaJWT`, from client libraries.

[3292](https://github.com/FusionAuth/fusionauth-issues/issues/3292)

[New Feature](#new-feature--issue-1679--2lkr)

Introduced support for [Demonstrating Proof-of-Possession (DPoP)](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/dpop.md), a method of binding access and refresh tokens to a client key pair for additional security. This protects against token theft and replay attacks.

[1679](https://github.com/FusionAuth/fusionauth-issues/issues/1679)

[Known Issue](#v-1-64-0--known-issue--via-3374--3c6g)

Rarely, maintenance mode errors could appear in the FusionAuth logs while maintenance mode was not active.

Resolved in version [1.64.0](#version-1-64-0) via [3374](https://github.com/FusionAuth/fusionauth-issues/issues/3374).

[Known Issue](#known-issue--issue-3284--ohct)

When upgrading to FusionAuth `1.62.0` or higher, when saving a theme, the Theme Editor UI cheerfully indicates that *a* template lacks one or more keys. Unfortunately, this error message does not indicate *which* template lacks the keys.

[3284](https://github.com/FusionAuth/fusionauth-issues/issues/3284)

[Known Issue](#v-1-65-0--known-issue--via-3396--y998)

Reactor contains a broken link that should lead users to find their license key in their FusionAuth account.

Resolved in version [1.65.0](#version-1-65-0) via [3396](https://github.com/FusionAuth/fusionauth-issues/issues/3396).

[Known Issue](#v-1-65-0--known-issue--via-3386--mlo3)

A race condition exists: concurrent `PATCH` calls to `/api/identity-provider/{id}` can *all* return status code `200`, but only one modification persists.

Resolved in version [1.65.0](#version-1-65-0) via [3386](https://github.com/FusionAuth/fusionauth-issues/issues/3386).

[Known Issue](#v-1-69-0--known-issue--via-3384--dxoo)

The default Enterprise User SCIM schema `meta.location` field contains a duplicate path segment, making it invalid.

Resolved in version [1.69.0](#version-1-69-0) via [3384](https://github.com/FusionAuth/fusionauth-issues/issues/3384).

[Known Issue](#v-1-69-0--known-issue--issue-3385--1fhg)

The SCIM Group schema does not mark `displayName` as required, even though the specification requires it.

[3385](https://github.com/FusionAuth/fusionauth-issues/issues/3385)

[Enhancement](#enhancement--issue-3314--hfan)

Added the `tenantID` parameter to several client requests to APIs used for fetching IdPs.

[3314](https://github.com/FusionAuth/fusionauth-issues/issues/3314)

[Enhancement](#enhancement--issue-3319--swwn)

Added the `AuthenticationType` parameter to the [MFA Requirement Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md). This enables prompts for MFA based on the method the user used to login.

[3319](https://github.com/FusionAuth/fusionauth-issues/issues/3319)

[Enhancement](#enhancement--issue-3346--thanks-mark-robustelli--u06q)

Added more relevant information to the summary tab in the setup wizard.

Thanks to [@mark-robustelli](https://github.com/mark-robustelli)!

[3346](https://github.com/FusionAuth/fusionauth-issues/issues/3346)

[Enhancement](#enhancement--issue-3347--thanks-mark-robustelli--4zqy)

In the setup wizard, added a link to the licensing agreement.

Thanks to [@mark-robustelli](https://github.com/mark-robustelli)!

[3347](https://github.com/FusionAuth/fusionauth-issues/issues/3347)

[Enhancement](#enhancement--issue-3286--12zq)

Added an Admin UI page for [Fine-Grained Authorization (FGA)](https://4002.18-224-161-104.sslip.io/docs/extend/fine-grained-authorization.md).

[3286](https://github.com/FusionAuth/fusionauth-issues/issues/3286)

[Enhancement](#enhancement--issue-2800--212v)

Added a 'show password' toggle to the default hosted login page.

[2800](https://github.com/FusionAuth/fusionauth-issues/issues/2800)

[Enhancement](#enhancement--issue-2733--7vxx)

Following [NIST password guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html#passwordver), added a check that prevents users from configuring a password that matches their username.

[2733](https://github.com/FusionAuth/fusionauth-issues/issues/2733)

[Fix](#fix--issue-2875--kdnh)

Removed all explicit mentions of "FusionAuth" from error message text.

[2875](https://github.com/FusionAuth/fusionauth-issues/issues/2875)

[Fix](#fix--issue-3217--emd0)

Fixed a bug where one application's SSO session could prevent login to another application when a user had not yet completed registration.

[3217](https://github.com/FusionAuth/fusionauth-issues/issues/3217)

[Fix](#fix--issue-3237--8mpt)

Fixed a bug where a reconcile lambda could fail to set a value for an IdP linking strategy when the IdP's value is `null`.

[3237](https://github.com/FusionAuth/fusionauth-issues/issues/3237)

[Fix](#fix--issue-3233--xab4)

Fixed an issue where the SAML metadata API returned a 500 response when the configuration specified a custom Name ID.

[3233](https://github.com/FusionAuth/fusionauth-issues/issues/3233)

[Fix](#fix--issue-3276--3a6n)

Added validation to fix a bug where nonfunctional signing keys could be successfully created by mismatching the `type` label with the PEM.

[3276](https://github.com/FusionAuth/fusionauth-issues/issues/3276)

[Fix](#fix--issue-3275--ollu)

Enabled the deletion of Apple IdP-assigned keys, which previously failed to delete.

[3275](https://github.com/FusionAuth/fusionauth-issues/issues/3275)

[Fix](#fix--issue-3295--vnba)

Fixed a bug introduced in `1.62.1` where the Simple Theme login page displayed a Face ID login graphic over content.

[3295](https://github.com/FusionAuth/fusionauth-issues/issues/3295)

[Fix](#fix--issue-3308--gwfc)

Fixed a bug where hosted login pages for universal applications sometimes showed IdPs scoped to another tenant.

[3308](https://github.com/FusionAuth/fusionauth-issues/issues/3308)

[Fix](#fix--issue-3309--thanks-robert-janeczek--dbyo)

Fixed a longstanding bug where the monthly active user table did not display data from the month of December.

Thanks to [@Robert-Janeczek](https://github.com/Robert-Janeczek)!

[3309](https://github.com/FusionAuth/fusionauth-issues/issues/3309)

[Fix](#fix--issue-3313--msz9)

Fixed a bug in self-service registration where a user could alter a hidden field (using browser developer tools) and cause `Failed decrypt registration state` errors to appear in the event log.

[3313](https://github.com/FusionAuth/fusionauth-issues/issues/3313)

[Fix](#fix--issue-3333--eykl)

Fixed a bug where autocomplete did not function correctly when accessing the Admin UI over HTTP (instead of HTTPS).

[3333](https://github.com/FusionAuth/fusionauth-issues/issues/3333)

[Fix](#fix--issue-3335--x26u)

In the setup wizard, the checkbox for accepting the licensing agrement was not marked as required. It is indeed required, so now it is marked with an asterisk (`*`).

[3335](https://github.com/FusionAuth/fusionauth-issues/issues/3335)

[Fix](#fix--issue-3337--thanks-brob--66us)

In System Settings -> UI , a form field labeled "Menu font" controlled the menu font color. Added the suffix "color" to this label to clarify the field's purpose.

Thanks to [@brob](https://github.com/brob)!

[3337](https://github.com/FusionAuth/fusionauth-issues/issues/3337)

[Fix](#fix--issue-3343--thanks-brob--ha8t)

API Key endpoint permissions didn't allow for row selection, despite text that indicated otherwise.

Thanks to [@brob](https://github.com/brob)!

[3343](https://github.com/FusionAuth/fusionauth-issues/issues/3343)

[Fix](#fix--issue-3345--thanks-brob--8qex)

In the setup wizard, marked "tell us more" field as required with an asterisk (`*`) when the "Other" acquisition channel is selected.

Thanks to [@brob](https://github.com/brob)!

[3345](https://github.com/FusionAuth/fusionauth-issues/issues/3345)

[Fix](#fix--issue-3350--lqpi)

Fixed backwards toggle logic when requiring encrypted SAML assertions. When creating or editing a SAMLv2 and IdP-initiated SAML IdP, under the Options tab, the Require encrypted assertions toggle should expose the decryption key selector when it's on and hide it when it's off. The logic was backwards, hiding the selector when it's on and exposing it when it's off.

[3350](https://github.com/FusionAuth/fusionauth-issues/issues/3350)

[Fix](#fix--issue-3149--fnd5)

Fixed a bug where the SCIM create operation returned error code `400` (instead of `409`) when *both* `user.email` and `user.username` are duplicated.

[3149](https://github.com/FusionAuth/fusionauth-issues/issues/3149)

[Internal](#internal--issue-3266--v7jt)

Switched from MD5 hash generation to the built-in Postgres `gen_random_uuid()` function. This improves our [FIPS support](https://4002.18-224-161-104.sslip.io/docs/operate/secure/compliance.md).

[3266](https://github.com/FusionAuth/fusionauth-issues/issues/3266)

[Internal](#internal--issue-3344--thanks-brob--o4r9)

Cleaned up the root template for the FusionAuth instance to make it easier to reach the Admin UI.

Thanks to [@brob](https://github.com/brob)!

[3344](https://github.com/FusionAuth/fusionauth-issues/issues/3344)

[Internal](#internal--issue-3348--thanks-brob--fn75)

Changed first-time setup links to flexible pointers that we can update without releasing a new version.

Thanks to [@brob](https://github.com/brob)!

[3348](https://github.com/FusionAuth/fusionauth-issues/issues/3348)

[Internal](#internal--issue-3340--1fo5)

Updated the following dependencies:

Java:

*   `ch.qos.logback:logback-classic` 1.5.19 -> 1.5.25
*   `ch.qos.logback:logback-core` 1.5.19 -> 1.5.25
*   `com.inversoft:inversoft-license` 4.9.0 -> 4.10.0
*   `io.fusionauth:fusionauth-jwt` 6.0.0 -> 6.1.0
*   `io.fusionauth:fusionauth-samlv2` 1.1.3 -> 2.0.0
*   `org.primeframework:prime-mvc` 5.7.0 -> 5.9.0

Javascript:

*   `@ctrl/tinycolor` 4.1.0 -> 4.2.0
*   `@floating-ui/core` 1.6.9 -> 1.7.4
*   `@floating-ui/dom` 1.6.13 -> 1.7.5
*   `@floating-ui/utils` 0.2.9 -> 0.2.10
*   `@fusionauth/typescript-client` 1.57.0 -> 1.62.0
*   `@lit-labs/ssr-dom-shim` 1.3.0 -> 1.5.1
*   `@lit/react` 1.0.7 -> 1.0.8
*   `@lit/reactive-element` 2.0.4 -> 2.1.2
*   `@tailwindplus/elements` 1.0.20 -> 1.0.22
*   `@types/react` 19.1.0 -> 19.2.13
*   `csstype` 3.1.3 -> 3.2.3
*   `lit` 3.2.1 -> 3.3.2
*   `lit-element` 4.1.1 -> 4.2.2
*   `lit-html` 3.2.1 -> 3.3.2
*   `lodash` 4.17.21 -> 4.17.23
*   added `brace-expansion` 1.1.12
*   removed `cli/node_modules/brace-expansion` (was 1.1.12)
*   removed `jshint/node_modules/brace-expansion` (was 1.1.12)

[3340](https://github.com/FusionAuth/fusionauth-issues/issues/3340)

## Version 1.62.1

30 December 2025

[Known Issue](#v-1-67-0--known-issue--via-3338--eisf)

Calling the [Update a Tenant API](https://4002.18-224-161-104.sslip.io/docs/apis/tenants/update-a-tenant.md) via the `PATCH` HTTP method with the `content-type: application/merge-patch+json` header returns a `500` status code.

Resolved in version [1.67.0](#version-1-67-0) via [3338](https://github.com/FusionAuth/fusionauth-issues/issues/3338).

[Known Issue](#v-1-63-0--known-issue--via-3295--q7zy)

The Simple Theme login page displays a large Face ID login graphic over content.

Resolved in version [1.63.0](#version-1-63-0) via [3295](https://github.com/FusionAuth/fusionauth-issues/issues/3295).

[Known Issue](#v-1-63-0--known-issue--via-3308--q52a)

Hosted login pages for universal applications sometimes show IdPs scoped to another tenant.

Resolved in version [1.63.0](#version-1-63-0) via [3308](https://github.com/FusionAuth/fusionauth-issues/issues/3308).

[Known Issue](#v-1-65-0--known-issue--via-3324--c1va)

Image URLs may be obscured while viewing IdP configuration.

Resolved in version [1.65.0](#version-1-65-0) via [3324](https://github.com/FusionAuth/fusionauth-issues/issues/3324).

[Known Issue](#v-1-65-0--known-issue--via-3327--l983)

A `GET` request to `/api/jwt/issue` can produce a JWT for a user without firing the [JWT Populate lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md), for users registered for one application, when requesting a token for an application for which the user is not registered.

Resolved in version [1.65.0](#version-1-65-0) via [3327](https://github.com/FusionAuth/fusionauth-issues/issues/3327).

[Fix](#fix--issue-3282--f7mb)

The logout button was not visible on account self-service pages.

[3282](https://github.com/FusionAuth/fusionauth-issues/issues/3282)

[Fix](#fix--issue-3285--ccnr)

When using database search mode, user searches could fail due to FreeMarker template errors introduced in the `1.62.0` UI update.

[3285](https://github.com/FusionAuth/fusionauth-issues/issues/3285)

[Fix](#fix--issue-3289--vpmi)

When a custom theme was missing a template, FusionAuth could fail to render the fallback template from the default theme. In some cases this could prevent a user from completing various workflows.

[3289](https://github.com/FusionAuth/fusionauth-issues/issues/3289)

[Fix](#fix--issue-3290--z130)

The setup wizard could generate an error if the browser could not provide a timezone.

[3290](https://github.com/FusionAuth/fusionauth-issues/issues/3290)

## Version 1.62.0 (Refined Reindeer)

18 December 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--afuv)

To use the new pre-verification feature in Advanced Registration Forms, you must add new templates to your theme. See [Upgrade an Advanced Theme](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade-advanced-theme.md) for additional information about the upgrade process. See [Advanced Theme Upgrade Notes](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade.md) for details on updating an existing advanced theme specific to this release.

[Known Issue](#known-issue--issue-3284--ohct)

When upgrading to FusionAuth `1.62.0` or higher, when saving a theme, the Theme Editor UI cheerfully indicates that *a* template lacks one or more keys. Unfortunately, this error message does not indicate *which* template lacks the keys.

[3284](https://github.com/FusionAuth/fusionauth-issues/issues/3284)

[Known Issue](#v-1-64-0--known-issue--issue-3320--r2fo)

The phone verification page can display a label without a message.

[3320](https://github.com/FusionAuth/fusionauth-issues/issues/3320)

[Known Issue](#v-1-64-0--known-issue--via-3307--ajo4)

The SCIM `GET /api/scim/resource/v2/Groups` endpoint may fail with a `500` error when one of the groups in the response contains a large number of users.

Resolved in version [1.64.0](#version-1-64-0) via [3307](https://github.com/FusionAuth/fusionauth-issues/issues/3307).

[Known Issue](#v-1-64-0--known-issue--via-3326--jk6w)

In the Admin UI, linked users always show an error when you view the linked account at Users -> Manage -> Linked accounts -> view .

Resolved in version [1.64.0](#version-1-64-0) via [3326](https://github.com/FusionAuth/fusionauth-issues/issues/3326).

[Known Issue](#v-1-64-0--known-issue--via-3362--5m9r)

In the Admin UI, the Twilio or Generic Messenger **send test message** button always produced an unexpected error.

Resolved in version [1.64.0](#version-1-64-0) via [3362](https://github.com/FusionAuth/fusionauth-issues/issues/3362).

[Known Issue](#v-1-65-0--known-issue--via-3436--fkih)

When viewing keys without an algorithm, Key Master displays a [FreeMarker](https://freemarker.apache.org/) error at the top of the view menu.

Resolved in version [1.65.0](#version-1-65-0) via [3436](https://github.com/FusionAuth/fusionauth-issues/issues/3436).

[Theme Upgrade](#theme-upgrade--atw8)

When upgrading from older versions of FusionAuth with a customized theme, we recommend skipping this version and instead upgrading to `1.62.1`, which more gracefully handles missing templates.

[Breaking Change](#breaking-change--p9t2)

This release makes changes to API key requirements for the `/api/identity-provider` endpoint. Tenant-scoped API keys can only be used to configure identity providers belonging to the same tenant. A global API key is required to configure global identity providers.

[New Feature](#new-feature--issue-2309--ju90)

Introduces the [MFA Requirement Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/mfa-requirement.md), which dynamically decides whether a user should receive an MFA challenge, *even if trust has already been established*. Used for adaptive MFA and step-up workflows.

[2309](https://github.com/FusionAuth/fusionauth-issues/issues/2309)

[New Feature](#new-feature--issue-2905--y10a)

Added a mode that supports FIPS-compliant verified cryptographic modules. For more details, see [Compliance Frameworks](https://4002.18-224-161-104.sslip.io/docs/operate/secure/compliance.md).

[2905](https://github.com/FusionAuth/fusionauth-issues/issues/2905)

[New Feature](#new-feature--issue-3278--a64n)

Added pre-verification of user identities. This forces email address or phone number verification before creating a user.

[3278](https://github.com/FusionAuth/fusionauth-issues/issues/3278)

[Enhancement](#enhancement--issue-3255--mrve)

Added the ability to create tenant-scoped instances of identity providers. Tenant-scoped identity providers can only be used for authentication workflows within that tenant and are only configurable for applications belonging to that tenant, as well as universal applications. Managed domains may be reused on identity providers belonging to different tenants. Managed domains on global identity providers remain globally unique.

Tenant-scoped identity provider configurations can be managed by tenant-scoped API keys and requests.

Tenant-scoped identity providers are especially useful if you want to restrict identity provider availability to users belonging to a specific tenant.

[3255](https://github.com/FusionAuth/fusionauth-issues/issues/3255)

[Enhancement](#enhancement--issue-3260--pm36)

Added support for using EdDSA key pairs using the Ed25519 algorithm to sign and validate JWTs.

[3260](https://github.com/FusionAuth/fusionauth-issues/issues/3260)

[Enhancement](#enhancement--issue-3279--ak5y)

Updated the styling of the Admin UI. Does not affect custom themes, but does improve (at least, to our eyes) the default theme.

[3279](https://github.com/FusionAuth/fusionauth-issues/issues/3279)

[Fix](#fix--issue-2855--sb97)

Reports on the Admin UI could load slowly or time out during high user traffic or when a large number of applications exist.

[2855](https://github.com/FusionAuth/fusionauth-issues/issues/2855)

[Fix](#fix--issue-3161--msd7)

IdP (federated) logins do not work for Universal Apps. Instead, shows the error message: `Invalid_Request. Missing_tenant_id`.

[3161](https://github.com/FusionAuth/fusionauth-issues/issues/3161)

[Fix](#fix--issue-3201--cbtg)

When family settings are enabled, including requiring a parent email, the parent email does not persisted after self-service registration by a child. This prevents an email from being sent to the parent email.

[3201](https://github.com/FusionAuth/fusionauth-issues/issues/3201)

[Fix](#fix--issue-3272--q1ki)

When creating a new lambda, changing the lambda type does not update the lambda body to the default body for that type.

[3272](https://github.com/FusionAuth/fusionauth-issues/issues/3272)

[Fix](#fix--issue-3034--o976)

Fixed a JavaScript error on the user edit page caused by a stale reference to `birthDatePicker` in `User.js` that remained after the variable was removed.

[3034](https://github.com/FusionAuth/fusionauth-issues/issues/3034)

[Fix](#fix--issue-3060--9bil)

Fixed an issue where the date picker did not work properly on iOS, preventing users from selecting a date on iOS devices.

[3060](https://github.com/FusionAuth/fusionauth-issues/issues/3060)

[Internal](#internal--issue-3274--5hlr)

Updated the following dependencies:

*   Upgrade `io.fusionauth:fusionauth-jwt` `5.3.3` -> `6.0.0`
*   Upgrade `org.primeframework:prime-mvc` `5.6.1` -> `5.7.0`
*   Add `org.bouncycastle:bc-fips` `2.1.2`
*   Add `org.bouncycastle:bctls-fips` `2.1.22`

[3274](https://github.com/FusionAuth/fusionauth-issues/issues/3274)

## Version 1.61.2

10 December 2025

[Known Issue](#v-1-68-0--known-issue--issue-3311--2d3s)

The SCIM `PATCH` `/api/scim/resource/v2/Users` endpoint may fail and return a `400` status code when re-activating a deactivated user.

[3311](https://github.com/FusionAuth/fusionauth-issues/issues/3311)

[Security](#security--issue-3266--5rtk)

Improved signature processing of encrypted SAML assertions to mitigate an identified vulnerability. If you are using using a SAML IdP that allows IdP-initiated login, you should upgrade.

[3266](https://github.com/FusionAuth/fusionauth-issues/issues/3266)

[Internal](#internal--issue-3267--7qyu)

Updated the following dependencies:

*   Upgrade `io.fusionauth:fusionauth-samlv2` `1.1.1` -> `1.1.3`

[3267](https://github.com/FusionAuth/fusionauth-issues/issues/3267)

## Version 1.61.1

24 November 2025

[Known Issue](#v-1-62-1--known-issue--via-3282--r3qz)

The logout button was not visible on account self-service pages. The button is now displayed with the correct icon.

Resolved in version [1.62.1](#version-1-62-1) via [3282](https://github.com/FusionAuth/fusionauth-issues/issues/3282).

[Known Issue](#v-1-62-1--known-issue--via-3285--ktbb)

When using database search mode, user searches could fail due to FreeMarker template errors introduced in the UI update. User search now works correctly in database search mode.

Resolved in version [1.62.1](#version-1-62-1) via [3285](https://github.com/FusionAuth/fusionauth-issues/issues/3285).

[Fix](#fix--issue-3024--5mle)

When testing Email Templates in the FusionAuth admin UI, rendering some template types resulted in an error. All template types can now be tested in the admin UI.

[3024](https://github.com/FusionAuth/fusionauth-issues/issues/3024)

[Fix](#fix--issue-3247--al13)

When a Minimum Password Age is configured for the tenant, creating a user without a password resulted in an exception. You can now create users without a password in tenants with a minimum password age requirement; password age rules apply once the user sets a password.

[3247](https://github.com/FusionAuth/fusionauth-issues/issues/3247)

[Fix](#fix--issue-3251--z2xx)

Providing an expired Id Token to the `/oauth2/logout` endpoint using the `id_token_hint` parameter resulted in an OAuth error. The `/oauth2/logout` endpoint once again accepts expired Id Tokens in accordance with the specification.

[3251](https://github.com/FusionAuth/fusionauth-issues/issues/3251)

## Version 1.61.0 (Flexible Fox)

13 November 2025

[Theme Upgrade](#theme-upgrade--5ik7)

Several changes are required to support multiple configurations of various identity provider types that were previously restricted to a single configuration per FusionAuth instance. References to the legacy sign with Google JavaScript library, [deprecated by Google in 2023](https://developers.google.com/identity/sign-in/web/deprecation-and-sunset), have been removed from FusionAuth. Please migrate to the updated [Sign in with Google](https://developers.google.com/identity/gsi/web/guides/overview) integration to continue using the Google identity provider.

[Deprecated](#deprecated--vrqy)

**Identity Provider API**

For `/api/identity-provider` PUT/PATCH/DELETE:

The variant of these APIs that resolve the identity provider by a `type` query string parameter are deprecated. Use the variant that provides the `identityProviderId` via a URL path segment instead.

[Known Issue](#v-1-64-0--known-issue--via-3381--m0dp)

Long-running Admin UI requests can sometimes duplicate actions.

Resolved in version [1.64.0](#version-1-64-0) via [3381](https://github.com/FusionAuth/fusionauth-issues/issues/3381).

[Known Issue](#v-1-69-0--known-issue--via-3462--ncii)

The `PATCH /api/application/{id}` API returns an error for applications whose name is duplicated across Tenants.

Resolved in version [1.69.0](#version-1-69-0) via [3462](https://github.com/FusionAuth/fusionauth-issues/issues/3462).

[Fix](#since-1-61-0--fix--issue-3273--rn3g)

SCIM Group reconciliation may delete manually-assigned Group roles during the Microsoft Entra ID provisioning cycle.

Since: [1.61.0](#version-1-61-0)

[3273](https://github.com/FusionAuth/fusionauth-issues/issues/3273)

[Enhancement](#enhancement--issue-1841--yzkf)

You can now create multiple instances of any identity provider type, each with its own distinct configuration and reconcile lambda. This is especially useful if you have users mapped to different tenants, and want the ability to have an identity provider of the same type in each tenant, each having its own distinct config.

[1841](https://github.com/FusionAuth/fusionauth-issues/issues/1841)

[Enhancement](#enhancement--issue-3220--8u89)

Added the ability to set maximum sizes on both the HTTP request header and body. These can be useful for blocking invalid requests before they are processed by FusionAuth's HTTP server.

[3220](https://github.com/FusionAuth/fusionauth-issues/issues/3220)

[Enhancement](#enhancement--issue-2989--ysow)

Added support for the SAML v2.0 ForceAuthn attribute. When using FusionAuth as an IdP, this attribute will force re-authentication of the user, regardless of their SSO session state.

[2989](https://github.com/FusionAuth/fusionauth-issues/issues/2989)[1736](https://github.com/FusionAuth/fusionauth-issues/issues/1736)

[Fix](#fix--issue-3150--25mo)

In version `1.59.0` we started indexing the new `user.phoneNumber` field for searches. `IndexUser` had a new field added, but the doc annotation was missing the version.

[3150](https://github.com/FusionAuth/fusionauth-issues/issues/3150)

[Fix](#fix--issue-3179--jvaq)

The `GET /api/user/change-password` endpoint does not allow a `loginId` type of `phoneNumber`. Additionally, client libraries are incorrectly passing a `username` parameter instead of a `loginId` parameter in `checkChangePasswordUsingLoginId` calls. This API endpoint is also lacking documentation.

[3179](https://github.com/FusionAuth/fusionauth-issues/issues/3179)

[Fix](#fix--issue-3140--d9p6)

When federating with a Google IdP, there are situations where a user can be re-prompted for authentication when already having valid FusionAuth and Google IdP sessions. SSO should now be honored correctly in these cases.

[3140](https://github.com/FusionAuth/fusionauth-issues/issues/3140)

[Fix](#fix--issue-2949--5ddi)

After establishing MFA trust on a device, a user is being re-challenged during a voluntary password reset, even during the trust period. The user should be able to change their password without completing another MFA challenge.

[2949](https://github.com/FusionAuth/fusionauth-issues/issues/2949)

[Fix](#fix--issue-3208--24m5)

During startup, FusionAuth can output duplicate log entries. This was especially present with silent mode enabled. Logging should now be more efficient.

[3208](https://github.com/FusionAuth/fusionauth-issues/issues/3208)

[Fix](#fix--issue-3227--rbwa)

When a user first logs into a tenant configured with a connector, they will see an error when MFA is required and/or an updated and stronger password policy is in place. Subsequent logins behave normally.

[3227](https://github.com/FusionAuth/fusionauth-issues/issues/3227)

[Fix](#fix--issue-3167--6r1j)

Searches for users using nested searches involving registration fields may return incomplete results in some cases.

[3167](https://github.com/FusionAuth/fusionauth-issues/issues/3167)

[Fix](#fix--issue-3064--r8ww)

When using SCIM PATCH to add a user field, exiting fields are being removed. PATCH should now be handled as expected.

[3064](https://github.com/FusionAuth/fusionauth-issues/issues/3064)

[Fix](#fix--issue-3186--e681)

Performing a user reindex intermittently results in an `email`, `username`, or `phoneNumber` being omitted from Elastic/OpenSearch and not being searchable.

[3186](https://github.com/FusionAuth/fusionauth-issues/issues/3186)

[Fix](#fix--issue-3225--2460)

Some unwanted JavaScript errors are reported in the browser console on some pages, including the maintenance mode page and the application scope management page. These errors should now be handled more gracefully.

[3225](https://github.com/FusionAuth/fusionauth-issues/issues/3225)

[Fix](#fix--issue-3111--pqtx)

SCIM group searches are not properly honoring the `eq` operator. This operator should be doing an exact (but case-insensitive) search, but instead is doing a wildcard search.

[3111](https://github.com/FusionAuth/fusionauth-issues/issues/3111)

[Fix](#fix--issue-3191--ozga)

Webhook `user.delete` events were not populating `email`, `username`, or `phoneNumber` fields when users were deleted under certain circumstances.

[3191](https://github.com/FusionAuth/fusionauth-issues/issues/3191)

[Fix](#fix--issue-3069--pq5q)

Fixed an issue where the `user.update` webhook event triggered by an Identity Provider login did not include the user's registrations in the `original` field of the event payload.

[3069](https://github.com/FusionAuth/fusionauth-issues/issues/3069)

[Internal](#internal--issue-3176--nqdz)

Updated the following dependencies:

*   Upgrade `io.fusionauth:fusionauth-jwt` `5.3.2` -> `5.3.3`
*   Upgrade `io.fusionauth:java-http` `0.3.7` -> `1.4.0`
*   Upgrade `org.freemarker:freemarker` `2.3.33` -> `2.3.34`
*   Upgrade `org.primeframework:prime-email` `0.21.1` -> `0.22.0`
*   Upgrade `org.primeframework:prime-js` `1.7.0` -> `1.8.0`
*   Upgrade `org.primeframework:prime-mvc` `4.36.0` -> `5.6.1`
*   Upgrade `ch.qos.logback` `1.5.16` -> `1.5.19`
*   Upgrade `org.mybatis:mybatis` `3.5.16` -> `3.5.19`
*   Upgrade `com.fasterxml.jackson.*` `2.17.2` -> `2.19.2`
*   Upgrade `org.slf4j:slf4j-api` `2.0.13` -> `2.0.17`
*   Upgrade `org.postgresql:postgresql` `42.7.3` -> `42.7.7`
*   Upgrade `io.fusionauth:fusionauth-samlv2` `1.0.0` -> `1.1.1`

[3176](https://github.com/FusionAuth/fusionauth-issues/issues/3176)

## Version 1.60.2

26 September 2025

[Fix](#fix--issue-3190--tzyd)

When using FusionAuth as a SAML Service Provider (SP), receiving a SAML Response containing an Assertion with an attribute value of `null` or of an unsupported type will result in a failure to parse the Response.

This issue was introduced in version `1.60.0` and has been corrected.

[3190](https://github.com/FusionAuth/fusionauth-issues/issues/3190)

## Version 1.60.1

17 September 2025

[Breaking Change](#breaking-change--6fn4)

When upgrading from `1.60.0` you *must* revert the workaround noted on [GitHub Issue 3183](https://github.com/FusionAuth/fusionauth-issues/issues/3183) before or immediately after this upgrade.

[Fix](#fix--issue-3183--4iiw)

When using FusionAuth as a SAML IdP with a SAML Populate lambda that reads or modifies the SAML assertion will fail causing the login request to fail.

This issue was introduced in version `1.60.0` and has been corrected.

[3183](https://github.com/FusionAuth/fusionauth-issues/issues/3183)

## Version 1.60.0 (Prompt Param Piranha)

10 September 2025

[Breaking Change](#breaking-change--issue-3177--5zmv)

Some changes have been made to the way JWTs are produced and validated:

**Moved claims**

*   The `gty` claim has been moved from the JWT header to the body.
    *   This claim is present in an access token or id token produced by an OAuth grant.
*   The `use` claim has been moved from the JWT header to the body.
    *   This claim is present in an access token produced by an OAuth client credentials grant to authenticate a FusionAuth SCIM server.

**New and reserved claims**

The following claims are now reserved:

*   `auth_time` - Reserved for all user tokens, excludes client credentials
*   `gty` - Reserved for all tokens
*   `tty` - Reserved for all tokens
*   `use` - Reserved for the client credentials grant

We do not expect this change to impact our customers. If you are adding, removing or modifying these claims using a lambda function, you will need to plan to modify your integration.

These claims are not considered reserved for the Vend API.

**Token validation**

It is possible that an existing access token or id token that has not yet expired will no longer be considered valid by FusionAuth. If you are using a short lived access token with a refresh token, refreshing the access token will correct itself. These changes will not have any affect on your use of the JWTs produced by FusionAuth.

**Client credentials**

The `aud` claim will always be returned as an array.

Previously this claim may be returned as an string or an array depending upon the request. The following examples show different `scope` values and their prior affect on the `aud` claim:

*   `scope=target-entity:1:read` -> `aud: 1`
*   `scope=target-entity:1:read target-entity:2:read` -> `aud: [1, 2]`

To simplify integration requiring an integrator to only account for a single data type this claim will now always be returned as an array. If you have only ever used a single entity in the scope parameter, it is possible your integration is not expecting an array. Please be sure to account for this change prior to upgrade.

**SCIM client integrations**

If you are using FusionAuth as a SCIM server and you have integrated with a third-party SCIM client by manually performing a client credentials grant please be aware that you will need to adjust your integration.

The preferred integration with a SCIM client is to use the client credentials grant. By using a single long lived token you have functionally created an API key that cannot be revoked.

If your SCIM clients authentication configuration does not offer a way to configure the `scope` parameter you may add this to the Token endpoint as a query string. For example the Microsoft configuration does not offer a separate `scope` field so you will need to append `?scope={scope}` to the Token endpoint where the value of `{scope}` is the scope you are using to obtain an access token.

If your SCIM client authentication only allows for a token and does not directly support the client credentials grant, we would recommend that you programatically generate and rotate the access token by using an API to ensure that you are not creating very long lived access tokens for a SCIM client.

**Deprecated features removed**

The User API JWT authentication method which was deprecated in version `1.50.0` has now been removed.

**OAuth Logout**

Now that we identify an `id_token` using the newly added `tty` claim, the OAuth2 Logout endpoint will now correctly reject an `access_token` when sent as the `id_token_hint` parameter according to spec. If you have any integrations that are sending an `access_token` in the `id_token_hint` parameter instead of the `id_token` you will need to correct your integration prior to upgrading.

[3177](https://github.com/FusionAuth/fusionauth-issues/issues/3177)

[Known Issue](#v-1-65-0--known-issue--via-3438--r2ul)

Reactor and license data can be lost when migrating to a new version of FusionAuth. To avoid this issue, upgrade to version `1.65.0`.

Resolved in version [1.65.0](#version-1-65-0) via [3438](https://github.com/FusionAuth/fusionauth-issues/issues/3438).

[Known Issue](#v-1-64-0--known-issue--via-3366--4tfg)

Rarely, version upgrades may cause a FusionAuth instance to deactivate a configured license. To work around this issue, check for your license after a version upgrade; if it is missing, re-activate the license using your license Id from [account.fusionauth.io/](https://account.fusionauth.io/).

Resolved in version [1.64.0](#version-1-64-0) via [3366](https://github.com/FusionAuth/fusionauth-issues/issues/3366).

[Known Issue](#v-1-64-0--known-issue--via-3317--u7yw)

The `id_token_hint` field of the `oauth2/logout` endpoint is incompatible with Id tokens generated in `1.59.x` and earlier. Versions `1.64.0` and later are once again backwards-compatible with those tokens.

Resolved in version [1.64.0](#version-1-64-0) via [3317](https://github.com/FusionAuth/fusionauth-issues/issues/3317).

[Known Issue](#v-1-61-1--known-issue--via-3251--le61)

Providing an expired Id Token to the `/oauth2/logout` endpoint using the `id_token_hint` parameter results in an OAuth error.

Resolved in version [1.61.1](#version-1-61-1) via [3251](https://github.com/FusionAuth/fusionauth-issues/issues/3251).

[Known Issue](#v-1-61-0--known-issue--via-3186--5l99)

Performing a user reindex occasionally results in an email, username, or phoneNumber, for a small fraction of users, to not be searchable via Elasticsearch/OpenSearch.

Resolved in version [1.61.0](#version-1-61-0) via [3186](https://github.com/FusionAuth/fusionauth-issues/issues/3186).

[Known Issue](#v-1-60-2--known-issue--via-3190--qo61)

When using FusionAuth as a SAML Service Provider (SP), receiving a SAML Response containing an Assertion with an attribute value of `null` or of an unsupported type will result in a failure to parse the Response. If you have encountered this issue, please upgrade to `1.60.2` if possible.

Resolved in version [1.60.2](#version-1-60-2) via [3190](https://github.com/FusionAuth/fusionauth-issues/issues/3190).

[Known Issue](#v-1-60-1--known-issue--via-3183--vpkm)

When using FusionAuth as a SAML IdP with a SAML Populate lambda that reads or modifies the SAML assertion will fail causing the login request to fail. If you have encountered this issue, please upgrade to `1.60.1` if possible, or click on the linked GitHub issue to review the temporary workaround.

Resolved in version [1.60.1](#version-1-60-1) via [3183](https://github.com/FusionAuth/fusionauth-issues/issues/3183).

[New Feature](#new-feature--issue-2208--a0id)

Added support for the OIDC [prompt](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/prompt.md) parameter! This enables silent authentication, re-authentication requests, consent prompting, and more.

Thanks to all of the community members that have helped us define this requirement, and waited patiently for it!

[2208](https://github.com/FusionAuth/fusionauth-issues/issues/2208)

[Enhancement](#enhancement--issue-3177--3j02)

General improvements to how we handle and process JWTs in the form of access tokens and refresh tokens:

*   Adding `tty` claim to all tokens produced to easily differentiate between an access token and id token.
*   Moving the `gty` claim from the header to the body for tokens produced by an OAuth grant.
*   Moving the `use` claim from the header to the body for tokens produced by the client credentials grant for a SCIM server.
*   Better support of the `token_type_hint` on the Introspect endpoint.
*   Allow the use of refresh tokens on the Introspect endpoint with a `token_type_hint` of `refresh_token`

[3177](https://github.com/FusionAuth/fusionauth-issues/issues/3177)

[Enhancement](#enhancement--issue-2886--yaz3)

Move the `gty` and `use` claims from the JWT header to the body. This should improve interoperability with various identity providers such as AWS and Microsoft.

The `gty` claim will be present for all tokens produced by an OAuth grant. The `use` claim will be present in an access token produced to authenticate the SCIM server.

[2886](https://github.com/FusionAuth/fusionauth-issues/issues/2886)

[Enhancement](#enhancement--issue-3032--ldg3)

Significantly improved performance for the bulk User Import API.

Performance will particularly be improved when you have thousands of configured applications.

[3032](https://github.com/FusionAuth/fusionauth-issues/issues/3032)

[Enhancement](#enhancement--issue-3154--vf76)

Our release process now auto-updates the the example JSON payload for usage data on collected metrics.

This documentation will remain up to date going forward.

For example data, see [Collected Metrics](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/reference/collected-metrics.md#metrics).

[3154](https://github.com/FusionAuth/fusionauth-issues/issues/3154)

[Enhancement](#enhancement--issue-3159--bx4l)

In version `1.59.0` the password is now optional when creating or updating a user.

When returning from a third-party login, a user may be prompted to complete registration by entering a password when self-service is enabled and is configured to require a password.

This was unintended and has been corrected.

[3159](https://github.com/FusionAuth/fusionauth-issues/issues/3159)

[Enhancement](#enhancement--issue-3165--vpb3)

During a password reset workflow, for a user that has MFA configured, the user will be prompted to complete the MFA challenge.

When the user completes the challenge, the remember this device checkbox even when checked may not be honored.

The result is that once the user completes the change password workflow by completing an MFA challenge, the user will be prompt again on next login. This can be frustrating, and has been corrected.

[3165](https://github.com/FusionAuth/fusionauth-issues/issues/3165)

[Enhancement](#enhancement--issue-3171--gavw)

When performing the initial setup of FusionAuth outside of FusionAuth Cloud maintenance mode assists you with configuring the connecting to the database and search service.

When we cannot connect to the database, or you have not provided enough information to make these connections an error page is displayed.

This page has been enhanced to provide better messaging and links to documentation to help you out if you need to troubleshooting the setup process.

[3171](https://github.com/FusionAuth/fusionauth-issues/issues/3171)

[Enhancement](#enhancement--issue-3172--qahg)

FusionAuth now supports multiple assertions in the SAML AuthN response.

If the AuthN response contains multiple assertions, all will be made available to the SAML reconcile lambda function.

[3172](https://github.com/FusionAuth/fusionauth-issues/issues/3172)

[Enhancement](#enhancement--issue-3173--xt8u)

We significantly improved performance of User API searches returning expanded user records, and user reindex actions as well!

[3173](https://github.com/FusionAuth/fusionauth-issues/issues/3173)

[Fix](#fix--issue-2691--x7bf)

When decommissioning a license in a FusionAuth cluster, the change may not be reflected in all cluster nodes immediately. This can provide intermittent and inconsistent access to licensed features, depending on which node is handling a request.

[2691](https://github.com/FusionAuth/fusionauth-issues/issues/2691)

[Fix](#fix--issue-2887--wdac)

A user can be shown a rendering error while attempting to complete an email based MFA login.

The error occurs when send rate limiting has been enabled as part of Advanced Threat Detection. When the user reached the rate limit threshold for requesting emails to be sent to complete login, the intended error was not shown an instead a page rendering error was displayed.

[2887](https://github.com/FusionAuth/fusionauth-issues/issues/2887)

[Fix](#fix--issue-2936--ubmv)

When a user completes a forgot password workflow, the failed login count will be reset.

This should reduce frustration for a user that changed their password after exceeding the configured failed login count. In this scenario, if the user had entered the the incorrect password again they would be required to wait for the configured time period before attempting login again. This could be quite frustrating.

Now that the failed count has been reset, the user will at least be allowed to enter the wrong password a few more times before we thwart their efforts.

[2936](https://github.com/FusionAuth/fusionauth-issues/issues/2936)

[Fix](#fix--issue-2966--4zs8)

When running in dark mode, or using a dark theme with a FusionAuth simple theme, some QR code scanners are unable to read the QR code for setting up MFA. We have added a light border to ensure that the QR code is still readable on a dark background. The QR code should have a high-contrast border to allow these readers to work.

[2966](https://github.com/FusionAuth/fusionauth-issues/issues/2966)

[Fix](#fix--issue-3148--4lhh)

When previewing the `Phone verification required`, `Complete registration`, and `Passwordless` theme templates in an advanced theme preview window, a FreeMarker exception is displayed to the user.

This was introduced in version `1.59.0`.

[3148](https://github.com/FusionAuth/fusionauth-issues/issues/3148)

[Fix](#fix--issue-3151--1elf)

A race condition exists, when attempting to activate FusionAuth using an air-gapped license without any outbound network access that may cause the the request to fail and not correctly persist the license.

When this issue is encountered the system becomes un-licensed.

[3151](https://github.com/FusionAuth/fusionauth-issues/issues/3151)

[Fix](#fix--issue-3160--x682)

When regenerating Reactor's encryption key, the *Breached Password Detection* status may take longer than expected to return to *Active*.

If you were to encounter this issue, deactivating and reactivating your license will also correct the state. You can also reach out to support if you see something like this as well.

[3160](https://github.com/FusionAuth/fusionauth-issues/issues/3160)

[Fix](#fix--issue-3164--10tt)

Improved MFA configuration workflow during self-service registration when configured as required.

[3164](https://github.com/FusionAuth/fusionauth-issues/issues/3164)

[Fix](#fix--issue-3175--jaka)

In version `1.59.0`, changes were introduced that made it impossible to set webhooks for a handful of event types as transactional.

See release notes for `1.59.1` below for additional information.

[3175](https://github.com/FusionAuth/fusionauth-issues/issues/3175)

[Security](#security--issue-3177--k1yt)

FusionAuth accepts access tokens to authenticate requests and to initiate user authentication workflows.

Improvements have been made to how tokens are accepted, processed and validated to ensure they are suitable to authenticate the request. This will improve security now and will be necessary to support access tokens more extensively for authenticating requests.

[3177](https://github.com/FusionAuth/fusionauth-issues/issues/3177)

[Security](#security--issue-3172--r01m)

Improvements have been made to how FusionAuth processes signed SAML assertions to mitigate an identified vulnerability. If you are using using a SAML IdP, especially when allowing IdP initiated login, please plan to upgrade at your earliest convenience.

[3172](https://github.com/FusionAuth/fusionauth-issues/issues/3172)

[Internal](#internal--issue-3176--i3mt)

Updated the following dependencies:

*   Upgrade `io.fusionauth:fusionauth-usage-stats:fusionauth-usage-stats-common` `0.6.0` -> `0.6.1`
*   Upgrade `org.primeframework:prime-mvc` `4.34.0` -> `4.35.1`
*   Upgrade `io.fusionauth:fusionauth-samlv2` `0.11.1` -> `1.0.0`

[3176](https://github.com/FusionAuth/fusionauth-issues/issues/3176)

## Version 1.59.1

20 August 2025

[Known Issue](#v-1-60-0--known-issue--via-3159--hvok)

Admins control whether users must have passwords for an application by modifying the application's advanced registration form. Basic registration forms always have a password field, so a password is always required. IdP logins (such as Login with Google) create users without passwords. If the users are using an IdP to log in to an application with a required password field, the user is forced to set a password.

Resolved in version [1.60.0](#version-1-60-0) via [3159](https://github.com/FusionAuth/fusionauth-issues/issues/3159).

[Known Issue](#v-1-60-0--known-issue--via-3175--z64v)

Updating the tenant will cause the following webhok events when enabled to be configured as non-transactional. This will only affect you if you have configured one or more of these event types as transactional:

*   `user.identity.update`
*   `user.identity.verified`
*   `user.registration.create`
*   `user.registration.delete`
*   `user.registration.update`
*   `user.registration.verified`
*   `user.update`

Resolved in version [1.60.0](#version-1-60-0) via [3175](https://github.com/FusionAuth/fusionauth-issues/issues/3175).

[Known Issue](#v-1-62-0--known-issue--via-3161--2yqw)

IdP logins do not work for Universal Apps. Instead, the error message `Invalid_Request. Missing_tenant_id` is displayed.

Resolved in version [1.62.0](#version-1-62-0) via [3161](https://github.com/FusionAuth/fusionauth-issues/issues/3161).

[Known Issue](#v-1-61-0--known-issue--via-3186--5l99)

Performing a user reindex occasionally results in an email, username, or phoneNumber, for a small fraction of users, to not be searchable via Elasticsearch/OpenSearch.

Resolved in version [1.61.0](#version-1-61-0) via [3186](https://github.com/FusionAuth/fusionauth-issues/issues/3186).

[Fix](#fix--issue-3153--s7qq)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade.

[3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153)

## Version 1.59.0 (Identity Ibex)

20 August 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--ah49)

This version of requires several changes to your theme to support users without passwords.

[Deprecated](#deprecated--319e)

Registration verification is deprecated and will be removed in a future version of FusionAuth.

**User API**

For `/api/user` GET:

`user.verified` is now a deprecated field that only indicates whether or not the User's primary email identity has been verified. This does NOT indicate whether phone number identity types are verified. Use `user.identities[x].verified` and `user.identities[x].verifiedReason` instead.

For `/api/user` POST:

`sendSetPasswordEmail` is deprecated. Use `sendSetPasswordIdentityType` instead.

For `/api/user/forgot-password` POST:

`sendForgotPasswordEmail` is deprecated. Use `sendForgotPasswordMessage` instead.

**User Registration API**

`sendSetPasswordEmail` is deprecated. Use `sendSetPasswordIdentityType` instead.

[Known Issue](#known-issue--via-3401--ls9y)

Setting `user.passwordChangeRequired` to `true` on a user with no current password appears successful in the Admin UI and returns a `200` status code in the API. But the value remains `false` and the user is never prompted to change their password.

As a workaround, you can set a random secure password on the user account, *then* set `user.passwordChangeRequired` to `true`. As long as the user has a recovery option available (e.g. email or phone), they can use the **Forgot Password** flow to set up a new password.

[Known Issue](#v-1-64-0--known-issue--via-3287--2mpn)

Connectors do not allow login via username or email when the connector returns a different username or email from what the request provided.

Resolved in version [1.64.0](#version-1-64-0) via [3287](https://github.com/FusionAuth/fusionauth-issues/issues/3287).

[Known Issue](#v-1-59-1--known-issue--via-3153--5gvz)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version `1.59.0`, it is recommended that you upgrade to version `1.59.1`. If upgrading to `1.59.1` does not resolve this, please contact support.

Resolved in version [1.59.1](#version-1-59-1) via [3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153).

[Known Issue](#v-1-61-0--known-issue--via-3186--5l99)

Performing a user reindex occasionally results in an email, username, or phoneNumber, for a small fraction of users, to not be searchable via Elasticsearch/OpenSearch.

Resolved in version [1.61.0](#version-1-61-0) via [3186](https://github.com/FusionAuth/fusionauth-issues/issues/3186).

[Known Issue](#v-1-60-0--known-issue--via-3148--nvm5)

Previewing the phone verification required, complete registration, passwordless theme templates shows a template error.

Resolved in version [1.60.0](#version-1-60-0) via [3148](https://github.com/FusionAuth/fusionauth-issues/issues/3148).

[Known Issue](#v-1-61-1--known-issue--via-3247--3mp9)

When a Minimum Password Age is configured for the tenant, creating a user without a password results in an exception.

Resolved in version [1.61.1](#version-1-61-1) via [3247](https://github.com/FusionAuth/fusionauth-issues/issues/3247).

[Known Issue](#v-1-63-0--known-issue--via-3237--kkrd)

A reconcile lambda could fail to set a value for an IdP linking strategy when the IdP's value is `null`.

Resolved in version [1.63.0](#version-1-63-0) via [3237](https://github.com/FusionAuth/fusionauth-issues/issues/3237).

[New Feature](#new-feature--issue-3145--3l0s)

This release adds support for phone number as a first-class identity type. A user can now have phone number as their sole identifier, use SMS-based passwordless login, and much more. Read on for more information on related features!

[3145](https://github.com/FusionAuth/fusionauth-issues/issues/3145)

[New Feature](#new-feature--issue-208--3h1r)

With support for phone number as a first-class identity type, phone number can now be used as the sole identity type for a user, allowing phone-only registration.

[208](https://github.com/FusionAuth/fusionauth-issues/issues/208)

[New Feature](#new-feature--issue-1552--rqpk)

FusionAuth now supports Passwordless Authentication through SMS. Previously, a user was only able to use an email address for passwordless authentication.

[1552](https://github.com/FusionAuth/fusionauth-issues/issues/1552)

[New Feature](#new-feature--issue-625--j09e)

This release adds support for phone number verification.

[625](https://github.com/FusionAuth/fusionauth-issues/issues/625)

[Enhancement](#enhancement--issue-3132--d4b2)

Additional usage stats are collected for the use of grace periods with application refresh tokens, and for non-retrievable and expiring api keys.

[3132](https://github.com/FusionAuth/fusionauth-issues/issues/3132)

[Enhancement](#enhancement--issue-1574--kp1e)

When a messenger fails to deliver a message, FusionAuth now adds an event log for the error. This enhancements should help with troubleshooting message delivery issues.

[1574](https://github.com/FusionAuth/fusionauth-issues/issues/1574)

[Enhancement](#enhancement--issue-1778--kl7j)

Importing a password hash longer than 255 characters no longer fails. This limit was increased to 2048 characters.

[1778](https://github.com/FusionAuth/fusionauth-issues/issues/1778)

[Enhancement](#enhancement--issue-3120--vem4)

Update copy for the first `Enable SMS` step. It's using the word `two` instead of `too`.

[3120](https://github.com/FusionAuth/fusionauth-issues/issues/3120)

[Enhancement](#enhancement--issue-3141--pd9e)

The `exp` claim in the FusionAuth JWT can now be modified in a JWT Populate lambda, but only to a smaller value. This means you cannot extend the default lifetime of a JWT, however you can choose to shorten it. This allows for stricter JWT expirations to be applied dynamically based on user data or other information. Additionally, `scope` is now available to JWT Populate lambdas.

[3141](https://github.com/FusionAuth/fusionauth-issues/issues/3141)

[Enhancement](#enhancement--issue-484--4igq)

Passwords are now optional on users. This allows for passwordless-only and/or federated-only authentication, and simplifies the importing of users that don't currently have passwords.

[484](https://github.com/FusionAuth/fusionauth-issues/issues/484)

[Fix](#fix--issue-1573--7fcm)

When using a generic messenger in interactive workflows, no error is shown to the user if the message delivery attempt returns a non-200 response code. The user should be alerted to the fact that something went wrong.

[1573](https://github.com/FusionAuth/fusionauth-issues/issues/1573)

[Fix](#fix--issue-3073--ddmu)

During the slow migration of a user using a generic or LDAP connector, the known device cookie is not created. If the new device email or a new device webhook is configured, FusionAuth sends a second new device email and/or new device webhook the next time the user logs in.

[3073](https://github.com/FusionAuth/fusionauth-issues/issues/3073)

[Fix](#fix--issue-3142--fkne)

There are cases where we are not returning appropriate errors for invalid inputs to APIs. Errors with appropriate and descriptive messages should be returned.

[3142](https://github.com/FusionAuth/fusionauth-issues/issues/3142)

[Security](#security--issue-3144--sp8c)

Improved defenses against cross-site scripting attacks.

[3144](https://github.com/FusionAuth/fusionauth-issues/issues/3144)

[Security](#security--issue-3146--pzxp)

A potential vulnerability was identified that could lead to unwanted access to protected resources via an injection attack. Addition protections were added to prevent this.

[3146](https://github.com/FusionAuth/fusionauth-issues/issues/3146)

[Internal](#internal--issue-3143--jb1y)

Updated the following dependencies:

*   Upgrade `com.inversoft:inversoft-api-authentication` `0.30.0` -> `0.30.2`
*   Upgrade `com.inversoft:inversoft-config` `0.9.13` -> `0.10.0`
*   Upgrade `com.inversoft:inversoft-database` `0.10.2` -> `0.10.3`
*   Upgrade `com.inversoft:inversoft-license` `4.8.0` -> `4.8.1`
*   Upgrade `com.inversoft:inversoft-maintenance-mode` `0.23.1` -> `0.23.3`
*   Upgrade `com.inversoft:inversoft-support` `0.14.1` -> `0.14.2`
*   Upgrade `jakarta.mail:jakarta.mail-api` `2.1.2` -> `2.1.3`
*   Upgrade `jakarta.activation:jakarta.activation-api` `2.1.2` -> `2.1.3`
*   Upgrade `org.primeframework:prime-email` `0.21.0` -> `0.21.1`

[3143](https://github.com/FusionAuth/fusionauth-issues/issues/3143)

## Version 1.58.3

14 August 2025

[Fix](#fix--issue-3153--s7qq)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade.

[3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153)

## Version 1.58.2

23 July 2025

[Known Issue](#v-1-58-3--known-issue--via-3153--ek27)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version `1.58.2`, it is recommended that you upgrade to version `1.58.3`. If upgrading to `1.58.3` does not resolve this, please contact support.

Resolved in version [1.58.3](#version-1-58-3) via [3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153).

[Fix](#v-1-63-0--fix--via-3149--6v58)

The SCIM create operation returns error code `400` (instead of `409`) when *both* `user.email` and `user.username` are duplicated.

Resolved in version [1.63.0](#version-1-63-0) via [3149](https://github.com/FusionAuth/fusionauth-issues/issues/3149).

[Fix](#fix--issue-3123--v556)

The `Add Webhook` page and the `Login Records` report can show errors in some circumstances. These error conditions should be handled more gracefully.

[3123](https://github.com/FusionAuth/fusionauth-issues/issues/3123)

## Version 1.58.1

23 July 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-58-3--known-issue--via-3153--ioh3)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version `1.58.1`, it is recommended that you upgrade to version `1.58.3`. If upgrading to `1.58.3` does not resolve this, please contact support.

Resolved in version [1.58.3](#version-1-58-3) via [3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153).

[Fix](#fix--issue-3124--n3eg)

A race condition was identified in the `1.58.0` release that could affect a cluster of FusionAuth instances during the upgrade, preventing the upgrade from completing. This race condition has been addressed.

[3124](https://github.com/FusionAuth/fusionauth-issues/issues/3124)

## Version 1.58.0 (Delegation Dolphin)

21 July 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-58-1--known-issue--via-3124--tdm5)

After releasing FusionAuth version `1.58.0` we identified a race condition that could prevent an upgrade to version `1.58.0` from successfully completing in a clustered environment. We removed this release from distribution. If you happened to install version `1.58.0` during the brief time that it was available, it is recommended that you upgrade to version `1.58.3`.

Resolved in version [1.58.1](#version-1-58-1) via [3124](https://github.com/FusionAuth/fusionauth-issues/issues/3124).

[Known Issue](#v-1-58-3--known-issue--via-3153--msw0)

An upgrade to FusionAuth version `1.58.2` or `1.59.0` fails if the `Default Admin Registration provided by FusionAuth` form (shipped in `1.20.0`) is renamed or deleted prior to the upgrade. If you are planning an upgrade to version `1.58.0`, it is recommended that you upgrade to version `1.58.3`. If upgrading to `1.58.3` does not resolve this, please contact support.

Resolved in version [1.58.3](#version-1-58-3) via [3153](https://github.com/FusionAuth/fusionauth-issues/issues/3153).

[New Feature](#new-feature--issue-1524--jrn3)

FusionAuth now includes a [Tenant manager application](https://4002.18-224-161-104.sslip.io/docs/lifecycle/manage-users/tenant-manager.md). The Tenant Manager application is used for managing users within a single FusionAuth tenant, and you can grant access to this application to ordinary users (i.e. not FusionAuth admins). This is useful for delegating user administration to users in your, or your customers' organizations.

[1524](https://github.com/FusionAuth/fusionauth-issues/issues/1524)

[New Feature](#new-feature--issue-3065--runq)

FusionAuth introduces [Universal Applications](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/types/applications.md#universal-applications)! Formerly, in FusionAuth an application belonged to one and only one tenant. This can be cumbersome when you want to expose your application in many tenants, as you need to create an application record in each tenant. With universal applications, a single application entry in FusionAuth can be used in all tenants.

[3065](https://github.com/FusionAuth/fusionauth-issues/issues/3065)

[Enhancement](#enhancement--issue-2978--thanks-konvergence--wy0n)

FusionAuth was not handling a malformed Set-Cookie response header from another identity provider gracefully. The parsing done by FusionAuth was updated to handle this scenario better.

Thanks to [@konvergence](https://github.com/konvergence)!

[2978](https://github.com/FusionAuth/fusionauth-issues/issues/2978)

[Fix](#fix--issue-2982--icw6)

Searching for entities using the [Entity Search API](http://localhost:3000/docs/apis/entities/entities#search-for-entities) can produce results that have duplicate or missing items on response pages when a sort field isn't specified. Results should have an implicit ordering when no sort field is specified.

[2982](https://github.com/FusionAuth/fusionauth-issues/issues/2982)

[Fix](#fix--issue-3044--hdxg)

In certain circumstances, the FusionAuth admin UI and self-service account applications can fail to refresh an expired access token, causing a user to be logged out.

[3044](https://github.com/FusionAuth/fusionauth-issues/issues/3044)

[Fix](#fix--issue-3074--ndwx)

Calling the [Search Reindex API](https://4002.18-224-161-104.sslip.io/docs/apis/system/rebuild-the-elasticsearch-index.md) while a reindex is in progress yields a 500 error. This API now returns a 400 status if a reindex operation is already running.

[3074](https://github.com/FusionAuth/fusionauth-issues/issues/3074)

[Fix](#fix--issue-3106--6d6g)

Using PATCH calls from HTTPConnect in a lambda fails in some cases. PATCH should be generally supported.

[3106](https://github.com/FusionAuth/fusionauth-issues/issues/3106)

[Fix](#fix--issue-3115--yn1w)

Interacting with a date picker can generate errors in the broswer's console. FusionAuth should handle these errors more gracefully.

[3115](https://github.com/FusionAuth/fusionauth-issues/issues/3115)

[Fix](#fix--issue-3116--amee)

A few forms in the FusionAuth admin UI are setting the input focus in nonstandard ways. These include the setup wizard, the add API key view, and the edit API key view.

[3116](https://github.com/FusionAuth/fusionauth-issues/issues/3116)

[Fix](#fix--issue-3117--21ys)

When handling an HTTP request with a content type of `multipart/*`, FusionAuth now more accurately returns an HTTP status code of 422 if the request contains a file and a file upload was not expected for the intended HTTP request path.

[3117](https://github.com/FusionAuth/fusionauth-issues/issues/3117)

[Security](#security--issue-3117--de5q)

Enhance developer feedback when rejecting unexpected multipart/\* encoded requests containing files. Added additional file management configuration to allow for a per request persistence policy.

[3117](https://github.com/FusionAuth/fusionauth-issues/issues/3117)

## Version 1.57.1

22 April 2025

[Breaking Change](#breaking-change--r1xw)

**Only for users who have manually installed fusionauth using the RPM or Debian packages**: when upgrading from releases prior to `1.57.1`, you must ensure that both the `fusionauth-app` and `fusionauth-search` services are stopped. To do this, run the following command:

```bash
sudo systemctl stop fusionauth-app fusionauth-search
```

The upgrade will run a `usermod` command to modify the `fusionauth` user account so both processes must be stopped in order for the upgrade to succeed.

[Fix](#fix--issue-3013--n2rm)

Fixed a bug introduced in version `1.56.0` that caused FusionAuth to fail to start after being installed using RPM and Debian packages.

[3013](https://github.com/FusionAuth/fusionauth-issues/issues/3013)

[Known Issue](#v-1-68-0--known-issue--issue-3109--i0xa)

Hosted login pages do not display errors produced by the login validation lambda before presenting an MFA challenge to the user.

[3109](https://github.com/FusionAuth/fusionauth-issues/issues/3109)

## Version 1.57.0 (Webhook Wombat)

4 April 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-69-0--known-issue--via-3089--8c6k)

User MFA method validation does not check for duplicates when providing an `id` for the method. This allows a user to add the same email account or phone number multiple times.

Resolved in version [1.69.0](#version-1-69-0) via [3089](https://github.com/FusionAuth/fusionauth-issues/issues/3089).

[Enhancement](#enhancement--issue-3037--x1pl)

Two enhancements were added to the configuration for controlling webhook event logging behavior:

*   Webhook event logging can now be turned off, which is the default for new FusionAuth installations. Previously, you were only able to reduce the retention period to a very small window, however in this case the logging and log management would still occur.
*   Deleting webhook event logs according to a configured retention period is now enabled by default. Previously, it was disabled by default.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Enhancement](#enhancement--issue-3038--8i7p)

Webhook event log searching was improved by setting a default 1-hour search window when no duration parameters are provided. Webhook event logging can create a large number of log records, and the performance of unbounded searches scaled roughly linearly with the number of log records, leading to less performant searches as the data size increased.

[3038](https://github.com/FusionAuth/fusionauth-issues/issues/3038)

[Enhancement](#enhancement--issue-3039--hbaj)

The process that applies webhook event log retention rules is getting some performance improvements. This is a background process that generally does not impact performance but could consume a disproportionate amount of system resources when under heavy load.

[3039](https://github.com/FusionAuth/fusionauth-issues/issues/3039)

[Enhancement](#enhancement--issue-2980--lrqa)

When prompted for how you heard about FusionAuth in the setup wizard, you may now supply "ChatGPT/LLMs/AI" as a standard response.

[2980](https://github.com/FusionAuth/fusionauth-issues/issues/2980)

[Fix](#fix--issue-3037--5vuq)

The process for deleting webhook event logs according to retention rules was formerly turned off by default, causing all webhook event log entries to be retained forever. This will now be enabled by default in new FusionAuth installations. Existing installations that are being upgraded will retain their former setting.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Fix](#fix--issue-3026--isv4)

The client libraries were missing `PATCH` support for Entities. Support for this operation has been added.

[3026](https://github.com/FusionAuth/fusionauth-issues/issues/3026)

[Fix](#fix--issue-3027--acop)

Client libraries are missing full support for `PUT` and `PATCH` operations for entity types, forms, form fields, IP ACLs, webhooks, and families. This fix adds support for these.

[3027](https://github.com/FusionAuth/fusionauth-issues/issues/3027)

## Version 1.56.0 (SSO Snake)

6 March 2025

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-57-0--known-issue--via-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

Resolved in version [1.57.0](#version-1-57-0) via [3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037).

[Known Issue](#v-1-65-0--known-issue--via-3382--7ff3)

The Admin UI may fail to display embedded maps.

Resolved in version [1.65.0](#version-1-65-0) via [3382](https://github.com/FusionAuth/fusionauth-issues/issues/3382).

[Enhancement](#enhancement--issue-2536--zf1z)

FusionAuth now allows you to create non-retrievable API keys. If you select this option when creating a key, the key will only be visible during creation and not thereafter. Make a copy and keep it secure!

[2536](https://github.com/FusionAuth/fusionauth-issues/issues/2536)

[Enhancement](#enhancement--issue-2732--9l96)

Improved the execution performance of lambdas

[2732](https://github.com/FusionAuth/fusionauth-issues/issues/2732)

[Enhancement](#enhancement--issue-2975--i4i8)

Allow the post-login bootstrapping of a FusionAuth SSO session using an access token. This can be useful if you've authenticated a user outside of an OAuth workflow, or if you've lost access to the SSO session cookie.

[2975](https://github.com/FusionAuth/fusionauth-issues/issues/2975)

[Fix](#fix--issue-2252--4gts)

FusionAuth returns a 500 when supplying a malformed application Id in an IdP-initiated SAML login, making it hard to troubleshoot. The error should be handled more gracefully, and a more meaningful error message should be returned.

[2252](https://github.com/FusionAuth/fusionauth-issues/issues/2252)

[Fix](#fix--issue-2721--thanks-jcelentano--23ij)

The Application > Multi-Factor > SMS Template tooltip incorrectly referenced an email template instead of an SMS template. Updated this to reference the correct template type.

Thanks to [@JCelentano](https://github.com/JCelentano)!

[2721](https://github.com/FusionAuth/fusionauth-issues/issues/2721)

[Fix](#fix--issue-2814--iugb)

The passwordless API returns a 500 error when a non-existent application Id is provided. This should return a correct response code and meaningful error.

[2814](https://github.com/FusionAuth/fusionauth-issues/issues/2814)

[Fix](#fix--issue-2826--pwei)

When posting an invalid grant type to the `/oauth2/token` endpoint, the list of supported grant types in the error message is missing the `device` grant type

[2826](https://github.com/FusionAuth/fusionauth-issues/issues/2826)

[Fix](#fix--issue-2838--94mv)

Users are being prompted to re-submit a form when first logging into a new deployment using Firefox. The request should proceed on the first attempt.

[2838](https://github.com/FusionAuth/fusionauth-issues/issues/2838)

[Fix](#fix--issue-2872--6r1x)

When creating an entity grant for a user using the API, some invalid payloads will yield a 500 error. A more meaningful error should be returned.

[2872](https://github.com/FusionAuth/fusionauth-issues/issues/2872)

[Fix](#fix--issue-2888--ed2e)

FusionAuth shows a notification for getting a free license even after a license has been installed. This notification should disappear after a FusionAuth instance has been licensed.

[2888](https://github.com/FusionAuth/fusionauth-issues/issues/2888)

[Fix](#fix--issue-2892--nojw)

Executing a manual system reset in development mode with a valid kickstart file fails. This should work as expected.

[2892](https://github.com/FusionAuth/fusionauth-issues/issues/2892)

[Fix](#fix--issue-2913--1x0e)

Supplying a malformed license key to Reactor is producing a generic error. A specific error would be more helpful.

[2913](https://github.com/FusionAuth/fusionauth-issues/issues/2913)

[Fix](#fix--issue-2931--2e72)

The Daily Active Users report is missing data from the most recent day. The report should include this data.

[2931](https://github.com/FusionAuth/fusionauth-issues/issues/2931)

[Fix](#fix--issue-2941--eo1m)

After setting an application-level email verification template, the tenant-level template is still being used. The application-level setting should be honored.

[2941](https://github.com/FusionAuth/fusionauth-issues/issues/2941)

[Fix](#fix--issue-2953--uafw)

The standard first name field intended for use in user edit forms has an incorrect name in MySQL installations, which is preventing it from showing up in the user edit form

[2953](https://github.com/FusionAuth/fusionauth-issues/issues/2953)

[Fix](#fix--issue-2962--il5s)

The webhook event log can return fewer records per page than requested with the *Results per page* dropdown, even when more results are available. Ensure that the number of results equals the requested number.

[2962](https://github.com/FusionAuth/fusionauth-issues/issues/2962)

[Fix](#fix--issue-2970--q8b1)

A nondescript error is returned when trying to save system settings via the FusionAuth admin application. It is still possible to update system settings using the API.

[2970](https://github.com/FusionAuth/fusionauth-issues/issues/2970)

[Fix](#fix--issue-2990--4062)

The simple theme editor's right-hand panel did not constrain content properly, allowing content to spill over the bottom border.

[2990](https://github.com/FusionAuth/fusionauth-issues/issues/2990)

[Security](#security--issue-2976--dl5k)

Improved security around certain cross-origin requests

[2976](https://github.com/FusionAuth/fusionauth-issues/issues/2976)

[Internal](#internal--issue-2873--ptl6)

Updated the following dependencies:

*   Upgrade `ch.qos.logback:logback-core` `1.5.6` -> `1.5.16`
*   Upgrade `org.primeframework:prime-mvc` `4.27.0` -> `4.29.2`
*   Upgrade `org.graalvm.polyglot:polyglot` `22.3.3` -> `24.1.2`
*   Upgrade `org.graalvm.js:js` `22.3.3` -> `24.1.2`
*   Upgrade `com.inversoft:inversoft-cache` `0.6.0` -> `0.6.1`
*   Upgrade `com.inversoft:inversoft-api-authentication` `0.29.0` -> `0.30.0`

[2873](https://github.com/FusionAuth/fusionauth-issues/issues/2873)

[Internal](#internal--issue-2963--3vqt)

Removed duplicated storage of internal messages relating to SCIM group operations

[2963](https://github.com/FusionAuth/fusionauth-issues/issues/2963)

[Internal](#internal--issue-2967--lgey)

Added instrumentation to help with the auto-generation of documentation.

[2967](https://github.com/FusionAuth/fusionauth-issues/issues/2967)

## Version 1.55.1 (Holiday Hippo)

21 December 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--issue-2952--y94g)

Increased the length of the refresh token from `54` to `64` characters. If you hardcode a specific length, you must account for this change.

[2952](https://github.com/FusionAuth/fusionauth-issues/issues/2952)

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Known Issues](#v-1-56-0--known-issues--via-2970--yc4z)

You can't save the System Settings in the admin UI.

Resolved in version [1.56.0](#version-1-56-0) via [2970](https://github.com/FusionAuth/fusionauth-issues/issues/2970).

[New Feature](#new-feature--issue-2741--jdq4)

Allow for the sending of usage stats. Enabling usage stats allow FusionAuth to better understand how our users use our product. Usage data does not contain configuration, user data or any information that can be used to identity a company or individual. This information will help us know where we need to invest in new features and enhancements.

If you are using FusionAuth Cloud, this feature will be enabled by default and cannot be disabled.

[2741](https://github.com/FusionAuth/fusionauth-issues/issues/2741)

[Enhancement](#enhancement--issue-1596--thanks-juansedo--4l8h)

The `rate limit` error message was added to the default theme messages to make it more obvious that it is customizable. The `[RateLimitedException]` message key was previously supported, but not easily discoverable.

Thanks to [@juansedo](https://github.com/juansedo)!

[1596](https://github.com/FusionAuth/fusionauth-issues/issues/1596)

[Enhancement](#enhancement--issue-1619--1f52)

Add an additional refresh token revocation policy to revoke a one-time use token on reuse. This policy helps protect against token theft by revoking the token if it were to be stolen and reused.

[1619](https://github.com/FusionAuth/fusionauth-issues/issues/1619)

[Enhancement](#enhancement--issue-2378--6zvr)

FusionAuth can now accept encrypted SAML assertions when acting as a SAML service provider. Support for encrypted assertions when FusionAuth is the SAML identity provider was added in version `1.47.0` .

[2378](https://github.com/FusionAuth/fusionauth-issues/issues/2378)

[Enhancement](#enhancement--issue-2537--7jkh)

API keys can now be optionally set to expire at a given date/time. An expired key will not be deleted but will cause a `401` response to be returned when used. The expiration value can be edited to allow the expiration to be extended.

[2537](https://github.com/FusionAuth/fusionauth-issues/issues/2537)

[Enhancement](#enhancement--issue-2742--7hgl)

Additional parameters are now accepted on the hosted backend `/app/login` and `/app/registration` endpoints. This means you can pass things like `login_hint`, `idp_hint`, and analytics parameters that will be available on the respective OAuth hosted pages.

[2742](https://github.com/FusionAuth/fusionauth-issues/issues/2742)

[Enhancement](#enhancement--issue-2859--c6cj)

The First-time Setup wizard was improved with more descriptive and consistent text around using a Community plan license.

[2859](https://github.com/FusionAuth/fusionauth-issues/issues/2859)

[Enhancement](#enhancement--issue-2864--ay4r)

In the new Webhook Event Log there were numerous small UX and copy improvements.

[2864](https://github.com/FusionAuth/fusionauth-issues/issues/2864)

[Enhancement](#enhancement--issue-2878--53mn)

Improved handling of a SAML `RelayState` in an IdP-initiated login. Previously, FusionAuth would only look for a valid ACS URL in the `RelayState`. Now, if the ACS URL can be resolved via other means, the `RelayState` value will be preserved and passed as a parameter in the final call to the ACS URL.

[2878](https://github.com/FusionAuth/fusionauth-issues/issues/2878)

[Enhancement](#enhancement--issue-2938--ar9b)

Added support for providing connect and read timeout values when making a `fetch` call from a lambda.

[2938](https://github.com/FusionAuth/fusionauth-issues/issues/2938)

[Enhancement](#enhancement--issue-2952--vw1h)

You can now configure a grace period for single-use refresh tokens, during which time the previous token will remain active. This is required for various use cases, including when clustered OAuth clients employ eventual consistency when synchronizing a refresh token, and some nodes of a client can find themselves with an out-of-date refresh token.

[2952](https://github.com/FusionAuth/fusionauth-issues/issues/2952)

[Fix](#fix--issue-2737--ezhu)

The confirmation page shown when users are completing verification and other workflows shows a FreeMarker error when some cookies are unavailable. This could happen when cookies are deleted by a user, removed by a proxy, or when running in an iframe.

[2737](https://github.com/FusionAuth/fusionauth-issues/issues/2737)

[Fix](#fix--issue-2767--1ob5)

When an OAuth workflow ends in redirecting with an error to a `redirect_uri` that contains query parameters, the resulting URL is being built incorrectly.

[2767](https://github.com/FusionAuth/fusionauth-issues/issues/2767)

[Fix](#fix--issue-2793--thanks-runely--i6ku)

The SCIM ResourceTypes endpoint is returning resource type URLs with incorrect paths. The endpoint is returning a path prefix of `/api/scim/v2/` when it should be `/api/scim/resource/v2/`.

Thanks to [@runely](https://github.com/runely)!

[2793](https://github.com/FusionAuth/fusionauth-issues/issues/2793)

[Fix](#fix--issue-2817--fee2)

The OAuth scopes consent form has text that cannot be localized. Hosted pages should be fully localizable for users.

[2817](https://github.com/FusionAuth/fusionauth-issues/issues/2817)

[Fix](#fix--issue-2839--thanks-rod-martens-alida--63tf)

When viewing user data in the `Manage user` view, a boolean value is always shown as `-`, regardless of its actual value.

Thanks to [@rod-martens-alida](https://github.com/rod-martens-alida)!

[2839](https://github.com/FusionAuth/fusionauth-issues/issues/2839)

[Fix](#fix--issue-2899--r77k)

The JWT populate lambda is not executed when a user is logged in using the login API, but only when that user does not have a registration for the application named in the API call. This could lead to inconsistent behavior between a login using the hosted OAuth pages and a login using the login API.

[2899](https://github.com/FusionAuth/fusionauth-issues/issues/2899)

[Fix](#fix--issue-2909--4k7o)

The PHP client library is not handling libcurl errors gracefully, making it difficult to troubleshoot integration problems when using this library. See the [client library issue](https://github.com/FusionAuth/fusionauth-php-client/issues/28) for more details.

[2909](https://github.com/FusionAuth/fusionauth-issues/issues/2909)

[Fix](#fix--issue-2917--8516)

When downloading login records from System -> Login Records , the exported file format contains a place for zip code, however the zip code values are not being populated in the export.

[2917](https://github.com/FusionAuth/fusionauth-issues/issues/2917)

[Fix](#fix--issue-2928--thanks-cezarneaga--iu3v)

The `POST /api/user/registration` call is documented as returning a `refreshTokenId`, but this value is not being returned on the response.

Thanks to [@cezarneaga](https://github.com/cezarneaga)!

[2928](https://github.com/FusionAuth/fusionauth-issues/issues/2928)

[Fix](#fix--issue-2932--vnra)

When editing a user's password in the FusionAuth admin UI after a new hashing scheme is set on the tenant, the password is not re-hashed using the new scheme. The re-hashing occurs as expected on a login or when the user changes their own password.

[2932](https://github.com/FusionAuth/fusionauth-issues/issues/2932)

[Security](#security--issue-2906--sa4d)

Correct validation for configured authorized redirect URLs when using wild card support has been enabled.

[2906](https://github.com/FusionAuth/fusionauth-issues/issues/2906)

[Security](#security--issue-2916--1ym3)

Add additional validation of an authorizing JWT when using the Issue JWT API (`/api/jwt/issue`).

[2916](https://github.com/FusionAuth/fusionauth-issues/issues/2916)

[Internal](#internal--issue-2147--bq3k)

Added tests to verify correct handing of wildcards in URLs in various places in the application. This change does not contain any functional changes.

[2147](https://github.com/FusionAuth/fusionauth-issues/issues/2147)

[Internal](#internal--issue-2880--wiav)

Remove unused comments in a few theme templates.

[2880](https://github.com/FusionAuth/fusionauth-issues/issues/2880)

[Internal](#internal--issue-2873--g8ur)

Update dependencies.

*   Upgrade `org.primeframework:prime-mvc` `4.22.13` -> `4.27.0`

[2873](https://github.com/FusionAuth/fusionauth-issues/issues/2873)

[Internal](#internal--issue-2929--qm98)

Better exception handling in extreme edge cases related to licensing of Breached Password Detection.

[2929](https://github.com/FusionAuth/fusionauth-issues/issues/2929)

## Version 1.54.0 (Express Free Trial (EFT) Elephant)

25 November 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Fix](#fix--issue-2869--c9a1)

The SCIM Groups API does not properly perform atomic updates to groups and members. This can lead to consistency issues when multiple SCIM update requests are simultaneously processed requiring membership changes.

[2869](https://github.com/FusionAuth/fusionauth-issues/issues/2869)

[Security](#security--issue-2933--z8y0)

A vulnerability was discovered in the FusionAuth hosted pages. Under specific application configurations, and with insufficient authorization validation being performed on an access token, a malicious user could bypass required steps in post-authentication workflows, allowing unauthorized access to protected resources.

This vulnerability was introduced in version `1.41.0`. It is recommended that you upgrade to version `1.54.0` at your earliest convenience.

[2933](https://github.com/FusionAuth/fusionauth-issues/issues/2933)

## Version 1.53.3

25 October 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--2cxn)

A fix for FusionAuth SSO session management with external identity providers requires a change to Google IdP usage.

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Fix](#fix--issue-2764--lccc)

In order to better protect 3rd party logins via SAML v2, OpenID Connect, and other 3rd party identity providers, a CSRF (cross site request forgery) token was added in version `1.47.0`. This token was not being used when all identity providers configured for the requested `client_id` were also configured to use managed domains, and the authorize request also contained the `idp_hint` request parameter.

In this specific configuration, because the token was not being utilized, the login workflow would fail with the error `The request origin could not be verified. Unable to complete this login request.`

[2764](https://github.com/FusionAuth/fusionauth-issues/issues/2764)

[Fix](#fix--issue-2893--tb72)

When using the hosted login pages, the end user is generally shown a checkbox named `Keep me signed in`, which indicates whether the user wishes to create an SSO session after logging in.

When using an external identity provider along with an `idp_hint` or `login_hint` parameter, a user may be taken directly to the identity provider, bypassing the page with this checkbox. In this case, the user will not have the option of making a choice to establish or not establish an SSO session.

This behavior has been improved in order to provide additional control on how the SSO session should be created.

FusionAuth will now use the following order of operations in this non-interactive workflow to decide if the SSO session should be created:

1.  The user's previous selection, if available. This past choice will have been stored in an HTTP only cookie.
2.  The optionally supplied `rememberDevice` query parameter.

In the event that the user has never seen the login page, the value of the `rememberDevice` query parameter will be the deciding factor. A value of `true` indicates that an SSO session should be created and a value of `false` indicates that an SSO session should not be created. If this parameter is omitted, the default behavior will be to create the SSO session.

For more information on using the `idp_hint` and `login_hint` parameters, see the [Identity Providers Overview](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers.md) documentation.

[2893](https://github.com/FusionAuth/fusionauth-issues/issues/2893)

[Fix](#fix--issue-2903--jesd)

When using the login validation lambda with a 3rd party identity provider such as OpenID Connect, when the validation lambda causes the login to fail, the end user will not see the specific error returned by the lambda. Instead the user will see the following generic error (unless this message has been modified in a theme):

> A validation error occurred during the login attempt. An event log was created for the administrator to review.

The reason for this generic message is that in most cases if FusionAuth cannot complete a login request to a 3rd party we do not want to show the end user the technical reason. When a login validation lambda is the cause of the login failure, we do intend to the show the end user a more specific message. This issue has been corrected and if the login validation lambda was the cause of the failure, the event log is created when the identity provider has enabled debug.

[2903](https://github.com/FusionAuth/fusionauth-issues/issues/2903)

## Version 1.53.2

12 September 2024

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Fix](#fix--issue-2863--eebg)

The `kickstart.success` event may not fire correctly after Kickstart completes due to a timing issue when creating the webhook in your Kickstart definition.

[2863](https://github.com/FusionAuth/fusionauth-issues/issues/2863)

[Fix](#fix--issue-2865--gvyv)

Navigating to the System -> About page in the FusionAuth admin UI may fail to render if you start up without an internet connection.

[2865](https://github.com/FusionAuth/fusionauth-issues/issues/2865)

[Fix](#fix--issue-2871--ywz6)

Navigating to the System -> Webhook Log in the FusionAuth admin UI may display a general error and fail to return search results if there are any events of type `user.login.failed` displayed.

You may work around this issue by selecting a specific event type, or narrowing the scope of the results by using any of the additional search criteria found in the Advanced search controls.

[2871](https://github.com/FusionAuth/fusionauth-issues/issues/2871)

[Security](#security--issue-2868--y7ky)

Improvements to better defend against XSS (Cross-Site Scripting) attacks.

[2868](https://github.com/FusionAuth/fusionauth-issues/issues/2868)

## Version 1.53.1

6 September 2024

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Fix](#fix--issue-2861--eokg)

A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected. This bug was introduced in version `1.53.0`.

[2861](https://github.com/FusionAuth/fusionauth-issues/issues/2861)

## Version 1.53.0 (Lambda Llama)

5 September 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--issue-2473--q6ys)

This release ends support for the Docker image for the `linux/arm/v7` architecture.

This deprecation was announced in version `1.52.0`, and while we had planned to continue publishing this build for the next few releases, Java 21 is not being built for this architecture which means we can no longer support it. Please see thread in [Adoptium support](https://github.com/adoptium/adoptium-support/issues/962) or the [Adoptium release status](https://github.com/adoptium/temurin/issues/49) for additional details.

[2473](https://github.com/FusionAuth/fusionauth-issues/issues/2473)

[Known Issue](#v-1-57-0--known-issue--issue-3037--noil)

Very large webhook event log volumes could impact performance during log cleaning operations. If you are currently using a version of FusionAuth earlier than `1.53.0` and use webhooks, we recommend upgrading to version `1.57.0`.

[3037](https://github.com/FusionAuth/fusionauth-issues/issues/3037)

[Known Issue](#v-1-53-1--known-issue--via-2861--r0rj)

A user may fail to enroll a new Passkey (WebAuthn credential) used for reauthentication during a login workflow. Previously configured Passkeys should continue to work as expected.

Resolved in version [1.53.1](#version-1-53-1) via [2861](https://github.com/FusionAuth/fusionauth-issues/issues/2861).

[Known Issue](#v-1-69-0--known-issue--via-3222--w05u)

A Generic Connector configured with a Login Validation Lambda will *always* fail on first login for each user with `Unexpected FusionAuth error`.

Resolved in version [1.69.0](#version-1-69-0) via [3222](https://github.com/FusionAuth/fusionauth-issues/issues/3222).

[Known Issue](#known-issue--vxm5)

FusionAuth's hosted login pages no longer create an SSO session when signing in using an external IdP.

[Known Issue](#known-issue--issue-3008--we24)

Currently, FusionAuth's Webhook Event Log does not set a retention policy by default and may grow too large in volume which can result in an impact to performance when searching Webhook Event Logs. See issue for workaround.

[3008](https://github.com/FusionAuth/fusionauth-issues/issues/3008)

[New Feature](#new-feature--issue-1314--dzx4)

Introduced the [Webhook Event Log](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/webhook-event-log.md), which contains a record of each triggered event and the corresponding attempts to deliver the event to each configured webhook. This log will be useful for monitoring events that have succeeded or failed to be received by your configured webhooks. The attempt log will provide you with timing, the status code returned by your webhook, and other metadata.

The longer term goal of this feature will be to allow events to be retried when one or more webhooks failed to receive the event, or for some reason was unable to process the event. This is the first step towards that goal. You will find this new feature in the Admin UI under System -> Webhook Log .

For more information, see the [API reference](https://4002.18-224-161-104.sslip.io/docs/apis/webhook-event-logs.md).

[1314](https://github.com/FusionAuth/fusionauth-issues/issues/1314)

[New Feature](#new-feature--issue-1282--tqsg)

Introduced the [Login Validation Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/login-validation.md), which can prevent login based on information in a user record, an application registration, and more. This allows the notion of a valid login to be extended beyond the standard items such as credential checks and MFA.

[1282](https://github.com/FusionAuth/fusionauth-issues/issues/1282)

[Enhancement](#enhancement--issue-2810--z66n)

Introduced dropdown menus for actions in Admin UI tables. The number of buttons on some pages grew to the point that it was becoming difficult to differentiate between the buttons, and was also visually cluttering up the view. We hope you like it!

[2810](https://github.com/FusionAuth/fusionauth-issues/issues/2810)

[Fix](#fix--issue-2843--thanks-runely--6e43)

When using the start and end times in the Advanced search criteria in the Admin UI for the Audit Log, Event Log, and Login Records the selected values were incorrectly adjusted. This bug was introduced in version `1.52.0`.

Thanks to [@runely](https://github.com/runely)!

[2843](https://github.com/FusionAuth/fusionauth-issues/issues/2843)

[Fix](#fix--issue-2736--ax5d)

An SSO TTL of `0` seconds or a very small number may make it impossible to complete login using hosted login pages. To work around this issue in prior versions, increase the TTL to something larger than `0`, ideally at least `30` seconds.

The potential for this issue has existed for some time, but some changes made in version `1.50.0` made it more likely for this to occur.

[2736](https://github.com/FusionAuth/fusionauth-issues/issues/2736)

[Internal](#internal--issue-2473--xqqd)

Updated from Java 17 to Java 21 LTS.

[2473](https://github.com/FusionAuth/fusionauth-issues/issues/2473)

[Internal](#internal--issue-2700--ds4b)

Improved database connection resiliency under heavy load by separating interactive and non-interactive tasks into separate connection pools. This change should improve performance and scalability.

If you self-host, you may see an increase in the number of open connections to the relational database from FusionAuth. Previously each FusionAuth node would open `10` connections. Starting in this release, this number will increase to a minimum of `21`, and can scale to a maximum of `50`. These numbers are subject to change in future releases.

To calculate the total number of connections to the relational database, multiple these numbers by the number of nodes in your cluster. If you have a `3` node FusionAuth cluster, the minimum number of connections open to your database will be `63` with a maximum of `150`.

[2700](https://github.com/FusionAuth/fusionauth-issues/issues/2700)

[Internal](#internal--issue-2829--cw3a)

Updated the following dependencies:

*   Upgrade `js/handlebars.js` `4.7.6` -> `4.7.8`

[2829](https://github.com/FusionAuth/fusionauth-issues/issues/2829)

## Version 1.52.1

15 August 2024

[Fix](#fix--issue-2834--vzqy)

The SCIM Patch operation now properly handles removing multiple array elements, such as group memberships, in a single request.

[2834](https://github.com/FusionAuth/fusionauth-issues/issues/2834)

[Internal](#internal--issue-2858--uawh)

Updated the following dependencies:

*   Upgrade `io.fusionauth:fusionauth-scim` `2.2.1` -> `2.2.2`

[2858](https://github.com/FusionAuth/fusionauth-issues/issues/2858)

## Version 1.52.0 (Passkey Platypus)

8 August 2024

[Breaking Change](#breaking-change--ec0l)

**User Registrations API**

When using the User Registrations API, the `data` field for the FusionAuth application with Id `3c219e58-ed0e-4b18-ad48-f4f92793ae32` may now contain a `preferences` object. This object is reserved and should not be modified.

[Breaking Change](#breaking-change--ozey)

As part of our move to the GraalVM Java distribution, we plan to **discontinue publishing Docker images for the following architectures** which GraalVM does not support:

*   `linux/arm/v7`
*   `linux/ppc64le`
*   `linux/s390x`

We do not believe these architectures are actively being used.

We plan to stop publishing Docker images for these architectures at the end of 2024. **If you are actively using any of these architectures, please let us know.**

[Breaking Change](#breaking-change--f4wb)

**Air-gapped instances of FusionAuth** must complete the following steps to preserve access to premium features:

*   Navigate to the [Plan page](https://account.fusionauth.io/account/plan) in your FusionAuth account
*   Pick up your license key and newly generated license text
*   Navigate to `Reactor` in your Admin UI on your FusionAuth instance
*   Decommission your license
*   Reactivate FusionAuth Reactor using the license key and text

For more information about activating and deactivating your license, see the [Licensing documentation](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/licensing.md).

[Deprecated](#deprecated--xdlf)

**Group Member API**

The `user` field on the Group Member API responses is being deprecated.

This field was not documented, and has never been populated on the API response. However, because this field was generated and part of the domain in FusionAuth client libraries, we are providing a deprecation notice in case this may affect your integration. Client library users should remove references at your earliest convenience.

Removal of this field is targeted for the end of 2024.

[Theme Upgrade](#theme-upgrade--4sxf)

A new date picker element with enhanced styling and mobile support is now available.

[Known Issue](#known-issue--issue-2843--dmwm)

In the Admin UI, Advanced search criteria start and end times for the Audit Log, Event Log and Login Records incorrectly adjusted the selected value.

[2843](https://github.com/FusionAuth/fusionauth-issues/issues/2843)

[Known Issue](#v-1-68-0--known-issue--issue-3519--1vds)

Supplying a value of any type other than a `long` for instant fields (e.g. `insertInstant`) returns a `500` status code.

[3519](https://github.com/FusionAuth/fusionauth-issues/issues/3519)

[New Feature](#new-feature--issue-2663--ydsv)

[Play](https://youtube.com/watch?v=5fnqo_13ZYk)

Introduced the free Community license, which adds WebAuthn (Passkeys) to the Community plan. All Community license users will now find a license key on their [FusionAuth account plan](https://account.fusionauth.io/account/plan) page.

[2663](https://github.com/FusionAuth/fusionauth-issues/issues/2663)

[Enhancement](#enhancement--issue-2804--iort)

Added the new health check endpoint (`/api/health`) that was added in `1.51.1` to the client libraries.

[2804](https://github.com/FusionAuth/fusionauth-issues/issues/2804)

[Fix](#fix--issue-2718--ooyd)

Clicking the toggle checkbox element in the admin UI quickly caused the checkbox state to be inverted. This can be easily fixed by refreshing the page. You should now be able to click as fast as you want!

[2718](https://github.com/FusionAuth/fusionauth-issues/issues/2718)

[Fix](#fix--issue-2738--xvu3)

Attempting to sort API keys by key value in the admin UI by clicking the key value header resulted in an error.

[2738](https://github.com/FusionAuth/fusionauth-issues/issues/2738)

[Fix](#fix--issue-2749--z63o)

Attempting to create a tenant-scoped API key with an invalid `tenantId` failed with a `500` status code. This error has been corrected, and an appropriate validation error is now returned.

[2749](https://github.com/FusionAuth/fusionauth-issues/issues/2749)

[Fix](#fix--issue-2770--3wfr)

The date picker used for birthdates and custom date fields was not styled correctly based upon the selected theme. The date picker has been changed to the browser-default date picker, which should work much better on mobile devices. This picker style will now be used in themed hosted login pages, as well as the admin UI for searching a date range or selecting a birthdate. This change should not affect any existing advanced theme that may still use the older style date picker. See [theme upgrade notes](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade.md#version-1520) for details on updating an existing advanced theme to use this new option.

[2770](https://github.com/FusionAuth/fusionauth-issues/issues/2770)

[Fix](#fix--issue-2778--otmi)

Adding custom message keys to theme messages using the Admin UI failed to persist these changed messages. The UI for editing messages in the simple theme editor has also been improved to make it easier to understand which messages have been modified.

[2778](https://github.com/FusionAuth/fusionauth-issues/issues/2778)

[Fix](#fix--issue-2794--p6zn)

When the Browser preview button was used to open a new tab for simple themes in the Admin UI, the page would render without any applied CSS when using the Firefox browser. Sorry Firefox users, we ask for your forgiveness.

[2794](https://github.com/FusionAuth/fusionauth-issues/issues/2794)

[Fix](#fix--issue-2798--cnk7)

The default `orderBy` parameter value for the [Group Member Search API](https://4002.18-224-161-104.sslip.io/docs/apis/groups/search-for-group-members.md) did not provide a consistent ordering of results because the default sort was on `insertInstant ASC` which may not always be unique. This API is used by the SCIM Groups Resource API which then can cause inconsistent results for the SCIM client. The default `orderBy` is now set to `insertInstant ASC, userId ASC, groupId ASC` to ensure a consistent result between API calls.

[2798](https://github.com/FusionAuth/fusionauth-issues/issues/2798)

[Fix](#fix--issue-2803--46lr)

When using the simple theme editor in the admin UI, the color picker did not always render next to the input field. The color picker will now always correctly render adjacent to the input field you select.

[2803](https://github.com/FusionAuth/fusionauth-issues/issues/2803)

[Fix](#fix--issue-2808--werc)

Newlines and tabs were not rendered when viewing audit entries in the view dialog from the admin UI. If you use new lines or tabs in your audit log messages, you may now enjoy viewing them in all their intended glory!

[2808](https://github.com/FusionAuth/fusionauth-issues/issues/2808)

[Fix](#fix--issue-2815--cz20)

It sometimes required two Submit button clicks to exit interactive maintenance mode to upgrade your database schema. We are sorry if you had to click the Submit button twice.

[2815](https://github.com/FusionAuth/fusionauth-issues/issues/2815)

[Fix](#fix--issue-2777--52lq)

For users in FusionAuth Cloud, attempting to save a Simple theme may result in an error.

[2777](https://github.com/FusionAuth/fusionauth-issues/issues/2777)

[Fix](#fix--issue-2792--y0v7)

Query parameter values containing an equals sign (`=`) were not parsed correctly. Typically, query parameter values URL encode equals signs as `%3D`, but since there are legal uses of the un-encoded character, we have added support for (`=`).

[2792](https://github.com/FusionAuth/fusionauth-issues/issues/2792)

[Security](#security--issue-2753--q670)

When detecting impossible travel or similarly suspicious login events, it is possible that not all device trust cookies were correctly revoked. These are now automatically revoked.

[2753](https://github.com/FusionAuth/fusionauth-issues/issues/2753)

[Internal](#internal--issue-2818--lgcn)

Removed an unused template from the self-service login workflow. In practice this page was never rendered and was not included in the theme configuration. This change should not impact anyone using themes.

[2818](https://github.com/FusionAuth/fusionauth-issues/issues/2818)

[Internal](#internal--issue-2726--k5xq)

Updated the following dependencies:

*   Upgrade `org.freemarker:freemarker` `2.3.32` -> `2.3.33`
*   Upgrade `org.primeframework:prime-mvc` `4.22.7` -> `4.22.12`
*   Upgrade `org.apache.kafka:kafka-clients` `3.6.1` -> `3.7.1`
*   Upgrade `com.fasterxml.jackson.*` `2.15.4` -> `2.17.2`
*   Upgrade base docker image `ubuntu:jammy (22.04)` -> `ubuntu:noble (24.04)`

[2726](https://github.com/FusionAuth/fusionauth-issues/issues/2726)

## Version 1.51.2

3 July 2024

[Security](#security--issue-2801--xtko)

Fixed a XSS (Cross-Site Scripting) vulnerability in the FusionAuth admin UI.

[2801](https://github.com/FusionAuth/fusionauth-issues/issues/2801)

## Version 1.51.1

12 June 2024

[New Feature](#new-feature--issue-1166--xwar)

Introduced the Health API, `/api/health`. Previously, the `/api/status` endpoint was the best option for performing health checks. The Status API may not be ideal for all use cases because it returns a JSON body and the status code is used to indicate the status of various health checks that may not be valuable by a load balancer to indicate if requests should be routed to this node. This new endpoint provides a binary indication of the healthiness or unhealthiness of a FusionAuth instance by only returning a `200` or `500` status code w/out a JSON response. This new API also runs fewer health checks and may perform better than the Status API.

[1166](https://github.com/FusionAuth/fusionauth-issues/issues/1166)

[Fix](#fix--issue-2774--ans8)

An HTTP request sent to FusionAuth with non-ASCII characters in request header values caused the request to be rejected and caused the connection to be closed without a response. Generally speaking values outside of the ASCII character set are not allowed, but in practice they may be used, and so these values are now treated as opaque and ignored by the HTTP request parser.

[2774](https://github.com/FusionAuth/fusionauth-issues/issues/2774)

[Fix](#fix--issue-2782--49gm)

Fixed a typo on the Tenant edit page in the description of the `user.password.reset.send` event.

[2782](https://github.com/FusionAuth/fusionauth-issues/issues/2782)

[Fix](#fix--issue-2784--j5hz)

The SCIM API did not properly handle reading, creating, and updating groups with more than one hundred memberships. Responses containing groups with more than one hundred memberships only returned the first one hundred. Create and update operations only created or updated one hundred, *deleting the remainder*. This defect also caused the FusionAuth event for `group.member.update` and `group.member.update.complete` to contain the same truncated list of members.

[2784](https://github.com/FusionAuth/fusionauth-issues/issues/2784)

[Internal](#internal--issue-2786--1tz6)

Updated the following dependencies:

*   Upgrade `io.fusionauth:java-http` `0.3.4` to `0.3.5`

[2786](https://github.com/FusionAuth/fusionauth-issues/issues/2786)

## Version 1.51.0 (Theming Toucan)

28 May 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[New Feature](#new-feature--issue-2669--em08)

Introduced WYSIWYG theme editing with [Simple Themes](https://4002.18-224-161-104.sslip.io/docs/theme/simple-theme-editor.md), along with a visual editor. This first version of visual theme editing allows you to change the basic styling of FusionAuth hosted pages, including logos and background images, colors, fonts, and more.

[2669](https://github.com/FusionAuth/fusionauth-issues/issues/2669)

[Fix](#fix--issue-2735--xeog)

In version `1.45.0` we added a hosted OAuth backend capability, allowing a developer to write a front end-only application, but still take advantage of an authorization code grant workflow by leveraging the backend provided by FusionAuth. Multi-segment domain suffixes (e.g. `.co.uk`) are not handled correctly by this hosted backend when setting the domain on cookies. Cookie domains are now set properly.

[2735](https://github.com/FusionAuth/fusionauth-issues/issues/2735)

[Fix](#fix--issue-2722--q1rb)

A SAML login request that is missing a `Content-Type` header yields a cryptic error message. A more meaningful error message is now provided. Additionally, sending a `binding` parameter would lead to an error message, when this parameter is not one we process. We now ignore this parameter if it is provided.

[2722](https://github.com/FusionAuth/fusionauth-issues/issues/2722)

[Fix](#fix--issue-2728--5m7h)

A SMS two-factor messages template can be set at the Tenant level and should be overridable at the Application level. When a template is set at the Application level it is not being honored and the Tenant-level template is always used. Application overrides of SMS two-factor templates are now used correctly.

[2728](https://github.com/FusionAuth/fusionauth-issues/issues/2728)

[Security](#security--issue-2757--8eus)

Improved SAMLv2 callback handing with malformed requests.

[2757](https://github.com/FusionAuth/fusionauth-issues/issues/2757)

[Internal](#internal--issue-2727--aatg)

Updated the following dependencies:

*   Upgrade `org.graalvm.sdk:*:22.3.3` to `org.graalvm.polyglot:*:23.1.2`
*   Upgrade `org.graalvm.js:js` `22.3.3` to `23.0.3`
*   Upgrade `io.fusionauth:java-http` `0.3.2` to `0.3.4`

[2727](https://github.com/FusionAuth/fusionauth-issues/issues/2727)

## Version 1.50.1

25 April 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-69-0--known-issue--via-2743--5yp5)

Inactive IdPs may not display correctly in the Admin UI.

Resolved in version [1.69.0](#version-1-69-0) via [2743](https://github.com/FusionAuth/fusionauth-issues/issues/2743).

[Fix](#fix--issue-2729--oc2d)

Fixes usability items related to the First Time Setup wizard (introduced in `1.50.0`):

*   Items related to the first time setup wizard were shown after upgrades, when the intent was to only show them for new installations. These are now only being shown for unconfigured FusionAuth instances.
*   The First Time Setup summary page displayed sample configuration for various [quickstarts](https://4002.18-224-161-104.sslip.io/docs/get-started/quickstarts.md). The configuration for the [React quickstart](https://4002.18-224-161-104.sslip.io/docs/get-started/quickstarts/spa/react.md) corresponded to a previous version of the quickstart and was incompatible with the current version. The React quickstart configuration is now formatted for the current quickstart version.

[2729](https://github.com/FusionAuth/fusionauth-issues/issues/2729)

## Version 1.50.0 (Scopes Salamander)

24 April 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--12fd)

The new consent prompt themed page requires the `scopeConsentField` macro and `resolveScopeMessaging` function to be defined in the *Helpers* template in order to render scope consent form fields. These *must* be added to a custom theme in order for it to function.

[Breaking Change](#breaking-change--1csi)

This release makes significant changes to the default behavior of new Applications with regard to scopes in OAuth workflows. The database migration will update existing Applications to behave in a backwards compatible manner. See the OAuth [Scopes](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/scopes.md) documentation for more information, in particular the `Relationship`, `Unknown scope policy`, and `Scope handling policy` configurations.

[Breaking Change](#breaking-change--xh9s)

If you are using an `iframe` to access the FusionAuth hosted login pages, the `src` must use the same domain as the FusionAuth pages.

[FusionAuth uses cookies](https://4002.18-224-161-104.sslip.io/docs/reference/cookies.md) to manage user state with the `SameSite` attribute set to `Lax` or `Strict`. Browsers will block `Set-Cookie` headers on cross-domain requests.

This release introduces a new redirect into the OAuth flows to `/oauth2/consent` as part of the OAuth [Scopes](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/scopes.md) feature. This redirect will occur during each browser-based interactive OAuth workflow. Prior to this version it was possible to complete an OAuth code grant flow without cookies being set as long as there were no additional redirects to FusionAuth before the final redirect to the configured **redirect\_url**. As a result it did not matter if the `Set-Cookie` headers were blocked. The redirect with the code would still work.

However, in this version the browser will not be able to send the FusionAuth cookies required to maintain user state along with the redirect to `/oauth2/consent` and the login flow will fail. The user will be redirected back to `/oauth2/authorize` and will be unable to log in.

[Breaking Change](#breaking-change--issue-2725--lzus)

The `/oauth2/userinfo` endpoint now requires the `aud` claim to be present on the provided access token, allowing for tighter compliance with the OIDC spec. See the [UserInfo endpoint](https://4002.18-224-161-104.sslip.io/docs/apis/oauth/userinfo.md) for more detail.

If you are not using OAuth, and your JWT does not contain the `aud` claim, consider using the [JWT validate](https://4002.18-224-161-104.sslip.io/docs/apis/jwt/validate-a-jwt.md) API instead.

[2725](https://github.com/FusionAuth/fusionauth-issues/issues/2725)

[Deprecated](#deprecated--yqxk)

**JWT authentication for the `/api/user` API**

This functionality will be removed in a future release.

If you are using this API with JWT authentication, you will need to modify your integration to use the `/oauth2/userinfo` endpoint if you have obtained your JWT using an OAuth2 grant, or authenticate the request to the User API using an API key.

Removal of this authentication type is targeted for the end of 2024.

[Known Issue](#known-issue--issue-2736--i683)

An SSO TTL of `0` seconds or a very small number may make it impossible to complete login using hosted login pages. To work around this issue, increase the TTL to something larger than `0`, ideally at least `30` seconds.

[2736](https://github.com/FusionAuth/fusionauth-issues/issues/2736)

[Known Issue](#v-1-62-1--known-issue--via-3290--cd2h)

There was the potential for an error in the setup wizard if the timezone was not set on the machine running the browser. This has been corrected.

Resolved in version [1.62.1](#version-1-62-1) via [3290](https://github.com/FusionAuth/fusionauth-issues/issues/3290).

[New Feature](#new-feature--issue-275--thanks-badaz--s9m7)

Custom OAuth scopes are now supported for applications. Custom OAuth scopes come along with a number of related features, including support for third-party applications, themeable user consent, and much more.

See the [API docs](https://4002.18-224-161-104.sslip.io/docs/apis/scopes.md) and [OAuth Scopes documentation](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/scopes.md) for more detail.

Thanks to [@badaz](https://github.com/badaz)!

[275](https://github.com/FusionAuth/fusionauth-issues/issues/275)

[New Feature](#new-feature--issue-2723--dare)

Applications may now be designated as third-party applications. In addition to the prompting for authorization that comes with the `Custom OAuth Scopes` feature (see above), limitations are being added to how third-party applications may interact with FusionAuth.

[2723](https://github.com/FusionAuth/fusionauth-issues/issues/2723)

[New Feature](#new-feature--issue-411--h7n5)

Applications can now be configured to prompt users to grant consent to requested OAuth scopes using the `/oauth2/consent` [themed](https://4002.18-224-161-104.sslip.io/docs/theme.md) page. See the OAuth [Scopes](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/scopes.md) for more detail.

[411](https://github.com/FusionAuth/fusionauth-issues/issues/411)

[New Feature](#new-feature--issue-1647--thanks-themobi--2ca5)

Introduced [UserInfo Populate Lambda](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/userinfo-populate.md), which can customize the UserInfo response for an application.

Thanks to [@themobi](https://github.com/themobi)!

[1647](https://github.com/FusionAuth/fusionauth-issues/issues/1647)

[New Feature](#new-feature--issue-2717--lnce)

Added a new, optional First Time Setup wizard, which guides a developer through the basic setup needed to integrate their first application. After installing FusionAuth, you'll be able to access this from the main admin dashboard, as well as from the top of the left hand navigation.

[2717](https://github.com/FusionAuth/fusionauth-issues/issues/2717)

[Enhancement](#enhancement--issue-2688--wdp9)

Added a maximum password length of 256 characters in the tenant password policy. This decision was made to strike a balance between allowing very secure passwords and maintaining acceptable performance when using a large number of hash iterations.

[2688](https://github.com/FusionAuth/fusionauth-issues/issues/2688)

[Enhancement](#enhancement--issue-659--thanks-soullivaneuh--dm4p)

Added locale and timezone information to the Oauth UserInfo endpoint.

Thanks to [@soullivaneuh](https://github.com/soullivaneuh)!

[659](https://github.com/FusionAuth/fusionauth-issues/issues/659)

[Enhancement](#enhancement--issue-275--9ggl)

Applications now offer an `Unknown Scope Policy`. This can be used to enhance security by rejected or removing unrecognized scopes during an OAuth workflow. See the application [Scopes tab](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/types/applications.md#scopes) for more detail.

[275](https://github.com/FusionAuth/fusionauth-issues/issues/275)

[Enhancement](#enhancement--issue-2590--824w)

The [Refresh Token Grant](https://4002.18-224-161-104.sslip.io/docs/apis/oauth/token.md#refresh-token-grant-request) request now supports requesting a subset of the original scopes. Previously, the request responded with an `invalid_scope` OAuth error.

[2590](https://github.com/FusionAuth/fusionauth-issues/issues/2590)

[Enhancement](#enhancement--issue-1582--thanks-awoodobvio--bax0)

Applications now have a new Scope Handling Policy. The `Strict` option provides behaviors that are more compliant with the OIDC specification, while the `Compatibility` option provides backwards-compatible behavior. Specifically, `Strict` mode limits information in access tokens and populates Id tokens and UserInfo responses based on the requested OAuth scopes. This option also restricts the UserInfo endpoint to accepting only access tokens containing the `openid` scope.

New applications will default to the `Strict` option. If your integration requires the `Compatibility` policy because you need backwards compatible behavior, please specify that option when creating the application.

For more information, see the [Scope handling policy documentation](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/oauth/scopes.md#scope-handling-policy).

Thanks to [@awoodobvio](https://github.com/awoodobvio)!

[1582](https://github.com/FusionAuth/fusionauth-issues/issues/1582)[1475](https://github.com/FusionAuth/fusionauth-issues/issues/1475)

[Enhancement](#enhancement--issue-2724--d78o)

Added support for optional expansion of the `application.roles` and `application.scopes` properties on the Application Search API.

This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the [Application Search](https://4002.18-224-161-104.sslip.io/docs/apis/applications/search-for-applications.md) API for additional details on using the `expand` request parameter, and the `expandable` response value.

[2724](https://github.com/FusionAuth/fusionauth-issues/issues/2724)

[Enhancement](#enhancement--issue-275--rmzv)

The `/oauth2/device/user-code` endpoint now returns the `scope` parameter value that should be used in the interactive portion of the Device Code Grant workflow. See [Device User Code](https://4002.18-224-161-104.sslip.io/docs/apis/oauth/device.md#device-user-code-via-api-key) for more detail.

[275](https://github.com/FusionAuth/fusionauth-issues/issues/275)

[Fix](#fix--issue-2671--5ch6)

The bcrypt algorithm now limits passwords to 50 characters. This restriction is due to limitations in the bcrypt algorithm. This limit will be enforced even when the tenant policy allows for a maximum password length greater than 50.

[2671](https://github.com/FusionAuth/fusionauth-issues/issues/2671)

[Fix](#fix--issue-1651--thanks-ashutoshningot--3cr2)

There are several scenarios where implicit email verification can occur. They are, during registration verification, password change, passwordless authentication, and MFA code validation. In these cases, a configured email verification email was not being sent, and the email verification event was not being generated. The email and event will both be triggered during implicit verification now.

Thanks to [@ashutoshningot](https://github.com/ashutoshningot) and [@mou](https://github.com/mou)!

[1651](https://github.com/FusionAuth/fusionauth-issues/issues/1651)[2672](https://github.com/FusionAuth/fusionauth-issues/issues/2672)

[Fix](#fix--issue-2593--t26b)

When configuring MFA for an application, the `Trust policy` selector was not shown when MFA is required for the application, but only shown when MFA enabled for optional use. The selector is now shown when the `On login policy` is set to either `Enabled` or `Required`.

[2593](https://github.com/FusionAuth/fusionauth-issues/issues/2593)

[Fix](#fix--issue-2702--j6op)

When using FusionAuth behind a proxy, a missing `X-Forwarded-Proto` header could incorrectly cause a warning of a missing `X-Forwarded-Port` header. These warnings are now reported accurately. Additionally, FusionAuth will now be smarter about determining the forwarded port, taking it from one of multiple sources including `X-Forwarded-Host`, `X-Forwarded-Port`, or inferring it from `X-Forwarded-Proto`. This should make FusionAuth work with more proxies out of the box without additional configuration.

[2702](https://github.com/FusionAuth/fusionauth-issues/issues/2702)

[Fix](#fix--issue-2670--thanks-charlesericjs--sts4)

When authentication with an identity provider fails due to misconfiguration, and a user falls back to logging in with a username and password, the `authenticationType` reported by FusionAuth is for the original identity provider despite the user having logged in with a username and password. FusionAuth now correctly reports the authentication type as `PASSWORD`.

Thanks to [@charlesericjs](https://github.com/charlesericjs)!

[2670](https://github.com/FusionAuth/fusionauth-issues/issues/2670)

[Internal](#internal--issue-2678--3woa)

Updated the following dependencies:

*   Upgrade `ch.qos.logback:logback-*` `1.4.14` to `1.5.6`
*   Upgrade `com.fasterxml.jackson.*` `2.15.3` to `2.15.4`
*   Upgrade `io.fusionauth:java-http` `0.2.10` to `0.3.2`
*   Upgrade `org.mybatis:mybatis` `3.5.15` to `3.5.16`
*   Upgrade `org.primeframework:prime-mvc` `4.22.0` to `4.22.7`
*   Upgrade `org.postgresql:postgresql` `42.7.2` to `42.7.3`
*   Upgrade `org.slf4j:slf4j-api` `2.0.7` to `2.0.13`

[2678](https://github.com/FusionAuth/fusionauth-issues/issues/2678)

## Version 1.49.2

20 March 2024

[New Feature](#new-feature--issue-2679--4fnh)

The search index default refresh interval may now be configured. In general this should not be modified, but the configuration option has been added and will default to `1s`. The new configuration is named `fusionauth-app.search.default-refresh-interval`. For more information, see the [Configuration reference](https://4002.18-224-161-104.sslip.io/docs/reference/configuration.md).

[2679](https://github.com/FusionAuth/fusionauth-issues/issues/2679)

[Enhancement](#enhancement--issue-2681--kfv8)

Added email and registration verification Ids to the User and Registration API responses when available for consistency and to better enable out of band management of these verification workflows.

[2681](https://github.com/FusionAuth/fusionauth-issues/issues/2681)

[Fix](#fix--issue-1734--nrwm)

When configured to use an email verification strategy of `Form Field` without setting the unverified behavior to `Gated` the verification strategy was always functionally using `Clickable Link` which means the user would receive an email with a clickable URL instead of a short code.

With this fix, you may now use an unverified behavior of `Allow` with a verification strategy of `Form Field`. When you configure FusionAuth this way, it is assumed that you will be handling the verification process in your own application.

[1734](https://github.com/FusionAuth/fusionauth-issues/issues/1734)

[Fix](#fix--issue-2679--s4hd)

When using the Bulk User Import API `/api/user/import` the search index refresh interval is modified to improve performance. Specifically the index `refresh_interval` is set equal to `-1`. When this API is called in parallel, it is possible that this index setting is not reset and will stay configured as `-1`. The symptom of this error is that changes to the index are not reflected by the Search API and the search results may no longer be accurate.

[2679](https://github.com/FusionAuth/fusionauth-issues/issues/2679)

[Fix](#fix--issue-2673--ihe0)

When Advanced Threat Detection is enabled, an IP location database will be downloaded and used for IP address resolution. For these licensed customers, it is possible that a corrupted IP location database was downloaded and not correctly discarded and as a result the IP address location data may not be available.

You may have been impacted if you were using version `1.47.0` or later, between February 1st, 2024 and February 23rd, 2024. The observable symptom would be that your license status for the Advanced Threat Detection will show `Pending` instead of `Active`.

This condition has already been corrected for FusionAuth Cloud. If you are self-hosting FusionAuth, upgrading will correct this condition. If you have a support contract and believe you are currently in this state and are not able to upgrade, please reach out to support for assistance.

[2673](https://github.com/FusionAuth/fusionauth-issues/issues/2673)

## Version 1.49.1 (Bugfix Beluga)

6 March 2024

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Enhancement](#enhancement--issue-2443--zc0q)

In prior versions of FusionAuth, if a new themed page was added, until you upgraded your theme by adding this new page, the end user may be shown a page indicate the page was missing. This was shown because it was assumed that a new page would only be shown for a new feature that had not been enabled, and this page would only ever been seen during development. In this release added a new page that may be shown without any additional features being enabled. For this reason, we have removed this place holder page, and we will always fall back to the default theme when a page is missing. You will still want to upgrade your theme as part of your upgrade process, but this change will ensure that we will not break any new or existing workflows when a new page is added.

[2443](https://github.com/FusionAuth/fusionauth-issues/issues/2443)

[Enhancement](#enhancement--issue-2443--wqqz)

Link checkers are great. They aim to protect end users from malicious links and phishing attacks. However, they wreak havoc and pain on identity providers using email based workflows to complete passwordless login, or email verification. And FusionAuth is one of those identity providers!

FusionAuth has employed various tactics over the years to stay ahead of the techniques used by these 3rd party tools. Their techniques continue to evolve making it difficult or impossible to know the difference between a link checker and a real human interacting with the link.

A new confirmation page has been added that is intended to protect the user, and make our email workflows immune to link checkers.

For example, when a user initiates a request such as passwordless login, and then completes the request in the same browser, the user will not observe any change. If the user completes the request on a different browser, or completes a request they did not initiate - such as clicking on an email verification link sent when a use is provisioned by an administrator, the user will be prompted to confirm they wish to complete the request.

If you are using a custom theme, you will want to upgrade your theme to include this new page. Until you complete this upgrade, the default theme will be used for this new page. In the FusionAuth admin UI, the theme page will be named *Confirmation required*.

[2443](https://github.com/FusionAuth/fusionauth-issues/issues/2443)

[Enhancement](#enhancement--issue-2557--yjvj)

Ensured the Login API never fails validation due to a timing issue with an Application cache. This rarely affects runtime, but this can be useful for testing where you may create an application and immediately perform a login.

[2557](https://github.com/FusionAuth/fusionauth-issues/issues/2557)

[Enhancement](#enhancement--issue-2624--o3hm)

Added a trusted proxy configuration to the System Configuration. This new configuration allows you to define one or more trusted upstream proxies using an IP address, or range of addresses using a CIDR notation.

A client IP address will be captured in a login record, sent to webhooks, and used to provide access when IP ACLs are configured. To correctly resolve the client IP address, we often will need to use the `X-Forwarded-For` request header.

This header is modified when it passes through a proxy. In order to trust the contents of this header and resolve the client IP address, FusionAuth must know if it can trust all proxies implicitly, or to only trust those that are explicitly configured as trusted. The change is to optionally configure FusionAuth to no longer trust any upstream proxy that is not explicitly configured as trusted.

This new configuration can be found in the FusionAuth admin UI by navigating to `Settings > System > Networking`, or on the System Configuration API.

[2624](https://github.com/FusionAuth/fusionauth-issues/issues/2624)

[Fix](#fix--issue-1681--3p3o)

Previously, an incorrectly formatted SAML request could cause excessive CPU load.

[1681](https://github.com/FusionAuth/fusionauth-issues/issues/1681)

[Fix](#fix--issue-2264--unq1)

The default permissions in AWS RDS PostgreSQL version 15.2 caused the initial configuration of FusionAuth to fail to create the tables required to complete the initial configuration. The required permissions are now being explicitly granted, and the errors reported back to the user have been improved.

[2264](https://github.com/FusionAuth/fusionauth-issues/issues/2264)

[Fix](#fix--issue-2328--1duh)

If a user starts a Forgot Password flow, and clicks on a change password link in an email after the link has expired, the redirect back to the original Forgot Password form will not include the locale parameter. This fix ensures that a locale parameter, when present in the change password link, is preserved through this workflow and allows for localization to remain consistent.

[2328](https://github.com/FusionAuth/fusionauth-issues/issues/2328)

[Fix](#fix--issue-2351--c2n2)

When setting up a Facebook IdP, an option was provided in the admin UI to select `Use vendor JavaScript` as a Login method. This option is not applicable and has been removed.

[2351](https://github.com/FusionAuth/fusionauth-issues/issues/2351)

[Fix](#fix--issue-2455--28pc)

Fixed the SCIM filter when filtering on `userName eq {username}` to always return a single result.

[2455](https://github.com/FusionAuth/fusionauth-issues/issues/2455)

[Fix](#fix--issue-2496--a14s)

The LinkedIn APIs have changed, and the LinkedIn IdP no longer worked for new LinkedIn applications. This update allows FusionAuth to work with new and legacy LinkedIn applications.

[2496](https://github.com/FusionAuth/fusionauth-issues/issues/2496)

[Fix](#fix--issue-2513--lree)

The FusionAuth TypeScript client library was incorrectly encoding arrays values into query parameters. This bug was preventing a few specific search queries from working correctly.

[2513](https://github.com/FusionAuth/fusionauth-issues/issues/2513)

[Fix](#fix--issue-2529--inbt)

When using MySQL, the default Admin user form was missing the `First name` field. The field could be added to the form, but was missing in the default version.

[2529](https://github.com/FusionAuth/fusionauth-issues/issues/2529)

[Fix](#fix--issue-2538--uat3)

When an invalid Tenant Id was provided on the `.well-known/openid-configuration` the default configuration was returned. This has been updated to return a `404` status code.

[2538](https://github.com/FusionAuth/fusionauth-issues/issues/2538)

[Fix](#fix--issue-2586--o8pt)

When creating a User with a group membership with a specified member Id that was already in use, the requested completed w/out a validation error and the membership was ignored. The API now correctly validates this condition and will return a `400` and a JSON response.

[2586](https://github.com/FusionAuth/fusionauth-issues/issues/2586)

[Fix](#fix--issue-2594--6qkt)

When retrieving all refresh tokens for a user, the response may contain the user's SSO token. The SSO token can be identified because it does not contain an `applicationId` and it may not be refreshed. Validation has been improved when using the Refresh Grant, or the Refresh API to ensure FusionAuth correctly fails indicating the token is invalid and may not be refreshed.

[2594](https://github.com/FusionAuth/fusionauth-issues/issues/2594)

[Fix](#fix--issue-2616--svg5)

A regression was introduced in version `1.47.0` to the Change Password themed page. The issue is that the **`passwordValidationRules`** variable may be `null` on the first render. If you had been referencing this field in your template, the render may fail.

[2616](https://github.com/FusionAuth/fusionauth-issues/issues/2616)

[Fix](#fix--issue-2622--c1kd)

The Identity Provider Link API states that a `token` parameter can be accepted during a create. When provided, the token was not being persisted on the link.

[2622](https://github.com/FusionAuth/fusionauth-issues/issues/2622)

[Fix](#fix--issue-2625--r2nx)

Fixed the "Getting Started" link found in the index page in the default theme.

[2625](https://github.com/FusionAuth/fusionauth-issues/issues/2625)

[Fix](#fix--issue-2639--2c1j)

When viewing a User's Consents in the FusionAuth admin UI, if one or more of the consents have been granted by another user that is not a member of their family, an error is shown in the `Given by` column.

[2639](https://github.com/FusionAuth/fusionauth-issues/issues/2639)

[Fix](#fix--issue-2661--1fi3)

When you have configured the JWT signing key with the `ES512` algorithm, the generated signature may be intermittently invalid. This means that JWTs may seemingly fail to validate randomly and you may think you are crazy. You are not crazy. If you are using this signing algorithm, it is recommended you use a different algorithm until you are able to upgrade.

[2661](https://github.com/FusionAuth/fusionauth-issues/issues/2661)

[Fix](#fix--issue-2667--8j7q)

SCIM PATCH requests may fail to parse if an op path value contains a named schema containing a `.` (dot). This parsing error has been corrected.

For example: `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department`

[2667](https://github.com/FusionAuth/fusionauth-issues/issues/2667)

[Fix](#fix--issue-2667--ta8m)

When an SCIM create or update request contains schemas for which no properties exist, subsequent PATCH requests to those schema namespaces may fail.

For example, if the initial request contains a schema `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User` without any properties, the default lambda function used to map this request to FusionAuth was not persisting this schema namespace. Then a subsequent PATCH request to add a member to that namespace such as `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department` would fail.

The default SCIM request converter (Lambda function) has been updated to correct this behavior.

[2667](https://github.com/FusionAuth/fusionauth-issues/issues/2667)

[Security](#security--issue-2605--15hm)

Disabled additional JNDI settings in the LDAP connector. This update is proactive, there are no known exploits.

[2605](https://github.com/FusionAuth/fusionauth-issues/issues/2605)

[Security](#security--issue-2611--5dal)

Added additional protection against cross-site attacks when FusionAuth is acting as a SAML IdP.

[2611](https://github.com/FusionAuth/fusionauth-issues/issues/2611)

[Security](#security--issue-2623--lat2)

Audit log entries added by the FusionAuth admin application may contain sensitive information. Sensitive fields will now be masked when written to the audit log. This does not affect the Audit Log API, only the use of this API by the FusionAuth admin app.

[2623](https://github.com/FusionAuth/fusionauth-issues/issues/2623)

[Security](#security--issue-2626--2zmi)

Added additional protection against cross-site attacks when using the self-service account pages.

[2626](https://github.com/FusionAuth/fusionauth-issues/issues/2626)

[Internal](#internal--issue-1828--vibf)

The Nashorn JavaScript engine has been removed from FusionAuth. All Lambda functions will now use the GraalJS engine which has been available since version `1.35.0`. No action is required, but please note that if you had any Lambda functions still configured to use the Nashorn engine they will be migrated to use GraalJS.

[1828](https://github.com/FusionAuth/fusionauth-issues/issues/1828)

[Internal](#internal--issue-2534--g0ua)

Updated the following dependencies:

*   Upgrade `org.postgresql:postgresql` from `42.6.0` -> `42.7.2`
*   Upgrade `com.fasterxml.jackson.*` from `2.15.2` -> `2.15.3`
*   Upgrade `org.mybatis:mybatis` from `3.5.13` -> `3.5.15`

[2534](https://github.com/FusionAuth/fusionauth-issues/issues/2534)

[Internal](#internal--issue-2565--ry8l)

During a reindex operation, log the progress based upon a fixed time interval instead of every 250k records. This ensures the output is predictable regardless of the reindex performance.

[2565](https://github.com/FusionAuth/fusionauth-issues/issues/2565)

## Version 1.48.3

6 December 2023

[Fix](#fix--issue-2566--vdd9)

Updated the refresh token TTL when using the sliding window with a maximum lifetime JWT Expiration Policy. The symptom of this bug is that a refresh token will expire before the maximum configured lifetime.

[2566](https://github.com/FusionAuth/fusionauth-issues/issues/2566)

## Version 1.48.2

21 November 2023

[Fix](#fix--issue-2544--1o6x)

When paging beyond 10,000 in the FusionAuth admin UI for Users or Entities, the bottom set of pagination controls may not work. If you encounter an error when clicking on the pagination controls, use the top set of controls instead. This bug is specific to the new pagination introduced in version `1.48.0`.

[2544](https://github.com/FusionAuth/fusionauth-issues/issues/2544)

[Fix](#fix--issue-2500--ixsb)

In some cases when using with FusionAuth-hosted pages in an non-secure context, such as accessing FusionAuth on `localhost`, the `PublicKeyCredential` JavaScript API will not be available. This may cause an error on your JavaScript console `PublicKeyCredential is not defined`. This error kept the form on the page from correctly submitting.

[2500](https://github.com/FusionAuth/fusionauth-issues/issues/2500)

[Fix](#fix--issue-2542--awia)

In version `1.48.0`, a change was made to reject a link request from an OpenID Connect IdP when the `email_verified` claim is supplied with a value of `false`. An assumption was made that the `email` and `email_verified` claims would both be present in the `Userinfo` response or the `id_token`. Some providers may split these claims, so this assumption has been removed.

[2542](https://github.com/FusionAuth/fusionauth-issues/issues/2542)

[Security](#security--issue-2539--aj6b)

Corrected the validation of the `post_logout_redirect_uri` parameter on the OAuth2 Logout request for relative URIs intended for use for FusionAuth applications.

[2539](https://github.com/FusionAuth/fusionauth-issues/issues/2539)

[Internal](#internal--issue-2555--jfl9)

Improved JWT validation for internal security schemes by failing faster on invalid tokens.

[2555](https://github.com/FusionAuth/fusionauth-issues/issues/2555)

## Version 1.48.1

29 October 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-2535--c9dy)

A bug was identified in a change made in version `1.48.0` that may affect performance for those with > 1M users.

[2535](https://github.com/FusionAuth/fusionauth-issues/issues/2535)

## Version 1.48.0 (Webhook Walrus)

29 October 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-48-1--known-issue--via-2535--esqq)

A bug was identified in a change made in this version that may affect performance for those with > 1M users.

Resolved in version [1.48.1](#version-1-48-1) via [2535](https://github.com/FusionAuth/fusionauth-issues/issues/2535).

[Breaking Change](#breaking-change--issue-1828--hzy3)

We are officially announcing the end of life for the Nashorn JavaScript engine used by FusionAuth Lambda functions. All new functions have defaulted to the GraalJS since version `1.35.0`. The engine is not being removed in the release, but this is an official notice that we plan to remove this engine in early 2024. Please review your lambda functions and ensure the `engineType` is set to `GraalJS`.

[1828](https://github.com/FusionAuth/fusionauth-issues/issues/1828)

[Breaking Change](#breaking-change--issue-2532--qzmb)

We are officially announcing the end of life for the `fusionauth-search` package. This is currently available in a `.deb`, `.rpm` and `.zip` bundle for various platforms. This package is still available, but the plan is to stop building this at the end of 2023. Please make plans to discontinue use of the `fusionauth-search` package if you are currently using it.

[2532](https://github.com/FusionAuth/fusionauth-issues/issues/2532)

[Breaking Change](#breaking-change--issue-2423--s0on)

When the OpenID Connect or External JWT Identity Provider is configured to Link by Email and the IdP returns a claim named `email_verified` and the value is `false`, the link request will be rejected. This change is intended to reduce the risk of linking on an un-verified email address.

[2423](https://github.com/FusionAuth/fusionauth-issues/issues/2423)

[Enhancement](#enhancement--issue-494--m99q)

Enhanced the User and Entity Search APIs to paginate beyond 10,000 results. The Search API response will now include a `nextResults` value that can be used to ask for the next set of search results which enables the API to paginate through the entire available result set. See the [Entity Search APIs](https://4002.18-224-161-104.sslip.io/docs/apis/entities/entities.md#search-for-entities) and [User Search APIs](https://4002.18-224-161-104.sslip.io/docs/apis/users/search.md) for API details.

[494](https://github.com/FusionAuth/fusionauth-issues/issues/494)

[Enhancement](#enhancement--issue-793--723k)

The Webhook test action in the FusionAuth admin UI now returns additional information if the webhook returns a non-200 status code. This should make it simpler to debug your webhook integration. Prior to this change, the response would only indicate if the response was successful or not.

[793](https://github.com/FusionAuth/fusionauth-issues/issues/793)

[Enhancement](#enhancement--issue-797--gi4p)

The Webhook test action in the UI, now preserves changes to the example request body. Changes will now be preserved across send requests for the browser session. This means a test can be run repeatedly without having to perform the same edits to the default event request body.

[797](https://github.com/FusionAuth/fusionauth-issues/issues/797)

[Enhancement](#enhancement--issue-883--pzt0)

Added support for specifying webhook SSL certificates from Key Master. Prior to this enhancement, if you needed to specify an SSL certificate, it had to be added to the webhook in PEM format. You may now store this certificate in Key Master and then use this same certificate between webhooks.

This change is backwards compatible, but the ability to manually specify X.509 certificates in PEM format on the webhook configuration has been deprecated and may be removed in the future. See the [Webhook](https://4002.18-224-161-104.sslip.io/docs/apis/webhooks.md) API `sslCertificateKeyId` field for additional details.

[883](https://github.com/FusionAuth/fusionauth-issues/issues/883)

[Enhancement](#enhancement--issue-903--qhh0)

Modal dialogs in the FusionAuth admin UI can now be closed by using the escape key or by clicking outside of the modal.

[903](https://github.com/FusionAuth/fusionauth-issues/issues/903)

[Enhancement](#enhancement--issue-1859--5wuq)

Added support for signing webhook events with a SHA-256 hash function. This feature will allow consumers of FusionAuth events to verify the message body has not been modified. The signature is contained in a JWT and will be sent using an HTTP request header named `X-FusionAuth-Signature-JWT`. You may use existing JWT verification strategies including consuming the public key from the JWKS endpoint. See the [Signing Webhooks](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/signing.md) and [Webhooks APIs](https://4002.18-224-161-104.sslip.io/docs/apis/webhooks.md) for signing and verification details.

[1859](https://github.com/FusionAuth/fusionauth-issues/issues/1859)

[Enhancement](#enhancement--issue-2189--ib50)

Exposed the `id_token` returned by the Identity Provider to the Reconcile Lambda function when available. If the `id_token` is returned by the IdP and the signature can be verified it will be now be passed to the lambda function in the `tokens` argument. Example: `tokens.id_token`.

[2189](https://github.com/FusionAuth/fusionauth-issues/issues/2189)

[Enhancement](#enhancement--issue-2272--d6xl)

Added the `curl` command to the FusionAuth Docker image. This allows you to use the `curl` command for use in health checks or anytime you need to use `curl`!

[2272](https://github.com/FusionAuth/fusionauth-issues/issues/2272)

[Enhancement](#enhancement--issue-2319--9u6f)

Added support for optional expansion of the `user.registrations` and `user.memberships` properties on the User Search API.

This change is backwards compatible, but you may optionally request the Search API omit these properties on the response which may improve performance. See the [User Search](https://4002.18-224-161-104.sslip.io/docs/apis/users/search.md) API for additional details on using the `expand` request parameter, and the `expandable` response value.

[2319](https://github.com/FusionAuth/fusionauth-issues/issues/2319)

[Enhancement](#enhancement--issue-2373--nyyi)

Enhanced the error messaging returned to the end user when using the Test SMTP button in the FusionAuth admin UI. This makes it easier to test your SMTP configuration.

[2373](https://github.com/FusionAuth/fusionauth-issues/issues/2373)

[Enhancement](#enhancement--issue-2393--wv5u)

Reduced un-necessary logging when fuzzers send parameter names containing `class`.

[2393](https://github.com/FusionAuth/fusionauth-issues/issues/2393)

[Enhancement](#enhancement--issue-2427--hy61)

Updating a theme now returns a validation error if you are missing messages. Currently the error response does include the missing message keys. This error response is now enhanced to return the keys and the default values from the default theme. This allows you to optionally parse the response for the missing keys and values.

[2427](https://github.com/FusionAuth/fusionauth-issues/issues/2427)

[Enhancement](#enhancement--issue-2494--mm47)

Exposed the `access_token` returned by the Identity Provider to the Reconcile Lambda function. The `access_token` will now be passed to the lambda function in the `tokens` argument. Example: `tokens.access_token`.

[2494](https://github.com/FusionAuth/fusionauth-issues/issues/2494)

[Enhancement](#enhancement--issue-2501--kd4r)

When the `id_token` is returned from the IdP and the signature can be verified it will now be used to optionally resolve the `uniqueIdClaim` in addition to the `emailClaim` and `usernameClaim`. This means you can configure the `uniqueIdClaim` to a claim that is only available in the `id_token`. Prior to this change, the `id_token` could only be verified if it was signed using the an HMAC algorithm using the `client_secret`. With this change, if the IdP publishes public keys using the JWKS endpoint that is resolved from the `.well-known/openid-configuration` FusionAuth will attempt to validate the signature.

[2501](https://github.com/FusionAuth/fusionauth-issues/issues/2501)

[Fix](#fix--issue-1784--fuxw)

Enhanced the widget used in multi-value select controls to accept a value when pasting. For example, you may now paste a value from the clipboard directly into the `Authorized redirect URLs` field. While previously the paste operation worked, the user would have to click the value to confirm. If you clicked off of the field, the value would not be saved.

[1784](https://github.com/FusionAuth/fusionauth-issues/issues/1784)

[Fix](#fix--issue-1955--yjex)

Corrected the error message when a user has enabled MFA and a webhook returns a non-200 status code for the `user.login.success` event. The message will now correctly indicate the webhook has failed instead of the previously incorrect error indicating an invalid token was used.

[1955](https://github.com/FusionAuth/fusionauth-issues/issues/1955)

[Fix](#fix--issue-2304--ldzd)

When viewing an Email Template in the FusionAuth admin UI, two dialogs open instead of one. This was the result of two event handlers being bound instead of one.

[2304](https://github.com/FusionAuth/fusionauth-issues/issues/2304)

[Fix](#fix--issue-2307--jbb2)

When using the asynchronous tenant delete, it is possible for the delete job to fail if the system is under heavy load. When this occurs the delete job status may not be correctly updated and you are stuck in a `Deleting` state. The asynchronous job processor has been enhanced to account for this potential failure condition so the job can be correctly restarted if necessary.

[2307](https://github.com/FusionAuth/fusionauth-issues/issues/2307)

[Fix](#fix--issue-2390--319t)

Corrected a potential race condition that could cause a request to the `/.well-known/jwks.json` endpoint to exception and return a `500` status code when under heavy load.

[2390](https://github.com/FusionAuth/fusionauth-issues/issues/2390)

[Fix](#fix--issue-2408--3nq2)

The Lambda metrics introduced in version `1.47.0` may not always correctly increment the failed count when a lambda invocation failed. This affects the `lambda.[*].failures` and `lambda.[{webhookId}].failures` metric names.

[2408](https://github.com/FusionAuth/fusionauth-issues/issues/2408)

[Fix](#fix--issue-2411--16gt)

When using the `PATCH` method on the Tenant API, if you previously had any explicit webhooks configured for this tenant, the association between the tenant and the webhook was lost. If you are not using webhooks, or all of your webhooks are configured for `All tenants` (`webhook.global`), this bug would not affect you.

[2411](https://github.com/FusionAuth/fusionauth-issues/issues/2411)

[Fix](#fix--issue-2412--fwlk)

Improved the validation for the Entity API to correctly validate the `type.id` value. Because this value was not being correctly validated, it means the API caller may receive a `500` status code instead of a `400` with a developer friendly JSON response body to indicate how the input can be corrected.

[2412](https://github.com/FusionAuth/fusionauth-issues/issues/2412)

[Fix](#fix--issue-2441--ktrm)

A critical bug was identified that caused FusionAuth to incorrectly identify users eligible for deletion based upon the tenant policy to delete users with an unverified email address. Until you have upgraded to version `1.48.0` please disable `Delete unverified users` if you currently have enabled `Email verification`, `Verify email when changed` and `Delete unverified users`.

[2441](https://github.com/FusionAuth/fusionauth-issues/issues/2441)

[Fix](#fix--issue-2454--izh9)

A bug was identified that affected several APIs when using the `PATCH` method with fields that require custom deserializers in FusionAuth. Affected APIs included Application, Connector, Message Template and Identity Provider. The symptom you will observe is a failed request with a `500` status code.

[2454](https://github.com/FusionAuth/fusionauth-issues/issues/2454)

[Fix](#fix--issue-2465--tpeu)

When using PostgreSQL, under heavy load, a potential deadlock conditions exists when attempting to write login metrics to the database. MySQL database was not affected by this bug. If you were to encounter this bug you may observe some exceptions in the log related to the LoginQueue.

[2465](https://github.com/FusionAuth/fusionauth-issues/issues/2465)

[Fix](#fix--issue-2470--c0r5)

Fixed a JavaScript error that was preventing Audit Log searches by user from returning results.

[2470](https://github.com/FusionAuth/fusionauth-issues/issues/2470)

[Fix](#fix--issue-2474--thanks-wproffitt-elder--nw9w)

Resolved an issue where users could not enable two-factor authentication during authentication when they were not registered for the application.

Thanks to [@wproffitt-elder](https://github.com/wproffitt-elder)!

[2474](https://github.com/FusionAuth/fusionauth-issues/issues/2474)

[Fix](#fix--issue-2489--mnqu)

When using the Refresh Token API, un-expired SSO sessions may be incorrectly omitted from the API response. The result of this bug is that an active SSO session may not be displayed in the FusionAuth admin UI. This has now been corrected, and the FusionAuth admin UI and the Refresh Token API will correctly return all valid SSO sessions.

[2489](https://github.com/FusionAuth/fusionauth-issues/issues/2489)

[Fix](#fix--issue-2507--fef9)

If the `search.servers` configuration value was not added to the `fusionauth.properties` configuration file, and you omit the **`SEARCH_SERVERS`** environment value, FusionAuth would fail to start. The correct behavior is for FusionAuth to default to `http://localhost:9021`.

[2507](https://github.com/FusionAuth/fusionauth-issues/issues/2507)

[Fix](#fix--issue-2385--bd2m)

Resolved a bug in the `multipart/form-data` parser that may cause elevated CPU usage in some specific cases.

[2385](https://github.com/FusionAuth/fusionauth-issues/issues/2385)

[Security](#security--issue-2512--s8k4)

*   When an IdP is configured to Link by Email or Link by Username and a user already exists with this email or username respectively, perform additional validation to ensure the user does not already have an existing link to the current Identity Provider. This only affects IdP that allow for one to many tenants to be accessed through a single IdP configuration. In practice this means that the IdP cannot guarantee that an email address is considered globally unique and only assigned to a single user.

[2512](https://github.com/FusionAuth/fusionauth-issues/issues/2512)

[Internal](#internal--issue-2385--d2m5)

Updated the following dependencies:

*   Upgrade `com.google.inject:guice` `5.1.0` to `6.0.0`
*   Upgrade `com.google.guava:guava` `30.1.0` to `32.1.2`
*   Upgrade `io.fusionauth:java-http` `0.2.0` to `0.2.9`
*   Upgrade `org.apache.kafka:kafka-clients` `2.8.2` to `3.6.0`
*   Upgrade `org.primeframework:prime-mvc` `4.11.0` to `4.17.1`
*   Upgrade `org.xerial.snappy:snappy-java` `1.1.8.1` to `1.1.10.4`

[2385](https://github.com/FusionAuth/fusionauth-issues/issues/2385)

[Internal](#internal--issue-2386--fugi)

Upgraded to the latest Java 17 LTS. Upgraded from `17.0.3+7` to `17.0.8+1`.

[2386](https://github.com/FusionAuth/fusionauth-issues/issues/2386)

[Internal](#internal--issue-2391--7dkm)

Updated the logging configuration when using the `fusionauth-search` distribution (`.deb`, `.rpm`, or `.zip`) to be more consistent with the `fusionauth-app` logging configuration. If you are using Elasticsearch or OpenSearch in Docker or other off the shelf installation of Elasticsearch or OpenSearch this change will not affect you.

[2391](https://github.com/FusionAuth/fusionauth-issues/issues/2391)

[Internal](#internal--issue-2462--iwbo)

Updated the FusionAuth static file resolution configuration to further limit class path resolution.

[2462](https://github.com/FusionAuth/fusionauth-issues/issues/2462)

## Version 1.47.1

27 July 2023

[Fix](#fix--issue-2392--thanks-pigletto--ye8i)

Revert the GC (garbage collection) logging change introduced in version `1.47.0` for compatibility with the FusionAuth Docker image.

Thanks to [@pigletto](https://github.com/pigletto) and [@patricknwn](https://github.com/patricknwn)!

[2392](https://github.com/FusionAuth/fusionauth-issues/issues/2392)

## Version 1.47.0 (Performance Panther)

25 July 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--x9ho)

This version changes OAuth2 origin validation code. This change is not expected to cause any change in behavior for anyone with configured Authorized Origin URLs. The change is to inspect the port in addition to the schema and host when comparing the request and the `Referer` or `Host` header to determine if the request has originated from FusionAuth. One possible edge case that could be affected is if you using `localhost` in development for both FusionAuth and another application. In this example, it is possible that FusionAuth was not validating the Origin of requests from your application running on `localhost` correctly. If you encounter this case, you can either remove all Authorized Origin URLs from your configuration, or add the origin of your application so that it can be correctly validated. Due to the necessary change related to adding a CSRF token when performing a federated login, a manual change may be required to your themed login pages. Please read through these details to understand if you will be affected:

*   If you are using any 3rd party IdP configurations such as OpenID Connect, SAML v2, Google, Facebook with a custom theme, you will need to make a modification to your template in order for federated login to continue to work correctly.
    
*   If you are not using any 3rd party IdP configurations, or you are not using a custom theme, no change will be necessary.
    
*   If you will be affected by this change, please review the following details and update to your theme as part of your upgrade process:
    
    1.  Find the `alternativeLogins` macro usage in `oauth2Authorize` and `oauth2Register` and add `federatedCSRFToken=federatedCSRFToken` as the last argument to this macro.
        
        ```html
        [#-- Updated macro usage. Line breaks added for readability. --]
        [@helpers.alternativeLogins clientId=client_id
                               identityProviders=identityProviders
                               passwordlessEnabled=passwordlessEnabled
                               bootstrapWebauthnEnabled=bootstrapWebauthnEnabled
                               idpRedirectState=idpRedirectState
                               federatedCSRFToken=federatedCSRFToken/]
        ```
        
    2.  Find the macro named `alternativeLogins` in `helpers` and add `federatedCSRFToken=""` as the last argument to this macro.
        
        ```html
        [#-- Updated macro in helpers. Line breaks added for readability. --]
        [#macro alternativeLogins clientId
                             identityProviders
                             passwordlessEnabled
                             bootstrapWebauthnEnabled=false
                             idpRedirectState=""
                             federatedCSRFToken=""]
        ```
        
    3.  Find the element `<div class="login-button-container">` in the macro named `alternativeLogins` in `helpers` and add `id="login-button-container"` and `data-federated-csrf="${federatedCSRFToken}"` attributes.
        
        ```html
        [#-- Updated div in alternativeLogins macro. Line breaks added for readability. --]
        <div id="login-button-container"
          class="login-button-container"
          data-federated-csrf="${federatedCSRFToken}">
        ```
        

[Known Issue](#v-1-47-1--known-issue--via-2392--fomz)

The garbage collection logging change introduced in version `1.47.0` was not compatible with the way the FusionAuth docker image was built. You will need to use version `1.47.1` if you will be using the FusionAuth docker image.

Resolved in version [1.47.1](#version-1-47-1) via [2392](https://github.com/FusionAuth/fusionauth-issues/issues/2392).

[Known Issue](#v-1-49-1--known-issue--via-2616--yfia)

The **`passwordValidationRules`** variable may be `null` on the first render of the Change Password themed page. If you had been referencing this field in your template, the render may fail.

Resolved in version [1.49.1](#version-1-49-1) via [2616](https://github.com/FusionAuth/fusionauth-issues/issues/2616).

[Known Issue](#v-1-53-3--known-issue--via-2764--r7au)

The CSRF token used with federated login is not being applied when all configured IdPs for an application use managed domains and an `/oauth2/authorize` request for the application includes an `idp_hint` parameter.

Resolved in version [1.53.3](#version-1-53-3) via [2764](https://github.com/FusionAuth/fusionauth-issues/issues/2764).

[New Feature](#new-feature--issue-1741--thanks-annismckenzie--p0jp)

Added support for SAML v2 assertion encryption when FusionAuth is acting as the SAML v2 IdP. This means FusionAuth is now compatible with a SAML v2 SP that requires encrypted assertions.

Thanks to [@annismckenzie](https://github.com/annismckenzie)!

[1741](https://github.com/FusionAuth/fusionauth-issues/issues/1741)

[Enhancement](#enhancement--issue-1738--thanks-glen-84--ou5k)

Added `user.preferredLanguages` to the basic self-service registration to allow a user's preferred language to be collected and then utilized to send localized emails without using advanced self-service registration.

Thanks to [@glen-84](https://github.com/glen-84) and [@geoalexidis](https://github.com/geoalexidis)!

[1738](https://github.com/FusionAuth/fusionauth-issues/issues/1738)

[Enhancement](#enhancement--issue-2318--vncx)

Improved handling of cache reload requests under heavy load. This should improve system performance at scale when mass creating or deleting of various items such as applications and keys.

[2318](https://github.com/FusionAuth/fusionauth-issues/issues/2318)

[Enhancement](#enhancement--issue-2389--il5o)

Added timers and metrics around lambda invocations and the use of HTTP Connect within a lambda function. This should help customers tune and manage lambdas by providing additional insight into the total execution time.

[2389](https://github.com/FusionAuth/fusionauth-issues/issues/2389)

[Enhancement](#enhancement--issue-2222--a0z3)

Added configuration to accept any named parameter as a login hint coming from the SAML v2 SP when FusionAuth is acting as the SAML v2 IdP. Prior to this change, FusionAuth would accept `login_hint` if provided on the request. However, this value can not be configured or optionally disabled.

[2222](https://github.com/FusionAuth/fusionauth-issues/issues/2222)

[Enhancement](#enhancement--issue-2337--mjqe)

Added `identityProviderName` to the IdP Link API response.

[2337](https://github.com/FusionAuth/fusionauth-issues/issues/2337)

[Fix](#fix--issue-2348--3z9g)

Ensure a signed AuthN request always has the `Signature` element as the next sibling after the `Issuer` element. This bug may cause some SAML v2 services provides to reject the signature of an AuthN request sent from FusionAuth.

[2348](https://github.com/FusionAuth/fusionauth-issues/issues/2348)

[Fix](#fix--issue-2355--4ln4)

Upgraded phone number validation to include the Kosovo country code of `+383` as well as various other country codes.

[2355](https://github.com/FusionAuth/fusionauth-issues/issues/2355)

[Fix](#fix--issue-2360--mkry)

Defend against corporate link "checkers" such as Outlook Safe Links and Google Workspace during the Change Password email workflow. This fix resolves a specific symptom that may occur when a link sent to a user during a change password workflow and the user has multi-factor authentication enabled. The symptom the end user may encounter is that multiple codes may be sent to the user during this workflow. When the two-factor method is email, multiple emails may be received, and when two-factor method is SMS, multiple SMS messages may be received. The cause of this symptom is that the link is being inspected by an intermediate party prior to the user's browser loading the link which functionally means the request is made more than once.

[2360](https://github.com/FusionAuth/fusionauth-issues/issues/2360)

[Fix](#fix--issue-2363--m0fb)

Improved locale validation, and restrict the number of preferred languages per user to 20. This should not have any practical impact on users of FusionAuth, but it will better protect FusionAuth from storing erroneous values for the user's preferred languages.

[2363](https://github.com/FusionAuth/fusionauth-issues/issues/2363)

[Fix](#fix--issue-2368--tpg5)

Improved username validation. This length limitation was already enforced by the schema, but the error message was not developer friendly. This change will add a proper validation error in the API response.

[2368](https://github.com/FusionAuth/fusionauth-issues/issues/2368)

[Fix](#fix--issue-2333--4xdr)

Updated the Tenant view dialog in the admin UI to reflect the changes made to the `/.well-known/openid-configuration` endpoint in version `1.46.0`. This is a cosmetic change only, and does not include any functional fixes.

[2333](https://github.com/FusionAuth/fusionauth-issues/issues/2333)

[Fix](#fix--issue-2338--xj3h)

Fixed Tenant select control on Group index page in the admin UI when only a single tenant is configured. This is just a cosmetic fix to how the form was being rendered.

[2338](https://github.com/FusionAuth/fusionauth-issues/issues/2338)

[Fix](#fix--issue-2359--m2gv)

Reduced Kafka logging. So noisy.

[2359](https://github.com/FusionAuth/fusionauth-issues/issues/2359)

[Fix](#fix--issue-2362--h4wo)

Protected the Kafka event sender from sending events related to it's own failure. This protects us from overloading the Kafka topic.

[2362](https://github.com/FusionAuth/fusionauth-issues/issues/2362)

[Fix](#fix--issue-1898--thanks-sjswami--yseg)

Fixed the `user.registration.update.complete` event to include the updates roles if applicable.

Thanks to [@sjswami](https://github.com/sjswami)!

[1898](https://github.com/FusionAuth/fusionauth-issues/issues/1898)

[Fix](#fix--issue-2382--w6f1)

Improved defense against truncated `oauth_context` request parameters. This parameter is passed around during various OAuth2 workflows to maintain context. This changes allows FusionAuth to fail more gracefully if this is value is intentionally or un-intentionally modified by a 3rd party.

[2382](https://github.com/FusionAuth/fusionauth-issues/issues/2382)

[Fix](#fix--issue-602--thanks-patrickvalle--kyzj)

Enabled queries of the `username` and `fullName` fields using the `.exact` suffix on these fields which does an exact match.

Thanks to [@patrickvalle](https://github.com/patrickvalle)!

[602](https://github.com/FusionAuth/fusionauth-issues/issues/602)

[Security](#security--issue-1840--thanks-avitsrimer--fe5b)

A race condition exists when using a refresh token with a one-time-use policy where the same token value could successfully be used twice to obtain a new access token. In practice this would be very difficult to replicate outside of a scripted example.

Thanks to [@avitsrimer](https://github.com/avitsrimer)!

[1840](https://github.com/FusionAuth/fusionauth-issues/issues/1840)

[Security](#security--issue-2238--kna5)

All federated login requests now use a CSRF token. This change will add additional protection when using a federated login to ensure the login is completed from the same browser that started the login workflow. This mitigates an attack vector that can be used in phishing attacks where a victim could be convinced to click on a link that would cause the user to unknowingly complete a login.

[2238](https://github.com/FusionAuth/fusionauth-issues/issues/2238)

[Internal](#internal--issue-2369--8eni)

Added aggregate HTTP request timers and metrics that can be retrieved by the Status API and Prometheus Metrics API.

[2369](https://github.com/FusionAuth/fusionauth-issues/issues/2369)

[Internal](#internal--issue-2238--f76r)

Updated dependencies.

[2238](https://github.com/FusionAuth/fusionauth-issues/issues/2238)[2384](https://github.com/FusionAuth/fusionauth-issues/issues/2384)

[Internal](#internal--issue-2388--rqq4)

Enabled GC (garbage collection) logging. A new log named `fusionauth-app.gc.log` will be found in the log directory.

[2388](https://github.com/FusionAuth/fusionauth-issues/issues/2388)

[Internal](#internal--issue-2195--51c8)

Improve performance and overhead when downloading and storing the IP location database required for resolving location meta-data for logins by IP address.

[2195](https://github.com/FusionAuth/fusionauth-issues/issues/2195)

## Version 1.45.4

25 July 2023

[Fix](#fix--issue-2382--f44w)

Fixed handling of truncated or malformed `oauth_context` request parameters when using the hosted login pages.

[2382](https://github.com/FusionAuth/fusionauth-issues/issues/2382)

## Version 1.43.2

9 July 2023

[Breaking Change](#breaking-change--gp2x)

The User and User Registration APIs now restrict `user.preferredLanguages` and `registration.preferredLanguages` to a maximum of `20` values, and each value to a maximum length of `24` characters.

[Fix](#fix--issue-2362--acne)

Corrected an edge case that exists where an `event-log.create` event fails to be sent to a Kafka topic, and this error causes another `event-log.create` event to be triggered.

[2362](https://github.com/FusionAuth/fusionauth-issues/issues/2362)

[Fix](#fix--issue-2363--4yec)

Limited the length of a valid value for `user.preferredLanguages` and `registration.preferredLanguages` to a maximum of `24` characters, and restrict the total number of values to `20` or less.

[2363](https://github.com/FusionAuth/fusionauth-issues/issues/2363)

[Internal](#internal--issue-2359--rlzm)

Reduced Kafka logging to make it much less noisy at runtime

[2359](https://github.com/FusionAuth/fusionauth-issues/issues/2359)

## Version 1.46.0 (Octagonal Ocelot)

19 June 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-67-0--known-issue--via-2357--p9on)

Federated users may not be prompted to configure MFA on initial login, even when MFA is required. However, on subsequent logins, FusionAuth will force these users to configure MFA if MFA is required.

Resolved in version [1.67.0](#version-1-67-0) via [2357](https://github.com/FusionAuth/fusionauth-issues/issues/2357).

[New Feature](#new-feature--issue-2218--o028)

Added the ability to complete Device Grant out of band.

*   New API `/oauth2/device/approve`
*   New API `/oauth2/device/user-code`

[2218](https://github.com/FusionAuth/fusionauth-issues/issues/2218)

[New Feature](#new-feature--issue-2218--re5n)

Added a new API to retrieve a pending IdP link: `/api/identity-provider/link/pending`.

[2218](https://github.com/FusionAuth/fusionauth-issues/issues/2218)

[Enhancement](#enhancement--issue-1100--if5w)

The OAuth2 Introspect endpoint now optionally takes a `client_secret`.

[1100](https://github.com/FusionAuth/fusionauth-issues/issues/1100)

[Enhancement](#enhancement--issue-1434--pdsk)

A token obtained from the Client Credentials Grant may now be used with the OAuth2 Introspect endpoint.

[1434](https://github.com/FusionAuth/fusionauth-issues/issues/1434)

[Enhancement](#enhancement--issue-1729--19pa)

Added a JWT Expiration Policy to configure a sliding window with a maximum lifetime.

[1729](https://github.com/FusionAuth/fusionauth-issues/issues/1729)

[Enhancement](#enhancement--issue-2259--6wm0)

The OpenID Connect discovery endpoint now accepts the `tenantId` as a URL segment. This should make it easier to integrate with providers that would not otherwise allow a query parameter on this URL to specify the `tenantId`.

[2259](https://github.com/FusionAuth/fusionauth-issues/issues/2259)

[Enhancement](#enhancement--issue-2074--lood)

Provide a validation error when using the `/api/jwt/reconcile` API with any IdP type `ExternalJWT`.

[2074](https://github.com/FusionAuth/fusionauth-issues/issues/2074)

[Enhancement](#enhancement--issue-2310--1bxy)

Added configuration to allow unauthenticated access to `/api/status` and `/api/prometheus/metrics` APIs from localhost.

[2310](https://github.com/FusionAuth/fusionauth-issues/issues/2310)

[Enhancement](#enhancement--issue-2237--4wox)

Added more support in the default theme to use Google reCAPTCHA v2 in an invisible mode w/ CAPTCHA fallback.

[2237](https://github.com/FusionAuth/fusionauth-issues/issues/2237)

[Enhancement](#enhancement--71yu)

Allow any string value in the `metaData.device.type` property on various APIs.

[Fix](#fix--issue-2210--8wil)

Always send email verification on user email change when configured for user self-service

[2210](https://github.com/FusionAuth/fusionauth-issues/issues/2210)

[Fix](#fix--issue-2296--a2xk)

Resolved a JavaScript bug when enabling MFA during login. The bug caused an error to be written to the JavaScript console, but no functional errors occurred.

[2296](https://github.com/FusionAuth/fusionauth-issues/issues/2296)

[Fix](#fix--issue-2288--taak)

When the `user.login.success` is configured to be transactional and the webhook returns a non `200` status code when the event is fired during the final step of the change password workflow, the failed webhook may not fail the login attempt.

[2288](https://github.com/FusionAuth/fusionauth-issues/issues/2288)

[Fix](#fix--issue-2146--o26n)

When enabling IdP initiated login on a SAMLv2 IdP, the base ACS URL is hidden in the view dialog

[2146](https://github.com/FusionAuth/fusionauth-issues/issues/2146)

[Fix](#fix--issue-2149--msq0)

When an `applicationId` is provided on a Two-Factor Start or Send APIs, the application variable may not available in the email template.

[2149](https://github.com/FusionAuth/fusionauth-issues/issues/2149)

[Fix](#fix--issue-2004--thanks-pycnomerus--9i4c)

APIs that optionally take a `sourceId` to indicate you wish to copy will now fail validation if you provide additional parameters in the body that will otherwise be ignored.

Thanks to [@Pycnomerus](https://github.com/Pycnomerus)!

[2004](https://github.com/FusionAuth/fusionauth-issues/issues/2004)

[Fix](#fix--issue-2197--hw2g)

When adding a user to multiple Groups using the `/api/group/member` API, the request may fail. Fixed.

[2197](https://github.com/FusionAuth/fusionauth-issues/issues/2197)

[Fix](#fix--issue-2227--thanks-beezerk23--i5jq)

When using a wildcard for authorized origin URL, you may receive an invalid origin error. Fixed.

Thanks to [@beezerk23](https://github.com/beezerk23)!

[2227](https://github.com/FusionAuth/fusionauth-issues/issues/2227)

[Fix](#fix--issue-2284--8ghs)

Ensured that the memory value for `fusionauth-app.memory` set in the `fusionauth.properties` file is always set correctly.

[2284](https://github.com/FusionAuth/fusionauth-issues/issues/2284)

[Fix](#fix--issue-2239--6468)

When using custom data with nested values such as `user.data.company.name` and `user.data.company.id` in an Advanced Registration form the nested values may not be properly persisted. Fixed.

[2239](https://github.com/FusionAuth/fusionauth-issues/issues/2239)

[Fix](#fix--issue-2262--pkfw)

Using the admin UI to update an IdP with over 6k applications the request may cause a database error. Fixed.

[2262](https://github.com/FusionAuth/fusionauth-issues/issues/2262)

[Fix](#fix--issue-2245--almm)

Added index `entity_user_grants` to increase `SELECT` performance

[2245](https://github.com/FusionAuth/fusionauth-issues/issues/2245)

[Fix](#fix--issue-2275--6ajm)

When using the `validateJWT` method in the FusionAuth Java REST Client, the `exp` or `iat` claims may have the incorrect precision.

[2275](https://github.com/FusionAuth/fusionauth-issues/issues/2275)

[Fix](#fix--issue-2247--t822)

Added missing endpoints to the OpenAPI spec.

[2247](https://github.com/FusionAuth/fusionauth-issues/issues/2247)

[Fix](#fix--issue-2250--thanks-marekuniq--5ibq)

A change in behavior was introduced in version `1.41.0` that may cause an error when accessing FusionAuth in Docker. The change was how the `Host` header was being parsed to pick up the local port.

Thanks to [@MarekUniq](https://github.com/MarekUniq) and [@java-http](https://github.com/java-http)!

[2250](https://github.com/FusionAuth/fusionauth-issues/issues/2250)

[Fix](#fix--issue-2233--jnxr)

The `user.create.complete` and `user.registration.create.complete` events may be sent before the transaction has closed during IdP Login.

[2233](https://github.com/FusionAuth/fusionauth-issues/issues/2233)

[Fix](#fix--issue-2257--hsir)

Corrected the internal authentication to receive an internal webhook between FusionAuth service nodes. If you encounter this error, you may see errors in the event log that mention `returned response code [401] when sending [JWTRefreshTokenRevoke] event`. This error was introduced in version `1.37.0` and the error only occurs when you have more than one FusionAuth service node.

[2257](https://github.com/FusionAuth/fusionauth-issues/issues/2257)

[Fix](#fix--issue-2258--qr36)

When you have enabled Implicit Email Verification, when completing a Multi-Factor login, a `user.email.verified` event may be sent even if the user has already verified their email address.

[2258](https://github.com/FusionAuth/fusionauth-issues/issues/2258)

[Fix](#fix--issue-2281--bu01)

When the `user.reactivate` event is configured to be transactional and the webhook returns a non `200` status code, the transaction may not be correctly rolled back.

[2281](https://github.com/FusionAuth/fusionauth-issues/issues/2281)

[Fix](#fix--issue-2282--jl8r)

When making a request to the self-service pages, such as `/account/` ensure any additional query parameters are preserved through a login workflow.

[2282](https://github.com/FusionAuth/fusionauth-issues/issues/2282)

[Fix](#fix--issue-2287--9np3)

When the `user.create` event is configured to be transactional, ensure the Setup Password email is not sent if a `user.create` webhook returns a non `200` status code.

[2287](https://github.com/FusionAuth/fusionauth-issues/issues/2287)

[Fix](#fix--issue-2331--u37f)

When using the Device Grant with the `/oauth2/device` themed page, you may be shown a Logout button if an SSO session exists during this workflow. Clicking this button will log the user out of the SSO session and return to this page. This fixes the logout link so that you do not receive an error when returning to the `/oauth2/device` page. A workaround is documented in the linked GitHub issue.

[2331](https://github.com/FusionAuth/fusionauth-issues/issues/2331)

[Security](#security--issue-2221--l5wc)

Fixed an edge case where the CAPTCHA could be bypassed when using Advanced Registration forms.

[2221](https://github.com/FusionAuth/fusionauth-issues/issues/2221)

[Security](#security--issue-2228--20il)

Added more validation on the `user_code` when completing a Device Grant by way of the Authorization Code Grant, Implicit Grant, or Password Credentials Grant.

[2228](https://github.com/FusionAuth/fusionauth-issues/issues/2228)

[Security](#security--issue-22234--jl0q)

Added more validation on self-service edit form.

[22234](https://github.com/FusionAuth/fusionauth-issues/issues/22234)

[Security](#security--issue-2299--8ly7)

Mitigated a potential directory traversal attack. CloudFlare, AWS and similar cloud providers will generally block these requests by default. FusionAuth Cloud customers are not vulnerable to this type of attack.

[2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)

[Internal](#internal--issue-2214--kysg)

Upgraded Apache FreeMarker from version `2.3.30` to `2.3.32`.

[2214](https://github.com/FusionAuth/fusionauth-issues/issues/2214)

[Internal](#internal--issue-2299--gx18)

Upgraded FusionAuth Java HTTP dependency from version `0.1.13` to `0.1.14`.

[2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)

[Internal](#internal--issue-2299--b2qb)

Upgraded Prime MVC dependency from version `4.7.1` to `4.9.10`.

[2299](https://github.com/FusionAuth/fusionauth-issues/issues/2299)

## Version 1.45.3

31 May 2023

[Fix](#fix--issue-2292--2rhd)

Update `fusionauth/java-http` to the most recent version to pick up a bug fix.

This fixed a very low level HTTP server bug. In some rare cases, the HTTP response handler may not identify the end of the stream and effectively truncate the response body. It is difficult to say how may affect your integration if you were to encounter it. If you were to make an API call with a large response body, it may be possible the response would not include a valid JSON object if the response is truncated. When this error occurs, the HTTP status code will be valid, but the response will be truncated or non-existent.

[2292](https://github.com/FusionAuth/fusionauth-issues/issues/2292)

## Version 1.45.2

8 May 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-2249--lm9p)

Access token signing keys specific to an entity type may revert to the tenant configuration after upgrading to this version.

It is recommended to upgrade to this version at a minimum if you are coming from a version prior to version `1.45.0`. For more information on this issue, see the Known Issues in the `1.45.0` release notes.

[2249](https://github.com/FusionAuth/fusionauth-issues/issues/2249)

## Version 1.45.1

14 April 2023

[Enhancement](#enhancement--issue-2185--ocpz)

Added more validation when adding authorized origin to the OAuth2 configuration to ensure the values do not include a path or query string. This change will only affect validation when adding or editing the application configuration. This change will not affect existing configured origins or their use at runtime.

[2185](https://github.com/FusionAuth/fusionauth-issues/issues/2185)

[Fix](#fix--issue-2164--jibh)

Added support for wildcard configuration when using `post_logout_redirect_uri` parameter on the OAuth2 Logout request.

[2164](https://github.com/FusionAuth/fusionauth-issues/issues/2164)

[Fix](#fix--issue-2206--o8b0)

Fixed salt validation for the `phpass-md5` or `phpass-sha512`. This will allow the import of users with this password hash when the salt includes a `.` (period) character.

[2206](https://github.com/FusionAuth/fusionauth-issues/issues/2206)

## Version 1.45.0 (Dapper Duck)

10 April 2023

[Known Issue](#v-1-45-1--known-issue--via-2206--w9vg)

When importing users using the `phpass-md5` or `phpass-sha512` schemes shipped in this release, if the salt contains a period (`.`) the import will fail validation.

Resolved in version [1.45.1](#version-1-45-1) via [2206](https://github.com/FusionAuth/fusionauth-issues/issues/2206).

[Known Issue](#v-1-45-2--known-issue--via-2249--hzf6)

If you configured an access token signing key specific to an entity type, the signing key configuration may revert to the tenant configuration after upgrading to this version.

If you wish to upgrade before a fix is available, please document your access token signing key configuration for each entity type that has provided a specific signing configuration. Then, once the upgrade has completed, review each entity type and confirm the correct signing key configuration. If the configuration is not correct, set the signing key to the previously documented signing key.

To verify if this issue may affect you during upgrade, confirm your signing configuration for each configured entity type.

1.  Navigate to Entity Management -> Entity Types -> Edit -> JWT .
2.  If you have not enabled Entity Type specific JWT signing, this section will be collapsed and this entity type will not be affected during upgrade. If the signing configuration is enabled and you have configured a key for the `Access token signing key` field, you may be affected. Please record this setting and ensure it has not changed after the upgrade has completed.

If you have not yet upgraded to version `1.45.0`, it is recommended to move to version `1.45.2` or later at a minimum and skip this version if you have confirmed you may be affected by this issue.

Resolved in version [1.45.2](#version-1-45-2) via [2249](https://github.com/FusionAuth/fusionauth-issues/issues/2249).

[New Feature](#new-feature--issue-1578--bh0q)

Added a policy to require a user to provide their current password when changing a password on the self-service account pages. See Applications -> Edit -> Registration -> Form settings -> Require current password .

[1578](https://github.com/FusionAuth/fusionauth-issues/issues/1578)

[New Feature](#new-feature--issue-1943--32c0)

Integrated the Authorization Code grant workflow into FusionAuth for use with single page web applications. This feature may be used with the FusionAuth React or Angular SDKs to support the use of the Authorization Code grant without having to write any backend code.

[1943](https://github.com/FusionAuth/fusionauth-issues/issues/1943)

[New Feature](#new-feature--mtpv)

Added new Search APIs. These new APIs provide search and pagination capability across more APIs and may increase performance when using the FusionAuth admin UI with larger numbers of Tenants and Applications. Added Search APIs include: Applications, Consents, Groups, Tenants, Themes, Keys, API keys, User Comments, Email Templates, Identity Providers, Webhooks, and Lambdas.

Resolves issues [2055](https://github.com/FusionAuth/fusionauth-issues/issues/2055), [2056](https://github.com/FusionAuth/fusionauth-issues/issues/2056), [2057](https://github.com/FusionAuth/fusionauth-issues/issues/2057), [2058](https://github.com/FusionAuth/fusionauth-issues/issues/2058), [2059](https://github.com/FusionAuth/fusionauth-issues/issues/2059), [2060](https://github.com/FusionAuth/fusionauth-issues/issues/2060), [2061](https://github.com/FusionAuth/fusionauth-issues/issues/2061), [2064](https://github.com/FusionAuth/fusionauth-issues/issues/2064), [2065](https://github.com/FusionAuth/fusionauth-issues/issues/2065), [2066](https://github.com/FusionAuth/fusionauth-issues/issues/2066), [2067](https://github.com/FusionAuth/fusionauth-issues/issues/2067), and [2068](https://github.com/FusionAuth/fusionauth-issues/issues/2068)

[New Feature](#new-feature--issue-2165--ooa8)

Added support for Drupal MD5, SHA-512 hashes for easier import. New schemes include `phpass-md5` and `phppass-sha512`. For more information, see the documentation for [phpass MD5](https://4002.18-224-161-104.sslip.io/docs/reference/password-hashes.md#phpass-md5) and [phpass SHA-512](https://4002.18-224-161-104.sslip.io/docs/reference/password-hashes.md#phpass-md5).

[2165](https://github.com/FusionAuth/fusionauth-issues/issues/2165)

[Enhancement](#enhancement--issue-1546--thanks-ansonallard--bdmd)

De-coupled the self-service themed account pages from SSO. You may now use the self-service account pages even if you choose not to preserve your SSO session. For example, you can un-check the "Keep me signed in" checkbox and still use the self-service pages.

Also allow the self-service account session to be bootstrapped from a mobile application using token authentication, also known as the `Bearer` authentication scheme. This mechanism provides access to the self-service themed pages even if you are unable to share cookies with the web view used to complete login.

Example request header: `Authorization: Bearer <access_token>`

Thanks to [@ansonallard](https://github.com/ansonallard)!

[1546](https://github.com/FusionAuth/fusionauth-issues/issues/1546)[1860](https://github.com/FusionAuth/fusionauth-issues/issues/1860)

[Fix](#fix--issue-2089--22kz)

Added validation for the length of an entity name in order to provide a more friendly validation error message.

[2089](https://github.com/FusionAuth/fusionauth-issues/issues/2089)

[Fix](#fix--issue-2103--h0rf)

Updated to the OpenAPI spec to correct an error related to `BaseSAMLv2IdentityProvider`.

[2103](https://github.com/FusionAuth/fusionauth-issues/issues/2103)

[Fix](#fix--issue-2163--syyt)

Reviewed and corrected tooltips in the admin UI for Application specific email templates.

[2163](https://github.com/FusionAuth/fusionauth-issues/issues/2163)

[Security](#security--issue-2182--y2d0)

Updated usage of `verificationId` on gated email or registration verification pages when configured to use a clickable link instead of a short code.

[2182](https://github.com/FusionAuth/fusionauth-issues/issues/2182)

[Internal](#internal--issue-2198--taoj)

Fixed JSON exclusions for ignoring foreign keys.

[2198](https://github.com/FusionAuth/fusionauth-issues/issues/2198)

[Internal](#internal--issue-2183--ncgq)

Updated 3rd party dependencies:

*   Upgrade Elasticsearch client from version `7.10.2` to `7.13.4`.
*   Upgrade GraalJS from version `22.3.0` to `22.3.1`.

[2183](https://github.com/FusionAuth/fusionauth-issues/issues/2183)

## Version 1.44.0

13 March 2023

[Database Migration](#database-migration--tzpb)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

This migration adds an index to the `identity_provider_links` table. It is not expected to negatively impact the migration time during upgrade, but please be aware that deployments with millions of Identity Provider Links may experience additional processing time during the migration.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-63-0--known-issue--via-3275--nd35)

Apple IdP-assigned keys may fail to delete.

Resolved in version [1.63.0](#version-1-63-0) via [3275](https://github.com/FusionAuth/fusionauth-issues/issues/3275).

[Known Issue](#v-1-63-0--known-issue--via-3313--khmj)

In self-service registration, a user can alter a hidden field (using browser developer tools) and cause `Failed decrypt registration state` errors to appear in the event log.

Resolved in version [1.63.0](#version-1-63-0) via [3313](https://github.com/FusionAuth/fusionauth-issues/issues/3313).

[Enhancement](#enhancement--issue-1742--g7k1)

Added default configuration for read and connect timeouts to the SMTP server configuration. This helps protect FusionAuth against an SMTP server that never closes a socket. From time to time we observed an SMTP server hold open a socket, and tie up a send thread which may block other senders. This includes the `mail.smtp.timeout` and `mail.smtp.connectiontimeout` settings. The default value is `2000` for each. These may be overridden by navigating to the `Advanced` tab in your tenant and adding them to the `SMTP settings` section.

[1742](https://github.com/FusionAuth/fusionauth-issues/issues/1742)

[Enhancement](#enhancement--issue-1747--2brw)

Changed Link API request body to match the response. Backwards compatibility is maintained, but this provides a more consistent API feel.

[1747](https://github.com/FusionAuth/fusionauth-issues/issues/1747)

[Enhancement](#enhancement--issue-1939--thanks-brunom50--jplm)

Updated the Google IdP JavaScript in the themed pages. This change removes the deprecated Google JavaScript library, and adds support for One Tap. *Thanks to [@forteilgmbh](https://github.com/forteilgmbh) for their contribution.*

Thanks to [@Brunom50](https://github.com/Brunom50) and [@harishreddy-m](https://github.com/harishreddy-m)!

[1939](https://github.com/FusionAuth/fusionauth-issues/issues/1939)

[Enhancement](#enhancement--issue-2109--a5tz)

Returns a `404` with status only for anything under `/api/*` instead of rendering a `404` page with HTML. It just seems like the right thing to do. Nobody wants HTML in their APIs!

[2109](https://github.com/FusionAuth/fusionauth-issues/issues/2109)

[Enhancement](#enhancement--issue-2122--63d5)

Added a new index to the `identity_provider_links` table to increase performance.

[2122](https://github.com/FusionAuth/fusionauth-issues/issues/2122)

[Enhancement](#enhancement--issue-2127--3uwd)

Added `apiMode: [Public|Partner]` to allow the user to select between the public or partner Steam API. The Partner API is preferred if you have access to it because it is not rate limited.

[2127](https://github.com/FusionAuth/fusionauth-issues/issues/2127)

[Fix](#fix--issue-2102--91el)

A Lambda invocation may incorrectly fail indicating a recursive call was attempted. This is unlikely to occur, but under heavy load, it is possible.

[2102](https://github.com/FusionAuth/fusionauth-issues/issues/2102)

[Fix](#fix--issue-2118--7k8q)

The Application API was failing to make a copy when using `sourceApplicationId` when the source Application has enabled and configured the SAML v2 IdP. This is a bug in a new feature that was added in version `1.43.0`.

[2118](https://github.com/FusionAuth/fusionauth-issues/issues/2118)

[Internal](#internal--issue-2097--jazp)

Expanded use of `Cache-Control: no-store` in the FusionAuth admin application.

[2097](https://github.com/FusionAuth/fusionauth-issues/issues/2097)

## Version 1.43.1

6 March 2023

[Fix](#fix--issue-2125--pgsy)

Corrected a potential FreeMarker render error caused by a missing CSRF token when performing an SAML v2 IdP initiated login to the FusionAuth admin UI. This error is a side effect of the caller not requesting the `scope=offline_access` parameter. With this fix, you should no longer encounter the error, and the `offline_access` scope is now optional on the request. To work around this issue, request the `offline_access` scope.

[2125](https://github.com/FusionAuth/fusionauth-issues/issues/2125)

## Version 1.43.0

15 February 2023

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-44-0--known-issue--via-2118--84li)

Creating a new application from another application with `sourceApplicationId` returns a `500` error when the source application has SAML v2 enabled and configured. If you have not configured SAML v2, you will not be affected by this issue. Workaround is to call Create Application API without the `sourceApplicationId` parameter and supply all the parameters copied from the source application.

Resolved in version [1.44.0](#version-1-44-0) via [2118](https://github.com/FusionAuth/fusionauth-issues/issues/2118).

[New Feature](#new-feature--issue-437--ey2t)

Added support for wild cards in OAuth2 Authorized Origin and Authorized Redirect URL configurations. Use with caution - but have fun with it!

*In chronological order, thank you to [@SeanStayn](https://github.com/SeanStayn), [@Jank1310](https://github.com/Jank1310), [@JuliusPC](https://github.com/JuliusPC), [@dystopiandev](https://github.com/dystopiandev), [@alessandrojcm](https://github.com/alessandrojcm), [@sjmog](https://github.com/sjmog), [@huysentruitw](https://github.com/huysentruitw) and [@mdnadm](https://github.com/mdnadm).*

[437](https://github.com/FusionAuth/fusionauth-issues/issues/437)

[New Feature](#new-feature--issue-1996--ixs7)

Added support for native TLS configuration in the FusionAuth HTTP server without the requirement to use a proxy with TLS termination.

[1996](https://github.com/FusionAuth/fusionauth-issues/issues/1996)

[New Feature](#new-feature--issue-2054--v2va)

Added support for the `salted-pbkdf2-hmac-sha512-512` password hash algorithm. For more information, see [Salted PBKDF2 HMAC SHA-512](https://4002.18-224-161-104.sslip.io/docs/reference/password-hashes.md#salted-pbkdf2-hmac-sha-512).

[2054](https://github.com/FusionAuth/fusionauth-issues/issues/2054)

[Enhancement](#enhancement--issue-1805--aauu)

Added support for importing an x.509 certificate with a private key into KeyMaster in the admin UI.

[1805](https://github.com/FusionAuth/fusionauth-issues/issues/1805)

[Enhancement](#enhancement--issue-778--thanks-johnmaia--98wb)

Added Additional configuration for the Apple IdP to support login from Mobile and Desktop.

Thanks to [@johnmaia](https://github.com/johnmaia) and [@Brunom50](https://github.com/Brunom50)!

[778](https://github.com/FusionAuth/fusionauth-issues/issues/778)[1248](https://github.com/FusionAuth/fusionauth-issues/issues/1248)

[Enhancement](#enhancement--issue-1612--wslt)

Updated the System Log viewer in the FusionAuth admin UI to order logs for easier viewing pleasure.

[1612](https://github.com/FusionAuth/fusionauth-issues/issues/1612)

[Enhancement](#enhancement--issue-1735--thanks-epbensimpson--ivhq)

Allow Forgot Password API usage when the Forgot Password Email template is not configured if `sendForgotPasswordEmail` is `false`.

Thanks to [@epbensimpson](https://github.com/epbensimpson)!

[1735](https://github.com/FusionAuth/fusionauth-issues/issues/1735)

[Enhancement](#enhancement--issue-1897--thanks-sujkattimani--6lca)

Provide better developer feedback on the Change Password API when using an API key.

Thanks to [@sujkattimani](https://github.com/sujkattimani)!

[1897](https://github.com/FusionAuth/fusionauth-issues/issues/1897)

[Enhancement](#enhancement--issue-1900--thanks-leesmith110--fcpk)

Allow the SAML v2 IdP to be used for both SP and IdP initiated login. Previously to utilize SP and IdP initiated login for the same SAML v2 IdP, you would have to create two separate configurations. It is still recommended to use the separate SAML v2 IdP initiated configuration if you will not be using an SP initiated login.

Thanks to [@leesmith110](https://github.com/leesmith110)!

[1900](https://github.com/FusionAuth/fusionauth-issues/issues/1900)

[Enhancement](#enhancement--issue-1944--fwmj)

Added support for PostgreSQL 15.

[1944](https://github.com/FusionAuth/fusionauth-issues/issues/1944)[2015](https://github.com/FusionAuth/fusionauth-issues/issues/2015)

[Enhancement](#enhancement--issue-1942--7j4k)

Added an option to include archived logs in gzip format on the System Log Download API. This will be the default when downloading the logs in the FusionAuth admin UI.

[1942](https://github.com/FusionAuth/fusionauth-issues/issues/1942)

[Enhancement](#enhancement--issue-1946--ogec)

Allow the login hint that is passed to a 3rd Party SAML v2 IdP to be configured. Previously this was always `login_hint`, but Azure will expect `username`, this can now be configured.

[1946](https://github.com/FusionAuth/fusionauth-issues/issues/1946)

[Enhancement](#enhancement--issue-1957--ibqo)

Added `sourceApplicationId` to the Application API to create an app from an existing Application to copy settings. This allows you to more easily use a single Application as a template, or to just make a copy.

[1957](https://github.com/FusionAuth/fusionauth-issues/issues/1957)

[Enhancement](#enhancement--issue-1993--4nx0)

Created default email templates for Add and Remove Multi-Factor methods.

[1993](https://github.com/FusionAuth/fusionauth-issues/issues/1993)

[Enhancement](#enhancement--issue-1995--44ki)

Added additional SAML IdP config to allow advanced assertion capabilities such as allow any destination, or alternate values. This is sort of a dangerous power user feature, but can be useful when migrating IdP configurations into FusionAuth w/out requiring each IdP to update their ACS.

[1995](https://github.com/FusionAuth/fusionauth-issues/issues/1995)

[Enhancement](#enhancement--issue-2045--o3au)

Added additional detail to the edit registration form in the FusionAuth admin UI so you know which user you are editing. Seemed like a good idea.

[2045](https://github.com/FusionAuth/fusionauth-issues/issues/2045)

[Enhancement](#enhancement--issue-2085--6o69)

Do not validate `Content-Type` when a payload has not been provided.

[2085](https://github.com/FusionAuth/fusionauth-issues/issues/2085)

[Fix](#fix--issue-1809--thanks-epbensimpson--yhxj)

When using the Forgot Password workflow on the FusionAuth login page with a user without an email address, the page would refresh instead of redirecting to the success screen indicating an email had been sent.

Thanks to [@epbensimpson](https://github.com/epbensimpson)!

[1809](https://github.com/FusionAuth/fusionauth-issues/issues/1809)

[Fix](#fix--issue-1909--thanks-timyourivh--u4rz)

The Change Password API was incorrectly failing, indicating a Trust Token was required, even when provided if the user has MFA enabled.

Thanks to [@timyourivh](https://github.com/timyourivh)!

[1909](https://github.com/FusionAuth/fusionauth-issues/issues/1909)

[Fix](#fix--issue-1912--k8f5)

Ensured that we correctly terminate an SSO session when beginning a new passwordless login flow with a different user in the same browser.

[1912](https://github.com/FusionAuth/fusionauth-issues/issues/1912)

[Fix](#fix--issue-1920--thanks-epbensimpson--aqya)

Fixed various limitations with adding a consent to a self-service account form.

Thanks to [@epbensimpson](https://github.com/epbensimpson)!

[1920](https://github.com/FusionAuth/fusionauth-issues/issues/1920)

[Fix](#fix--issue-1941--thanks-jon-at-advarra--27xm)

Fixed an error that may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP.

Thanks to [@jon-at-advarra](https://github.com/jon-at-advarra)!

[1941](https://github.com/FusionAuth/fusionauth-issues/issues/1941)

[Fix](#fix--issue-1976--thanks-jon-at-advarra--u5k0)

Fixed an error that may occur when logging into the FusionAuth admin UI with an IdP initiated request from a SAML v2 IdP and then navigating to your own profile page.

Thanks to [@jon-at-advarra](https://github.com/jon-at-advarra)!

[1976](https://github.com/FusionAuth/fusionauth-issues/issues/1976)

[Fix](#fix--issue-1978--mx32)

Fixed an error where, when taking a User Action, the duration is localized for the event. The localization is only available for a fixed number of locales. When an unsupported locale, such as Serbian is requested, an exception will occur. This has been fixed to avoid the exception, and if an unsupported Locale is requested, English will be used as the default.

[1978](https://github.com/FusionAuth/fusionauth-issues/issues/1978)

[Fix](#fix--issue-1985--thanks-sixhobbits--vwjt)

Fixed an error where, when sending a test event to verify the Kafka configuration, the topic was not being validated as required.

Thanks to [@sixhobbits](https://github.com/sixhobbits)!

[1985](https://github.com/FusionAuth/fusionauth-issues/issues/1985)

[Fix](#fix--issue-1989--378h)

Fixed an error where, when completing the forgot password workflow using the FusionAuth themed pages outside of an OAuth context, you may receive an error that says `Oops. It looks like you've gotten here by accident.`.

[1989](https://github.com/FusionAuth/fusionauth-issues/issues/1989)

[Fix](#fix--issue-2007--thanks-lancegliser--8ydz)

Updated the Email Template preview in the view dialog to be consistent with the preview in the edit page.

Thanks to [@lancegliser](https://github.com/lancegliser)!

[2007](https://github.com/FusionAuth/fusionauth-issues/issues/2007)

[Fix](#fix--issue-2010--9dst)

Restricted the Two-Factor Trust during a Change Password request to be used for the workflow that started the request.

[2010](https://github.com/FusionAuth/fusionauth-issues/issues/2010)

[Fix](#fix--issue-2026--9kki)

Fixed the edit Form Field in the FusionAuth admin UI for a consent field.

[2026](https://github.com/FusionAuth/fusionauth-issues/issues/2026)

[Fix](#since-1-42-0--fix--issue-2032--o6b1)

Using password reset to unlock account may not work when MFA is enabled for the user.

Since: [1.42.0](#version-1-42-0)

[2032](https://github.com/FusionAuth/fusionauth-issues/issues/2032)

## Version 1.42.1

8 January 2023

[Fix](#since-1-42-0--fix--issue-2043--6r8y)

A regression error in version `1.42.0` may cause a user to no longer be able to login after a successful login. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, please do not upgrade to version `1.42.0` and instead upgrade directly to this version.

Since: [1.42.0](#version-1-42-0)

[2043](https://github.com/FusionAuth/fusionauth-issues/issues/2043)

## Version 1.42.0

7 December 2022

[Known Issue](#v-1-42-0--known-issue--via-2043--2oyr)

A regression error in version `1.42.0` may cause a user to no longer be able to login after a successful login. In order to encounter this bug, you must have your tenant configured to re-hash passwords on login, and have a user login when their password encryption scheme or factor that does not match the configured tenant defaults. If you may have this type of configuration, do not upgrade to version `1.42.0` and instead upgrade directly to `1.42.1`.

Resolved in version [1.42.0](#version-1-42-0) via [2043](https://github.com/FusionAuth/fusionauth-issues/issues/2043).

[Known Issue](#v-1-43-0--known-issue--via-2032--ih8e)

In this release, you may now create a policy to allow a user to unlock their account after too many failed login attempts by completing a forgot password workflow. A bug was identified in this new feature that may cause this workflow to fail if the user also has 2FA enabled.

Resolved in version [1.43.0](#version-1-43-0) via [2032](https://github.com/FusionAuth/fusionauth-issues/issues/2032).

[Breaking Change](#breaking-change--issue-1929--m0ht)

When building a WebAuthn credential, the user's current email address or username will now be used as the credential name. Previously this value was generated to be unique to help the user identify multiple credentials. However, Safari on macOS and Edge on Windows may display this value to the end user, so this will no longer be generated but set to a value the user should recognize.

[1929](https://github.com/FusionAuth/fusionauth-issues/issues/1929)

[Theme Upgrade](#theme-upgrade--issue-197--em2u)

New themed templates for enabling two-factor authentication during login. Please review your themes to ensure the new templates and localized messages are added.

*   `theme.templates.oauth2TwoFactorEnable -> /oauth2/two-factor-enable`
*   `theme.templates.oauth2TwoFactorEnableComplete -> /oauth2/two-factor-enable-complete`

[197](https://github.com/FusionAuth/fusionauth-issues/issues/197)

[New Feature](#new-feature--issue-197--k16j)

Added an Multi-Factor policy option to require a user to enable multi-factor during login if not yet configured. See `Tenants > Edit > MFA > Policies > On login > Required.`. Application specific configuration can also be configured, see `Applications > Edit > MFA > Policies > On login > Required.`, using the application configuration requires an Enterprise plan.

[197](https://github.com/FusionAuth/fusionauth-issues/issues/197)

[New Feature](#new-feature--issue-1794--mxr4)

Allow refresh tokens to be revoked for a user when enabling two-factor authentication. See `Tenants > Edit > JWT > Refresh token settings > Refresh token revocation > On multi-factor enable`.

[1794](https://github.com/FusionAuth/fusionauth-issues/issues/1794)

[New Feature](#new-feature--issue-1833--8kn5)

A new lambda function can be assigned to perform custom validation for any step during a self-service registration. This feature is only available when using a custom form, and is not available when using basic self-service registration. This may be useful to perform advanced field validation, or to call a 3rd party API to perform additional identity verification.

[1833](https://github.com/FusionAuth/fusionauth-issues/issues/1833)

[Enhancement](#enhancement--issue-383--myc1)

Allow a user to unlock their account after being locked due to too many failed authentication attempts by completing a password reset workflow. See the `Cancel action on password reset` in the Tenant configuration. `Tenants > Edit > Password > Failed authentication settings`.

*Thanks [@colingm](https://github.com/colingm) for the request, and [@davidmw](https://github.com/davidmw) and [@Jlintonjr](https://github.com/Jlintonjr) for the advice and feedback!*

[383](https://github.com/FusionAuth/fusionauth-issues/issues/383)

[Enhancement](#enhancement--issue-1062--6epd)

Use the existing tenant configuration for `modifyEncryptionSchemeOnLogin` to also update the hash when changed.

[1062](https://github.com/FusionAuth/fusionauth-issues/issues/1062)

[Enhancement](#enhancement--issue-1823--6l28)

Added additional configuration to the `Failed authentication settings` in the tenant configuration to optionally email the user when the configured action is also configured to allow emailing.

[1823](https://github.com/FusionAuth/fusionauth-issues/issues/1823)

[Enhancement](#enhancement--issue-1982--xqan)

Updated the `System > About` panel in the admin UI to report OpenSearch when using OpenSearch instead of Elasticsearch.

[1982](https://github.com/FusionAuth/fusionauth-issues/issues/1982)

[Fix](#fix--issue-1979--nqgr)

Minor WebAuthn related fixes.

[1979](https://github.com/FusionAuth/fusionauth-issues/issues/1979)[1986](https://github.com/FusionAuth/fusionauth-issues/issues/1986)

[Fix](#fix--issue-1883--5ut5)

When providing both the `entityId` and `userId` on the Entity Search API, an exception will occur.

[1883](https://github.com/FusionAuth/fusionauth-issues/issues/1883)

[Fix](#fix--issue-1987--24sv)

Removed SCIM endpoints from the API key configuration in the admin UI, these endpoints do not use API keys.

[1987](https://github.com/FusionAuth/fusionauth-issues/issues/1987)

[Fix](#fix--issue-1755--thanks-steve-mp--g82p)

Fixed various rendering issues with the Theme preview in the admin UI

Thanks to [@Steve-MP](https://github.com/Steve-MP)!

[1755](https://github.com/FusionAuth/fusionauth-issues/issues/1755)

## Version 1.41.3

21 November 2022

[Security](#security--8ly7)

Mitigated a potential directory traversal attack. CloudFlare, AWS and similar cloud providers will generally block these requests by default. FusionAuth Cloud customers are not vulnerable to this type of attack.

## Version 1.41.2

17 November 2022

[Fix](#fix--issue-1969--13yn)

Enabled licensed features such as SCIM or WebAuthn to be configured during kickstart.

[1969](https://github.com/FusionAuth/fusionauth-issues/issues/1969)

## Version 1.41.1

16 November 2022

[Fix](#fix--issue-1907--thanks-yuezhou1998--etq4)

Improved synchronization of a user during a connector login. Specifically, allow previously obtained refresh tokens to be preserved during the user update procedures during a connector synchronization event.

Thanks to [@yuezhou1998](https://github.com/yuezhou1998)!

[1907](https://github.com/FusionAuth/fusionauth-issues/issues/1907)

[Fix](#fix--issue-1958--wr8f)

Allowed for invalid language values to be provided in the `Accept-Language` HTTP request header. When an invalid language is provided, the `Accept-Language` header will be discarded.

[1958](https://github.com/FusionAuth/fusionauth-issues/issues/1958)

[Fix](#fix--issue-1965--nb50)

Improved support for starting a forgot password workflow using the API and completing the workflow in a themed page when a user also has 2FA enabled.

[1965](https://github.com/FusionAuth/fusionauth-issues/issues/1965)

[Security](#security--issue-1964--thanks-vtcdanh--gq7r)

Removed app template files from the classpath.

Thanks to [@vtcdanh](https://github.com/vtcdanh)!

[1964](https://github.com/FusionAuth/fusionauth-issues/issues/1964)

## Version 1.41.0

10 November 2022

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#known-issue--twe5)

A change to the FusionAuth HTTP server may cause issues with reverse proxies that default upstream connections to `HTTP/1.0`. The HTTP server we are using no longer supports `HTTP/1.0`. We have identified that `nginx` defaults all upstream connections to `HTTP/1.0`, and the HTTP server we are using no longer supports `HTTP/1.0`. For `nginx` specifically, you will need to set the proxy version by adding `proxy_http_version 1.1;` to your proxy config.

[Theme Upgrade](#theme-upgrade--789j)

Added new themed pages for WebAuthn. Please review your themes to ensure the new templates and localized messages are added. WebAuthn re-authentication requires a new hidden form field named `userVerifyingPlatformAuthenticatorAvailable` to detect compatible devices/browsers and prompt the user to register a passkey. You can view the default templates to determine in which form to insert this field into any customized templates. This field must be present on the following pages:

*   OAuth authorize
*   OAuth complete registration
*   OAuth passwordless
*   OAuth register
*   OAuth two-factor
*   OAuth WebAuthn (new)

See [Upgrade an Advanced Theme](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade-advanced-theme.md) for additional information about the upgrade process. See [Advanced Theme Upgrade Notes](https://4002.18-224-161-104.sslip.io/docs/theme/advanced-themes/upgrade.md) for details on updating an existing advanced theme specific to this release.

[New Feature](#new-feature--issue-77--x4cp)

Introduced WebAuthn! Passkeys, Touch ID, Face ID, Android fingerprint, Windows Hello!

[77](https://github.com/FusionAuth/fusionauth-issues/issues/77)

[New Feature](#new-feature--issue-1915--imbq)

Enabled users to be provisioned into the FusionAuth app using an IdP.

[1915](https://github.com/FusionAuth/fusionauth-issues/issues/1915)

[New Feature](#new-feature--issue-1927--aylt)

Added the ability for FusionAuth to initiate a SAML v2 login request to a SAML v2 Service Provider.

[1927](https://github.com/FusionAuth/fusionauth-issues/issues/1927)

[Enhancement](#enhancement--issue-1785--hdy6)

Support passing the Assertion Consumer Service (ACS) in the `RelayState` query parameter.

[1785](https://github.com/FusionAuth/fusionauth-issues/issues/1785)

[Enhancement](#enhancement--issue-1873--nwey)

Support using an `appId` and `sessionTicket` to complete login with the Steam Identity Provider.

[1873](https://github.com/FusionAuth/fusionauth-issues/issues/1873)

[Enhancement](#enhancement--issue-1904--php6)

Restored support for some legacy HTTP Servlet Request methods for use in themed templates.

[1904](https://github.com/FusionAuth/fusionauth-issues/issues/1904)

[Fix](#fix--issue-1906--shpl)

Corrected signature verification of a SAML v2 AuthN response after the certificate has been removed from Key Master.

[1906](https://github.com/FusionAuth/fusionauth-issues/issues/1906)

[Fix](#fix--issue-1918--lr0i)

Fixed an issue where, when requesting keys by an `applicationId`, an exception may be thrown when there are no keys to be returned from the `/api/jwt/public-key`.

[1918](https://github.com/FusionAuth/fusionauth-issues/issues/1918)

[Fix](#fix--issue-1934--gnny)

Fixed an issue where, SSO logout in Firefox may result in downloading a zero byte file.

[1934](https://github.com/FusionAuth/fusionauth-issues/issues/1934)

[Fix](#fix--issue-1945--1unx)

Fixed an issue where, when multiple webhooks are configured, and more than one webhook is configured to receive the `event-log.create` event, a failed webhook may cause an event loop.

[1945](https://github.com/FusionAuth/fusionauth-issues/issues/1945)

[Fix](#fix--issue-1954--umiu)

Corrected de-serialization of the `userType` and `title` fields in a SCIM resource.

[1954](https://github.com/FusionAuth/fusionauth-issues/issues/1954)

[Security](#security--issue-1913--kfo9)

Updated `com.fasterxml.jackson.*` dependencies to version `2.14.0`. This update is proactive, there are no known exploits. See [CVE-2022-42003](https://www.cve.org/CVERecord?id=CVE-2022-42003) and [CVE-2022-42004](https://www.cve.org/CVERecord?id=CVE-2022-42004).

[1913](https://github.com/FusionAuth/fusionauth-issues/issues/1913)

[Internal](#internal--issue-1936--1lo7)

Updated the docker image to `ubuntu:jammy`.

[1936](https://github.com/FusionAuth/fusionauth-issues/issues/1936)

[Internal](#internal--b553)

Switched to a new HTTP server.

## Version 1.40.2

28 September 2022

[Fix](#since-1-37-0--fix--issue-1905--l72y)

Fixed an issue where a two-factor trust may expire early causing a user to be prompted to complete two-factor during login.

Since: [1.37.0](#version-1-37-0)

[1905](https://github.com/FusionAuth/fusionauth-issues/issues/1905)

## Version 1.40.1

26 September 2022

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Enhancement](#enhancement--issue-1885--8u0d)

Added support for `Content-Type` in Kickstart when using `PATCH` request to support `application/json-patch+json` and `application/merge-patch+json`.

[1885](https://github.com/FusionAuth/fusionauth-issues/issues/1885)

[Enhancement](#enhancement--issue-1895--r9wf)

Removed unnecessary logging when the `Content-Type` request header is invalid or unset.

[1895](https://github.com/FusionAuth/fusionauth-issues/issues/1895)

[Fix](#fix--issue-1800--jsor)

Fixed an issue where a SAML v2 IdP Initiated login request will fail if PKCE is configured as required.

[1800](https://github.com/FusionAuth/fusionauth-issues/issues/1800)

[Fix](#fix--issue-1891--exo7)

Fixed an issue where the path attribute in some cookies may be set to the request path instead of `/` which may affect a SAML v2 IdP initiated login request.

[1891](https://github.com/FusionAuth/fusionauth-issues/issues/1891)

## Version 1.40.0

16 September 2022

[Breaking Change](#breaking-change--issue-1862--xpqi)

If you are using MySQL or plan to use MySQL you will need to manually download the JDBC connector to allow FusionAuth to connect to a MySQL database. If you are using PostgreSQL, this change will not affect you. See the installation guide for additional information. We apologize in advance for the inconvenience this causes you, but the Oracle GPL licensing model makes it difficult for FusionAuth to easily delivery this capability.

[1862](https://github.com/FusionAuth/fusionauth-issues/issues/1862)

[New Feature](#new-feature--issue-1848--nl2d)

Re-instated native Windows support. We apologize for the gap in native Windows support, for those who have been waiting to upgrade since version `1.37.0` you may now upgrade with a native installer. Thank you for all of you who have voiced your opinions with how we are support a native Windows installation.

[1848](https://github.com/FusionAuth/fusionauth-issues/issues/1848)

[Enhancement](#enhancement--issue-1871--f16i)

Support changes to `user.active` for `PUT` or `PATCH` on the SCIM User or Enterprise User endpoints.

[1871](https://github.com/FusionAuth/fusionauth-issues/issues/1871)

[Enhancement](#enhancement--issue-1884--posp)

Improved the performance of SAML v2 request parsing.

[1884](https://github.com/FusionAuth/fusionauth-issues/issues/1884)

[Known Issue](#v-1-69-0--known-issue--via-3268--r0ui)

The Admin UI displays keys that cannot be used for the current task in the key dropdown (e.g. the JWT signing key dropdown displays a public key). Selecting an invalid key result in a validation error.

Resolved in version [1.69.0](#version-1-69-0) via [3268](https://github.com/FusionAuth/fusionauth-issues/issues/3268).

[Fix](#fix--issue-1872--jp40)

Fixed an issue where an exception could occur when you attempt to perform a `PATCH` request on a Group using a `roleId` that does not exist.

[1872](https://github.com/FusionAuth/fusionauth-issues/issues/1872)

[Fix](#fix--issue-1882--thanks-epbensimpson--dhsz)

Added URL escapes to the `identityProviderUser` in the admin UI to correctly build the View and Delete actions links.

Thanks to [@epbensimpson](https://github.com/epbensimpson)!

[1882](https://github.com/FusionAuth/fusionauth-issues/issues/1882)

## Version 1.39.0

11 September 2022

[Enhancement](#enhancement--issue-441--k0cw)

Improved support for JSON Patch. Now supporting RFC 7386 `application/merge-patch+json` and RFC 6902 `application/json-patch+json`. Note that you may still make a request using the `PATCH` HTTP method using `application/json` and the current behavior should not be changed. All `patch*` methods found in the FusionAuth client libraries will still be using `application/json` for backwards compatibility. However, now that support for these new content types exists, we will be working to build support into our client libraries.

[441](https://github.com/FusionAuth/fusionauth-issues/issues/441)

[Enhancement](#enhancement--issue-604--525k)

Improved error messages when the `Content-Type` request header is missing or incorrect.

[604](https://github.com/FusionAuth/fusionauth-issues/issues/604)

[Enhancement](#enhancement--issue-1761--qpgx)

Extended SCIM support for the `PATCH` HTTP request method and `filter` and `excludedAttributes` request attributes. The addition of these features allow the FusionAuth SCIM server to be compatible with Azure AD SCIM client and Okta SCIM client. The Group filter support has some limitations, see the [SCIM Group](https://4002.18-224-161-104.sslip.io/docs/apis/scim/scim-group.md#retrieve-a-group) API doc for additional details.

[1761](https://github.com/FusionAuth/fusionauth-issues/issues/1761)[1791](https://github.com/FusionAuth/fusionauth-issues/issues/1791)

[Enhancement](#enhancement--issue-1839--szh7)

Added some missing message keys to default Theme message bundle.

[1839](https://github.com/FusionAuth/fusionauth-issues/issues/1839)

[Enhancement](#enhancement--issue-1856--g5nv)

Removed an unnecessary db request when validating the user security scheme for a user in the Admin UI.

[1856](https://github.com/FusionAuth/fusionauth-issues/issues/1856)

[Fix](#fix--issue-1713--oaog)

Fixed an issue where, when appending the `locale` request parameter on the Authorize request to pre-select the user's locale, the locale could be incorrect for validation errors. For example, appending `locale=fr` will allow the initial render of the page to be localized in French when available. However, because the user did not manually modify the locale selector on the page, if the login fails due to a validation error, the error messages will be returned in the default locale which is generally English.

[1713](https://github.com/FusionAuth/fusionauth-issues/issues/1713)

[Fix](#fix--issue-1717--thanks-paul-fink-silvacom--ch6p)

Group application roles removed during a `PATCH` request to the Group API.

Thanks to [@paul-fink-silvacom](https://github.com/paul-fink-silvacom)!

[1717](https://github.com/FusionAuth/fusionauth-issues/issues/1717)

[Fix](#fix--issue-1842--q2ow)

Corrected the following issues with SAML v2 SP and IdP metadata:

*   The HTTP scheme was missing from the `entityID`. This issue was introduced in version `1.37.0`.
*   The `NameIdFormat` found in the SP meta data was always showing `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` regardless of the value configured in the SAML v2 IdP.

[1842](https://github.com/FusionAuth/fusionauth-issues/issues/1842)

[Fix](#fix--issue-18854--ze60)

Fixed an issue that could lead to an exception in the FusionAuth system logs when the internal login record service runs. Only seen in instances with very large login volumes.

[18854](https://github.com/FusionAuth/fusionauth-issues/issues/18854)

[Fix](#fix--issue-1855--6ziz)

Fixed an issue that could cause the Elasticsearch index to drift out of sync with group memberships when deleting groups or group members.

[1855](https://github.com/FusionAuth/fusionauth-issues/issues/1855)

[Fix](#fix--issue-1858--thanks-adambowen--w5ym)

Added missing support for `en_GB` time and data format support in the FusionAuth admin UI when setting your preferred locale to `en_GB`. It wasn't our intention to force our friends in the United Kingdom 🇬🇧 to painfully read dates and times in the American 🇺🇸 format. Please accept our apologies. 😎

Thanks to [@adambowen](https://github.com/adambowen)!

[1858](https://github.com/FusionAuth/fusionauth-issues/issues/1858)

## Version 1.38.1

22 August 2022

[Fix](#since-1-37-0--fix--issue-1831--thanks-singinc--9hsr)

Fixed an issue where static resources such as CSS and JS could lack a `Content-Type` header, which may cause a proxy using `X-Content-Type-Options: nosniff` to fail to load the resource.

Since: [1.37.0](#version-1-37-0)

Thanks to [@singinc](https://github.com/singinc) and [@Aaron-Ritter](https://github.com/Aaron-Ritter)!

[1831](https://github.com/FusionAuth/fusionauth-issues/issues/1831)[1834](https://github.com/FusionAuth/fusionauth-issues/issues/1834)

[Fix](#fix--issue-1836--2nsp)

Fixed a potential error issue caused by a webhook handler calling back to FusionAuth which may trigger another webhook event. This fix should also improve the performance when sending many events for webhooks.

[1836](https://github.com/FusionAuth/fusionauth-issues/issues/1836)

[Fix](#since-1-36-5--fix--issue-1837--rjov)

Corrected behavior during login when both self-service registration and require registration features are enabled. This configuration may cause a user to be directed to the registration required page during login instead of being registered automatically. If you encounter this error, you may either upgrade or disable the require registration configuration.

Since: [1.36.5](#version-1-36-5)

[1837](https://github.com/FusionAuth/fusionauth-issues/issues/1837)

## Version 1.38.0

17 August 2022

[Fix](#fix--issue-1820--thanks-kevcube--2r91)

Removed dead Tomcat files from Docker image. No cats were harmed in the making of this fix.

Thanks to [@kevcube](https://github.com/kevcube)!

[1820](https://github.com/FusionAuth/fusionauth-issues/issues/1820)

[New Feature](#new-feature--issue-633--ctxd)

Introduced Group and Group Membership Webhooks.

*Thanks to [@JLyne](https://github.com/JLyne), [@ric-sapasap](https://github.com/ric-sapasap) and [@rabshire](https://github.com/rabshire) for the feedback!*

*Thanks to [@matthew-jump](https://github.com/matthew-jump) for making the request.*

[633](https://github.com/FusionAuth/fusionauth-issues/issues/633)[1803](https://github.com/FusionAuth/fusionauth-issues/issues/1803)

## Version 1.37.2

11 August 2022

[Enhancement](#enhancement--issue-1819--wp7e)

Added the ability to create a user in the Admin UI optionally performing email verification. The UI controls and messaging have been enhanced to remove potential confusion.

[1819](https://github.com/FusionAuth/fusionauth-issues/issues/1819)

[Fix](#since-1-37-0--fix--issue-1818--wt4n)

Fixed an issue that caused HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.

Since: [1.37.0](#version-1-37-0)

[1818](https://github.com/FusionAuth/fusionauth-issues/issues/1818)

## Version 1.37.1

10 August 2022

[Fix](#fix--issue-1799--ki55)

Resolved an exception that could occur while trying to capture the debug log event during an authentication request using a Connector.

[1799](https://github.com/FusionAuth/fusionauth-issues/issues/1799)

[Fix](#fix--issue-1801--iij7)

Fixed an issue where a User Action configured to email a user on Failed Login would not send the email as intended.

[1801](https://github.com/FusionAuth/fusionauth-issues/issues/1801)

[Fix](#fix--issue-1816--s8qo)

Fixed an issue where Kickstart failed because it does not wait for FusionAuth to complete startup.

[1816](https://github.com/FusionAuth/fusionauth-issues/issues/1816)

[Fix](#fix--issue-1817--avki)

Fixed an issue where creating an application in the Admin UI could fail due to a licensing error if you do not have an Enterprise license.

[1817](https://github.com/FusionAuth/fusionauth-issues/issues/1817)

## Version 1.37.0

9 August 2022

[Breaking Change](#breaking-change--3nx3)

This release contains some significant internal changes to our HTTP server. While we do not expect any issues, please be aware of this change as you test and prepare for upgrades. Please also be aware of changes to our Windows bundling options.

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-37-1--known-issue--via-1816--3vi9)

Kickstart fails because it does not wait for FusionAuth to complete startup.

Resolved in version [1.37.1](#version-1-37-1) via [1816](https://github.com/FusionAuth/fusionauth-issues/issues/1816).

[Known Issue](#v-1-37-1--known-issue--via-1817--40o7)

Creating an application in the FusionAuth admin UI may fail due to a licensing error if you do not have an Enterprise license.

Resolved in version [1.37.1](#version-1-37-1) via [1817](https://github.com/FusionAuth/fusionauth-issues/issues/1817).

[Known Issue](#v-1-37-2--known-issue--via-1818--nkax)

A regression error was introduced in version `1.37.0` that causes HTTP request headers to be malformed when being sent to a Webhook, Generic Messenger or a Generic Connector.

Resolved in version [1.37.2](#version-1-37-2) via [1818](https://github.com/FusionAuth/fusionauth-issues/issues/1818).

[Known Issue](#v-1-38-1--known-issue--via-1831--xk7u)

Static resources such as CSS and JS may be missing a `Content-Type` header which may cause a proxy using `X-Content-Type-Options: nosniff` to fail to load the resource.

Resolved in version [1.38.1](#version-1-38-1) via [1831](https://github.com/FusionAuth/fusionauth-issues/issues/1831).

[Known Issue](#v-1-40-2--known-issue--via-1905--b891)

A two-factor trust may expire early causing a user to be prompted to complete two-factor during login.

Resolved in version [1.40.2](#version-1-40-2) via [1905](https://github.com/FusionAuth/fusionauth-issues/issues/1905).

[Known Issue](#known-issue--edtx)

A theme issue may exist on a form action and may cause breaking changes when upgrading to this version. If you are upgrading, please verify your theme files accurately create a form action. The following themes should be updated:

*   OAuth authorize -> `action="/oauth2/authorize"`
*   Child registration not allowed -> `action="/oauth2/child-registration-not-allowed"`
*   OAuth passwordless -> `action="/oauth2/passwordless"`
*   OAuth register -> `action="/oauth2/register"`
*   OAuth two-factor -> `action="/oauth2/two-factor"`
*   Change password form -> `action="/password/change"`
*   Forgot password -> `action="/password/forgot"`

[Security](#security--issue-1814--b6ur)

Allow deprecated XML signature algorithms that were removed in Java 17. It is still not recommended that you use any of these legacy SHA1 algorithms, but if you are unable to utilize a modern algorithm, they will be allowed.

[1814](https://github.com/FusionAuth/fusionauth-issues/issues/1814)

[Breaking Change](#breaking-change--204c)

Windows install has been removed. Our strategy is to support Windows using WSL 2 with our provided Debian package. (Note: Due to customer feedback, a native Windows installation option was restored as of version `1.40.0`.)

[Breaking Change](#breaking-change--issue-1812--94lb)

Webhooks are no longer configured as "All applications" or limited to a single Application. They are now scoped to one or more tenants. Filter events in your own Webhook handler by the `applicationId`.

[1812](https://github.com/FusionAuth/fusionauth-issues/issues/1812)

[Breaking Change](#breaking-change--issue-1414--zen2)

Deprecated Apache Tomcat specific configuration:

*   `fusionauth-app.http.max-header-size` default is now `64k`.
*   `fusionauth-app.http.cookie-same-site-policy` cookies will be written using `SameSite=Lax`, and cookies used by the Admin UI use `SameSite=Strict`.
*   `fusionauth-app.management.port` and `fusionauth-app.ajp.port` are no longer required.
*   `fusionauth-app.http.relaxed-path-chars` and `fusionauth-app.http.relaxed-query-chars` options removed.

[1414](https://github.com/FusionAuth/fusionauth-issues/issues/1414)

[Breaking Change](#breaking-change--xwpj)

FastPath and normal startup commands have changed. The startup process will now use `start.sh` instead of Catalina scripts.

[Breaking Change](#breaking-change--4z7k)

When using the FusionAuth Docker image with MySQL, you will need to bundle the MySQL connector jar in the image, or add a layer to the stock FusionAuth image to ensure `curl` is installed.

[Fix](#fix--issue-1547--gvyn)

Add the appropriate feedback to the users when attempting to change an email during a gated email verification that is already in-use.

[1547](https://github.com/FusionAuth/fusionauth-issues/issues/1547)

[Fix](#fix--issue-1676--jw1i)

Correct the validation when deleting a key from Key Master when in use by a de-activated application.

[1676](https://github.com/FusionAuth/fusionauth-issues/issues/1676)

[Fix](#fix--issue-1705--8gll)

Perform implicit email verification when enabled and a setup password email request is completed.

[1705](https://github.com/FusionAuth/fusionauth-issues/issues/1705)

[Fix](#fix--issue-1745--kquc)

Handle URL encoded characters in the user-information part of the URL when connecting to Elasticsearch.

[1745](https://github.com/FusionAuth/fusionauth-issues/issues/1745)

[Fix](#fix--issue-1764--kq48)

When using the Change Password workflow in the hosted login pages for a user that has enabled 2FA, adding the OAuth2 parameters found in the `state` resolves an error when the user completes the workflow.

[1764](https://github.com/FusionAuth/fusionauth-issues/issues/1764)

[Fix](#fix--issue-1772--rrxy)

The Refresh Token retrieve API and the Session tab in admin UI will no longer show expired refresh tokens.

[1772](https://github.com/FusionAuth/fusionauth-issues/issues/1772)

[Fix](#fix--issue-1790--thanks-theogravity--8s0c)

Fix Lambda JS validation when using ES6 features with the GraalJS engine.

Thanks to [@theogravity](https://github.com/theogravity)!

[1790](https://github.com/FusionAuth/fusionauth-issues/issues/1790)

[Enhancement](#enhancement--issue-1319--fz8r)

Administrative Email Verification using the API or FusionAuth admin UI. You may now optionally create the user with an un-verified email.

[1319](https://github.com/FusionAuth/fusionauth-issues/issues/1319)

[Enhancement](#enhancement--issue-1699--lj9l)

The Oauth2 Logout does not log a user out of FusionAuth app if logging out of another application in the same default tenant.

[1699](https://github.com/FusionAuth/fusionauth-issues/issues/1699)

[Enhancement](#enhancement--issue-1702--d142)

Updates to our initial SCIM Server implementation released in version `1.36.0`. (Also resolves #1703)

[1702](https://github.com/FusionAuth/fusionauth-issues/issues/1702)

[Enhancement](#enhancement--issue-1743--sbho)

Better options to capture debug information when troubleshooting an SMTP connection issue by enabling `debug` on the SMTP configuration.

[1743](https://github.com/FusionAuth/fusionauth-issues/issues/1743)

[Enhancement](#enhancement--issue-1788--thanks-darkeagle1337--3k49)

Support larger email templates on MySQL using `MEDIUMTEXT` which supports up to `16M`.

Thanks to [@darkeagle1337](https://github.com/darkeagle1337)!

[1788](https://github.com/FusionAuth/fusionauth-issues/issues/1788)

[Enhancement](#enhancement--issue-1792--jmsf)

Improvements to the OAuth2 Logout endpoint correctly supporting the `POST` method in addition to `GET`, and allowing an expired `id_token` in `id_token_hint`.

[1792](https://github.com/FusionAuth/fusionauth-issues/issues/1792)

[Enhancement](#enhancement--issue-1812--na7d)

Webhooks are now scoped to one or more tenants.

[1812](https://github.com/FusionAuth/fusionauth-issues/issues/1812)

[Enhancement](#enhancement--411d)

Any API response that returns a Refresh Token will now also return a `refresh_token_id` (or `refreshTokenId`), useful for identifying a refresh token for revocation.

[Enhancement](#enhancement--z7rh)

The Access Token will contain a new claim named `sid` which is the immutable identifier Refresh Token.

[Enhancement](#enhancement--8yr4)

When available the Refresh Token is now returned in the `JWTRefreshTokenRevokeEvent` event in the `refreshToken` field.

[Enhancement](#enhancement--dboe)

The Login Ping API may now optionally take the request as a POST body.

[New Feature](#new-feature--issue-763--tf3t)

Application scoped Multi-Factor authentication allowing an application to choose to participate in MFA with a separate TTL.

[763](https://github.com/FusionAuth/fusionauth-issues/issues/763)

[New Feature](#new-feature--issue-1551--thanks-epbensimpson--3m9r)

Optionally disable the IdP linking strategy for an Identity Provider.

Thanks to [@epbensimpson](https://github.com/epbensimpson)!

[1551](https://github.com/FusionAuth/fusionauth-issues/issues/1551)

[New Feature](#new-feature--1fgh)

Added `fusionauth-app.http.read-timeout` to the configuration to optionally set the maximum read timeout.

[Internal](#internal--issue-1671--lgey)

Remove Apache Tomcat as the underlying application server, in favor of a more modern HTTP server based upon Netty.

[1671](https://github.com/FusionAuth/fusionauth-issues/issues/1671)

## Version 1.36.8

4 July 2022

[Fix](#fix--issue-1774--lft9)

Fixed the placeholder text in the entity grants search field.

[1774](https://github.com/FusionAuth/fusionauth-issues/issues/1774)

[Fix](#fix--issue-1775--n0fx)

Corrected the SCIM HTTP response code when a new resource was created to be `201`.

[1775](https://github.com/FusionAuth/fusionauth-issues/issues/1775)

[Fix](#fix--issue-1776--sbqo)

Corrected the SCIM HTTP response code when a duplicate resource was attempted to be created to be `409`.

[1776](https://github.com/FusionAuth/fusionauth-issues/issues/1776)

## Version 1.36.7

23 June 2022

[Security](#security--issue-1766--thanks-gnarlium--qati)

Ensured the provided `client_id` matched the Application represented by the Refresh Token when performing a Refresh grant.

Thanks to [@gnarlium](https://github.com/gnarlium)!

[1766](https://github.com/FusionAuth/fusionauth-issues/issues/1766)

[Fix](#fix--issue-1654--2eoe)

Fixed an issue where the initial "start" phase of a user action triggered by a failed login configuration was not sent.

[1654](https://github.com/FusionAuth/fusionauth-issues/issues/1654)

[Fix](#fix--issue-1723--nxov)

Fixed an issue where FusionAuth failed to complete the logout request when a SAML v2 SP used an HTTP redirect binding.

[1723](https://github.com/FusionAuth/fusionauth-issues/issues/1723)

[Fix](#fix--issue-1765--gnbj)

Fixed a timing issue where under the load of creating logins and deleting applications programmatically, a login record got stuck in the queue.

[1765](https://github.com/FusionAuth/fusionauth-issues/issues/1765)

[Fix](#fix--issue-1769--50e7)

Corrected the `Content-Type` HTTP response header returned from the SCIM endpoints.

[1769](https://github.com/FusionAuth/fusionauth-issues/issues/1769)

## Version 1.36.6

16 June 2022

[Fix](#fix--issue-1758--16y3)

Fixed an issue where a user was able to login successfully after being rate limited, but prior to the end of the configured time period.

[1758](https://github.com/FusionAuth/fusionauth-issues/issues/1758)

[Fix](#fix--issue-1759--41st)

Fixed an issue when using a JWT Populate lambda and modifying the default value of the `aud` claim to be an array instead of a string value.

[1759](https://github.com/FusionAuth/fusionauth-issues/issues/1759)

## Version 1.36.5

13 June 2022

[Security](#security--issue-1672--r437)

Upgraded Java to get the patch for `CVE-2022-21449`.

[1672](https://github.com/FusionAuth/fusionauth-issues/issues/1672)

[Security](#security--issue-1750--bx3s)

Fixed validation of the Oauth2 Logout endpoint when using the `post_logout_redirect` parameter.

[1750](https://github.com/FusionAuth/fusionauth-issues/issues/1750)

[Fix](#fix--issue-1706--bvjr)

Fixed a UI bug that caused the application column to show "Single sign-on" instead of the Application name in the Session tab.

[1706](https://github.com/FusionAuth/fusionauth-issues/issues/1706)

[Fix](#fix--issue-1708--thanks-chimericdream--8dz5)

Fixed an issue where a user was not routed to the Complete Registration step correctly after completing the Two-Factor challenge.

Thanks to [@chimericdream](https://github.com/chimericdream)!

[1708](https://github.com/FusionAuth/fusionauth-issues/issues/1708)

[Fix](#since-1-36-0--fix--issue-1728--sk7k)

Fixed an issue where the `displayName` property on the Link a User API was ignored.

Since: [1.36.0](#version-1-36-0)

[1728](https://github.com/FusionAuth/fusionauth-issues/issues/1728)

[Fix](#fix--issue-1731--thanks-atakane--ax24)

Fixed an issue where a 3rd party Web Application Firewall such as CloudFlare injected JavaScript into the `head` element.

Thanks to [@atakane](https://github.com/atakane)!

[1731](https://github.com/FusionAuth/fusionauth-issues/issues/1731)

[Internal](#internal--issue-1672--yjx6)

Upgraded to the latest Java 17 LTS (from `17.0.1+12` to `17.0.3+7`).

[1672](https://github.com/FusionAuth/fusionauth-issues/issues/1672)

## Version 1.36.4

21 April 2022

[Security](#security--issue-1694--66k8)

Proactively patched Java `CVE-2022-21449` manually within FusionAuth until the patched release of Java became available.

[1694](https://github.com/FusionAuth/fusionauth-issues/issues/1694)

## Version 1.36.3

19 April 2022

[Fix](#since-1-36-2--fix--issue-1688--10sd)

Identified and resolved an additional edge case regarding the `auth_time` claim precision fix.

Since: [1.36.2](#version-1-36-2)

[1688](https://github.com/FusionAuth/fusionauth-issues/issues/1688)

## Version 1.36.2

14 April 2022

[Fix](#fix--issue-1687--lfxr)

Fixed an issue where 3rd party libraries validating the `id_token` incorrectly identified it as expired due to `auth_time` claim precision loss.

[1687](https://github.com/FusionAuth/fusionauth-issues/issues/1687)

## Version 1.36.1

14 April 2022

[Fix](#fix--issue-1579--qugh)

Fixed an issue where selecting an entity in a tenant other than the user's tenant caused an exception when building an entity grant in the UI.

[1579](https://github.com/FusionAuth/fusionauth-issues/issues/1579)

[Fix](#fix--issue-1683--ldpr)

Fixed an issue where creating an empty directory in the FusionAuth plugin directory caused the legitimate plugin jar to fail to load.

[1683](https://github.com/FusionAuth/fusionauth-issues/issues/1683)

[Fix](#fix--issue-1686--1jqz)

Fixed an issue where expected permissions were not returned as part of the access token claims when using the Client Credentials Grant.

[1686](https://github.com/FusionAuth/fusionauth-issues/issues/1686)

## Version 1.36.0

7 April 2022

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-36-1--known-issue--addx)

Creating an empty directory in the FusionAuth plugin directory caused the legitimate plugin jar to fail to load.

[Known Issue](#v-1-36-1--known-issue--28rl)

Permissions were omitted from the access token claims when using the Client Credentials Grant and omitting the permissions from the `target-entity:` scope.

[Known Issue](#v-1-36-3--known-issue--qas5)

Tokens produced by the `openid` scope were incorrectly identified as expired due to `auth_time` claim precision loss after a refresh token was used.

[Security](#security--issue-1632--jowv)

Ensured that the Change Password identifier was revoked if an API was used to change a user's password after initiating a change password request.

[1632](https://github.com/FusionAuth/fusionauth-issues/issues/1632)

[Breaking Change](#breaking-change--issue-1646--jmgu)

Removed support for the JWT authorization method when using the `GET` method on the Retrieve Refresh Tokens API (required API key instead).

[1646](https://github.com/FusionAuth/fusionauth-issues/issues/1646)

[Breaking Change](#breaking-change--issue-1669--7t0s)

Updated reserved JWT claims by grant type, including new `amr`, `tid`, and `gty` claims.

[1669](https://github.com/FusionAuth/fusionauth-issues/issues/1669)

[New Feature](#new-feature--issue-106--c90d)

Added initial technology preview for SCIM Server (Enterprise plan feature).

[106](https://github.com/FusionAuth/fusionauth-issues/issues/106)

[New Feature](#new-feature--issue-1206--s390)

Added Nintendo Online Identity Provider support.

[1206](https://github.com/FusionAuth/fusionauth-issues/issues/1206)

[New Feature](#new-feature--issue-1589--cz53)

Added new Identity Provider Link & Unlink Events.

[1589](https://github.com/FusionAuth/fusionauth-issues/issues/1589)

[New Feature](#new-feature--issue-1644--rieb)

Defaulted the Event Transaction Type in the Tenant configuration to `None`.

[1644](https://github.com/FusionAuth/fusionauth-issues/issues/1644)

[Fix](#fix--issue-1278--thanks-pakomp--tsf1)

Fixed an issue where the requested `AssertionConsumerServiceURL` in a SAML v2 `AuthNRequest` was ignored.

Thanks to [@pakomp](https://github.com/pakomp)!

[1278](https://github.com/FusionAuth/fusionauth-issues/issues/1278)

[Fix](#fix--issue-1480--thanks-matthewhartstonge--rxi1)

Removed the limitation where Entities did not support the use of `:` in the permission name.

Thanks to [@matthewhartstonge](https://github.com/matthewhartstonge)!

[1480](https://github.com/FusionAuth/fusionauth-issues/issues/1480)

[Fix](#fix--issue-1575--qtg8)

Fixed an issue where an application role was not immediately available to assign to a user after initial creation.

[1575](https://github.com/FusionAuth/fusionauth-issues/issues/1575)

[Fix](#fix--issue-1585--5l5j)

Fixed an issue where the Password Grant response was missing the Two-Factor Method Ids when a Two-Factor challenge was required.

[1585](https://github.com/FusionAuth/fusionauth-issues/issues/1585)

[Fix](#fix--issue-1593--1rnz)

Fixed an issue where the Tenant edit and add panel displayed Webhook events that were not configured at the Tenant level.

[1593](https://github.com/FusionAuth/fusionauth-issues/issues/1593)

[Fix](#fix--issue-1624--thanks-james-m-oswald--m2k6)

Fixed an issue where FusionAuth failed to start on Windows when using the `startup.bat` script.

Thanks to [@James-M-Oswald](https://github.com/James-M-Oswald)!

[1624](https://github.com/FusionAuth/fusionauth-issues/issues/1624)

[Fix](#fix--issue-1625--thanks-pablomadrigal--cc3a)

Enhanced email validation to prevent obviously incorrect emails from being used during self-service user registration.

Thanks to [@pablomadrigal](https://github.com/pablomadrigal)!

[1625](https://github.com/FusionAuth/fusionauth-issues/issues/1625)

[Fix](#fix--issue-1630--j89c)

Fixed an issue where ECMA 6 features such as `const` or `let` could not be used with the GraalJS Lambda engine.

[1630](https://github.com/FusionAuth/fusionauth-issues/issues/1630)

[Fix](#fix--issue-1633--oh8l)

Fixed a timing issue with Connectors that caused a login to fail.

[1633](https://github.com/FusionAuth/fusionauth-issues/issues/1633)

[Fix](#fix--issue-1642--rbug)

Fixed an issue where the Tenant View dialog showed the incorrect Event transaction setting for a Tenant created via the API.

[1642](https://github.com/FusionAuth/fusionauth-issues/issues/1642)

[Fix](#fix--issue-1643--hhyd)

Fixed an issue where the resulting `id_token` was signed with the key configured for the `access_token` when the `openid` scope was used.

[1643](https://github.com/FusionAuth/fusionauth-issues/issues/1643)

[Fix](#fix--issue-1655--v7xk)

Ignored read-only directories inside of the configured plugin directory instead of throwing an exception.

[1655](https://github.com/FusionAuth/fusionauth-issues/issues/1655)

[Enhancement](#enhancement--issue-1659--4ld2)

Added a separate execute thread pool in the Apache Tomcat configuration to separate incoming requests from localhost callback requests.

[1659](https://github.com/FusionAuth/fusionauth-issues/issues/1659)

[Enhancement](#enhancement--issue-1663--hfnn)

Allowed for plugins that required dependent jars in their classpath.

[1663](https://github.com/FusionAuth/fusionauth-issues/issues/1663)

[Enhancement](#enhancement--issue-1666--ql83)

Minimized the duration of the database Transaction during authentication to improve login performance.

[1666](https://github.com/FusionAuth/fusionauth-issues/issues/1666)

[Enhancement](#enhancement--issue-1668--5i4w)

Alphabetized the Applications in Select form controls in the admin UI.

[1668](https://github.com/FusionAuth/fusionauth-issues/issues/1668)

[Enhancement](#enhancement--issue-1673--g2cl)

Allowed a login using a 3rd party IdP such as Google to succeed even if an Elasticsearch exception occurred.

[1673](https://github.com/FusionAuth/fusionauth-issues/issues/1673)

[Internal](#internal--issue-1620--34sw)

Updated Apache Tomcat from `8.5.72` to `8.5.77`.

[1620](https://github.com/FusionAuth/fusionauth-issues/issues/1620)

## Version 1.35.0

10 March 2022

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-1597--thanks-gkrothammer--o9qq)

Fixed an issue where the FastPath install failed to download Java on Windows when using the `startup.bat` script.

Thanks to [@gkrothammer](https://github.com/gkrothammer)!

[1597](https://github.com/FusionAuth/fusionauth-issues/issues/1597)

[Fix](#fix--issue-1609--nrzq)

Fixed an issue where using the Identity Provider Link API with multiple tenants failed unless the tenant Id was specified.

[1609](https://github.com/FusionAuth/fusionauth-issues/issues/1609)

[Fix](#fix--issue-1617--thanks-pablomadrigal--hbhe)

Fixed an issue where self-service registration failed to validate an email address beginning with `@`.

Thanks to [@pablomadrigal](https://github.com/pablomadrigal)!

[1617](https://github.com/FusionAuth/fusionauth-issues/issues/1617)

[Fix](#fix--issue-1623--b6yw)

Fixed an issue where using the Passwordless API failed if OAuth2 state parameters were omitted and the user was not registered.

[1623](https://github.com/FusionAuth/fusionauth-issues/issues/1623)

[New Feature](#new-feature--issue-267--ybb6)

Introduced the initial technology preview for HTTP requests within a lambda function (Lambda HTTP Connect), setting GraalJS as the default engine.

[267](https://github.com/FusionAuth/fusionauth-issues/issues/267)

## Version 1.34.1

23 February 2022

[Fix](#fix--issue-1606--thanks-kristianvld--3qb7)

Fixed an exception that caused SAML v2 Logins to FusionAuth to fail.

Thanks to [@kristianvld](https://github.com/kristianvld)!

[1606](https://github.com/FusionAuth/fusionauth-issues/issues/1606)

## Version 1.34.0

21 February 2022

[Known Issue](#v-1-34-1--known-issue--via-1606--1kj0)

SAML v2 Logins to FusionAuth failed due to an exception.

Resolved in version [1.34.1](#version-1-34-1) via [1606](https://github.com/FusionAuth/fusionauth-issues/issues/1606).

[Breaking Change](#breaking-change--issue-1595--q40m)

Changed the OpenID Connect identity provider client authentication to strictly adhere to specifications, preventing `client_id` in the request body.

[1595](https://github.com/FusionAuth/fusionauth-issues/issues/1595)

[Breaking Change](#breaking-change--issue-1598--6oq2)

Utilized PKCE anytime FusionAuth initiated an Authorization Code grant to FusionAuth.

[1598](https://github.com/FusionAuth/fusionauth-issues/issues/1598)

[Breaking Change](#breaking-change--issue-1577--s3xb)

Changed the interactive Setup Wizard to check the FusionAuth newsletter sign-up box by default (opt-out instead of opt-in).

[1577](https://github.com/FusionAuth/fusionauth-issues/issues/1577)

[New Feature](#new-feature--issue-1604--nera)

Added native support for PBKDF2 using a 512-bit derived key length.

[1604](https://github.com/FusionAuth/fusionauth-issues/issues/1604)

[Security](#security--issue-1600--ugbe)

Resolved a potential vulnerability in the IdP Link API affecting configurations using the `CreatePendingLink` linking strategy.

[1600](https://github.com/FusionAuth/fusionauth-issues/issues/1600)

## Version 1.33.0

7 February 2022

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Security](#security--issue-1520--tzei)

Added `-Dlog4j2.formatMsgNoLookups=true` to the `fusionauth-search` bundled version of Elasticsearch to proactively address CVE-2021-44228.

[1520](https://github.com/FusionAuth/fusionauth-issues/issues/1520)

[Security](#security--issue-1535--ngtx)

Updated the PostgreSQL JDBC driver from version `42.2.22` to `42.3.2` to patch CVE-2022-21724.

[1535](https://github.com/FusionAuth/fusionauth-issues/issues/1535)

[Security](#security--issue-1530--qgy6)

Proactively upgraded Logback to incorporate additional hardening added by the Logback team.

[1530](https://github.com/FusionAuth/fusionauth-issues/issues/1530)

[Security](#security--issue-1549--nywd)

Provided better protection against malicious actors that had access to configuring Themed templates.

[1549](https://github.com/FusionAuth/fusionauth-issues/issues/1549)

[Security](#security--issue-1591--1z95)

Ensured a Two-Factor challenge was enforced before changing a password using the Change Password API.

[1591](https://github.com/FusionAuth/fusionauth-issues/issues/1591)

[Breaking Change](#breaking-change--issue-1591--d1ha)

Required obtaining a Trust Token from the Two-Factor Login API to use the Change Password API for users with Two-Factor enabled.

[1591](https://github.com/FusionAuth/fusionauth-issues/issues/1591)

[Fix](#fix--issue-1519--ir24)

Fixed an issue where the FastPath install failed to download Java due to missing redirect support in `curl`.

[1519](https://github.com/FusionAuth/fusionauth-issues/issues/1519)

[Fix](#fix--issue-1521--qhht)

Ensured proper handling of Login records containing more than one IP address from the `X-Forwarded-For` header.

[1521](https://github.com/FusionAuth/fusionauth-issues/issues/1521)

[Fix](#fix--issue-1526--f7e8)

Fixed an issue where the Login with Apple button failed on Safari iOS 12.

[1526](https://github.com/FusionAuth/fusionauth-issues/issues/1526)

[Fix](#fix--issue-1501--27t8)

Fixed pagination resets in the Event Log, Audit Log, and Login Records search feature.

[1501](https://github.com/FusionAuth/fusionauth-issues/issues/1501)

[Fix](#fix--issue-1432--exif)

Ensured Group Membership was preserved after the first login request when using a Connector without migration.

[1432](https://github.com/FusionAuth/fusionauth-issues/issues/1432)

[Fix](#fix--issue-1522--thanks-timvanherwijnen--xdwn)

Fixed an issue where the `jwt.refresh-token.revoke` event was not sent during a request to the Logout API.

Thanks to [@TimVanHerwijnen](https://github.com/TimVanHerwijnen)!

[1522](https://github.com/FusionAuth/fusionauth-issues/issues/1522)

[Fix](#fix--issue-1259--1wor)

Fixed display issues for consents during the complete registration step.

[1259](https://github.com/FusionAuth/fusionauth-issues/issues/1259)

[Fix](#fix--issue-1490--20hy)

Provided better support for `user.birthDate` when using Advanced self-service registration with Family child registration.

[1490](https://github.com/FusionAuth/fusionauth-issues/issues/1490)

[Fix](#fix--issue-1131--ynv4)

Fixed an issue where the order of multiple preferred languages was not preserved.

[1131](https://github.com/FusionAuth/fusionauth-issues/issues/1131)

[Fix](#fix--issue-1548--h1ko)

Fixed a potential memory leak in the Email services.

[1548](https://github.com/FusionAuth/fusionauth-issues/issues/1548)

[Fix](#fix--issue-1550--6oz1)

Fixed an issue where the `parentEmail` field was not properly updated in the search index during a Family workflow.

[1550](https://github.com/FusionAuth/fusionauth-issues/issues/1550)

[Fix](#fix--issue-1560--ygng)

Fixed unexpected validation errors when transitioning from Basic to Advanced Self-Service registration.

[1560](https://github.com/FusionAuth/fusionauth-issues/issues/1560)

[Fix](#fix--issue-1559--dq0s)

Fixed edge cases where a tenant got stuck in the Pending Delete state.

[1559](https://github.com/FusionAuth/fusionauth-issues/issues/1559)

[Enhancement](#enhancement--issue-1531--qhnp)

Added host architecture and operating system details to the About panel in the admin UI.

[1531](https://github.com/FusionAuth/fusionauth-issues/issues/1531)

[Enhancement](#enhancement--issue-1542--yrii)

Added a tooltip to the Webhook Application configuration to reduce confusion.

[1542](https://github.com/FusionAuth/fusionauth-issues/issues/1542)

[Enhancement](#enhancement--issue-1541--gy9e)

Supported longer Refresh Tokens on the Refresh Tokens Import API (increased from 191 characters).

[1541](https://github.com/FusionAuth/fusionauth-issues/issues/1541)

[Enhancement](#enhancement--issue-1500--1p9w)

Used a better thread pooling strategy for Webhooks to handle large volumes of events.

[1500](https://github.com/FusionAuth/fusionauth-issues/issues/1500)

[Enhancement](#enhancement--issue-1555--281y)

Improved licensing errors to better differentiate between unlicensed installations and features requiring specific licensed plans.

[1555](https://github.com/FusionAuth/fusionauth-issues/issues/1555)

[Enhancement](#enhancement--issue-1309--tdr7)

Added `tokenExpirationInstant` to the Login Response.

[1309](https://github.com/FusionAuth/fusionauth-issues/issues/1309)

[Enhancement](#enhancement--issue-1561--h261)

Added User API validation in support of Family configurations with child registration restrictions.

[1561](https://github.com/FusionAuth/fusionauth-issues/issues/1561)

[Enhancement](#enhancement--issue-1532--mlo6)

Added support for ARM 64 architectures (Apple M1, AWS Graviton, etc.).

*Thanks to many of our community superstars for the help with this one! [@rscheuermann](https://github.com/rscheuermann), [@jerryhopper](https://github.com/jerryhopper), [@ceefour](https://github.com/ceefour), [@dmitryzan](https://github.com/dmitryzan).*

[1532](https://github.com/FusionAuth/fusionauth-issues/issues/1532)[49](https://github.com/FusionAuth/fusionauth-issues/issues/49)

[Enhancement](#enhancement--issue-1571--s3wa)

Added the option to use `userId` on the Start Two-Factor API.

[1571](https://github.com/FusionAuth/fusionauth-issues/issues/1571)

[Enhancement](#enhancement--issue-1214--3lb7)

Moved `changePasswordId` to the request body during a POST request.

[1214](https://github.com/FusionAuth/fusionauth-issues/issues/1214)

## Version 1.32.1

13 December 2021

[Fix](#fix--issue-1517--thanks-oceanswave--5euy)

Fixed an issue where Identity Provider Reconcile Lambdas were invoked more than once, potentially modifying or losing User registration data.

Thanks to [@Oceanswave](https://github.com/Oceanswave)!

[1517](https://github.com/FusionAuth/fusionauth-issues/issues/1517)

[Fix](#fix--issue-1518--phm5)

Fixed a missing Java module in the `1.32.0` Docker image that caused startup failures.

[1518](https://github.com/FusionAuth/fusionauth-issues/issues/1518)

## Version 1.32.0

10 December 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--issue-1202--nljf)

Upgraded FusionAuth to run on Java 17, deprecating support for legacy XML signature algorithms used by older SAML v2 IdPs.

[1202](https://github.com/FusionAuth/fusionauth-issues/issues/1202)

[New Feature](#new-feature--issue-628--thanks-arni-inaba--3gze)

Allowed optional custom SMTP headers in the Tenant email configuration.

Thanks to [@arni-inaba](https://github.com/arni-inaba)!

[628](https://github.com/FusionAuth/fusionauth-issues/issues/628)

[Enhancement](#enhancement--issue-1310--i4vc)

Allowed Identity provider linking to optionally limit the number of unique links to an IdP for a particular user.

[1310](https://github.com/FusionAuth/fusionauth-issues/issues/1310)

[Enhancement](#enhancement--issue-1443--thanks-bonify-b2b--48x3)

Allowed application URIs to be configured as OAuth2 Authorized request origin URLs.

Thanks to [@bonify-b2b](https://github.com/bonify-b2b)!

[1443](https://github.com/FusionAuth/fusionauth-issues/issues/1443)

[Enhancement](#enhancement--issue-1467--thanks-lliu-20200701--7dyh)

Added configuration to allow implicit email verification to be disabled.

Thanks to [@lliu-20200701](https://github.com/lliu-20200701)!

[1467](https://github.com/FusionAuth/fusionauth-issues/issues/1467)

[Enhancement](#enhancement--issue-1495--iriz)

Added a notice on the Device workflow panel to allow users to optionally logout if an existing SSO session existed.

[1495](https://github.com/FusionAuth/fusionauth-issues/issues/1495)

[Fix](#fix--issue-1498--my0o)

Fixed an issue where global and application registration count rollups failed when using PostgreSQL.

[1498](https://github.com/FusionAuth/fusionauth-issues/issues/1498)

[Fix](#fix--issue-1514--x0qp)

Fixed an issue where the Development Reset feature failed when a specific theme was configured.

[1514](https://github.com/FusionAuth/fusionauth-issues/issues/1514)

[Internal](#internal--iczv)

Upgraded to Java 17 LTS.

## Version 1.31.0

18 November 2021

[Known Issue](#v-1-32-1--known-issue--via-1517--w57i)

Modifying the user email or username in an Identity Provider Reconcile Lambda invoked the lambda more than once, causing data loss.

Resolved in version [1.32.1](#version-1-32-1) via [1517](https://github.com/FusionAuth/fusionauth-issues/issues/1517).

[Breaking Change](#breaking-change--issue-1425--u4tz)

Allowed modification or fabrication of an email or username in the Identity Provider Reconcile Lambda regardless of Identity Provider type.

[1425](https://github.com/FusionAuth/fusionauth-issues/issues/1425)

[Fix](#fix--issue-702--2a30)

Fixed an exception that occurred when requiring a birthdate and a parent email on a self-service registration form.

[702](https://github.com/FusionAuth/fusionauth-issues/issues/702)

[Fix](#fix--issue-978--wqgl)

Improved locale handling to support locales beyond ISO 639 (e.g., `es_419`, `aghem`).

[978](https://github.com/FusionAuth/fusionauth-issues/issues/978)

[Fix](#fix--issue-1123--dspw)

Fixed an issue where disabling webhooks from the tenant configuration table header did not work.

[1123](https://github.com/FusionAuth/fusionauth-issues/issues/1123)

[Fix](#fix--issue-1171--6zl9)

Fixed general message template issues when previewing templates or localized versions.

[1171](https://github.com/FusionAuth/fusionauth-issues/issues/1171)

[Fix](#fix--issue-1397--thanks-miaucl--3lny)

Corrected length validation for API keys created via Kickstart.

Thanks to [@miaucl](https://github.com/miaucl)!

[1397](https://github.com/FusionAuth/fusionauth-issues/issues/1397)

[Fix](#fix--issue-1446--o65a)

Allowed theme customization for the error message returned when a webhook failed during Self-Service Registration.

[1446](https://github.com/FusionAuth/fusionauth-issues/issues/1446)

[Fix](#fix--issue-1448--npq7)

Fixed an issue where the Theme preview failed to render the Account Edit page for Self-Service forms.

[1448](https://github.com/FusionAuth/fusionauth-issues/issues/1448)

[Fix](#fix--issue-1449--5tft)

Fixed the inability to delete an email template when it was not assigned to a Consent.

[1449](https://github.com/FusionAuth/fusionauth-issues/issues/1449)

[Fix](#since-1-30-2--fix--issue-1452--thanks-johnmaia--fjx2)

Fixed a timing issue when registering a user immediately after creating a new Application role.

Since: [1.30.2](#version-1-30-2)

Thanks to [@johnmaia](https://github.com/johnmaia)!

[1452](https://github.com/FusionAuth/fusionauth-issues/issues/1452)

[Fix](#since-1-27-0--fix--issue-1456--thanks-rscheuermann--66hn)

Fixed an infinite redirect loop caused by using an expired Passwordless link.

Since: [1.27.0](#version-1-27-0)

Thanks to [@rscheuermann](https://github.com/rscheuermann)!

[1456](https://github.com/FusionAuth/fusionauth-issues/issues/1456)

[Fix](#fix--issue-1457--j0nw)

Added missing validation to ensure the User existed by Id on the Registration API.

[1457](https://github.com/FusionAuth/fusionauth-issues/issues/1457)

[Fix](#fix--issue-1459--tp9v)

Ensured Blocked domain configurations were preserved when copying a Tenant in the admin UI.

[1459](https://github.com/FusionAuth/fusionauth-issues/issues/1459)

[Fix](#fix--issue-1462--qnx0)

Ensured the resulting JWT contained the `aud` claim when using the OAuth2 Password grant with `client_id` in the HTTP Basic Authorization header.

[1462](https://github.com/FusionAuth/fusionauth-issues/issues/1462)

[Fix](#since-1-30-2--fix--issue-1466--z8ks)

Fixed a database foreign key violation in the Registration Count aggregation service if a Tenant was deleted before the aggregator ran.

Since: [1.30.2](#version-1-30-2)

[1466](https://github.com/FusionAuth/fusionauth-issues/issues/1466)

[Fix](#fix--issue-1470--7rwj)

Fixed QR code rendering failures for Two-Factor authentication when the encoded string length was between 192 and 220 characters.

[1470](https://github.com/FusionAuth/fusionauth-issues/issues/1470)

[Fix](#since-1-30-2--fix--issue-1473--qede)

Ensured roles assigned by Group membership were returned when users were also explicitly assigned roles.

Since: [1.30.2](#version-1-30-2)

[1473](https://github.com/FusionAuth/fusionauth-issues/issues/1473)

[Fix](#fix--issue-1476--lwpo)

Fixed an issue where the Setup Password email template included an erroneous `client_id` when used via the User Registration API.

[1476](https://github.com/FusionAuth/fusionauth-issues/issues/1476)

[Fix](#fix--issue-1496--j9p1)

Fixed a signature validation failure when a SAML v2 SP used lower case percent encoding in the query string.

*Thanks to the engineering team at [HAProxy](https://www.haproxy.com/) for the assist!*

[1496](https://github.com/FusionAuth/fusionauth-issues/issues/1496)

[Enhancement](#enhancement--issue-323--thanks-thammada--h2ld)

Allowed access to the `id_token` when available during an OpenID Connect Reconcile lambda.

Thanks to [@Thammada](https://github.com/Thammada)!

[323](https://github.com/FusionAuth/fusionauth-issues/issues/323)

[Enhancement](#enhancement--issue-1306--ucdu)

Added additional support for `idp_hint` for Apple and Twitter Identity Providers.

[1306](https://github.com/FusionAuth/fusionauth-issues/issues/1306)

[Enhancement](#enhancement--issue-1360--z1pn)

Added example user details to the Audit Log Test event in the Webhook Tester.

[1360](https://github.com/FusionAuth/fusionauth-issues/issues/1360)

[Enhancement](#enhancement--issue-1417--cejb)

Produced an Event Log when FusionAuth was unable to discover OpenID endpoints using the configured Issuer.

[1417](https://github.com/FusionAuth/fusionauth-issues/issues/1417)

[Internal](#internal--issue-1461--e98e)

Updated the internal scheduler library.

[1461](https://github.com/FusionAuth/fusionauth-issues/issues/1461)

## Version 1.30.2

13 October 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-1316--ndl2)

Fixed an exception occurring when logging in with an anonymous user from an IdP that had its linking strategy changed.

[1316](https://github.com/FusionAuth/fusionauth-issues/issues/1316)

[Fix](#fix--issue-1324--8yb5)

Fixed a FreeMarker exception that prevented the view dialog for a SAML v2 IdP Initiated configuration from completely rendering.

[1324](https://github.com/FusionAuth/fusionauth-issues/issues/1324)

[Fix](#fix--issue-1358--g06y)

Fixed an issue where activating FusionAuth Reactor via Kickstart with CAPTCHA enabled prevented login until Threat Detection came online.

[1358](https://github.com/FusionAuth/fusionauth-issues/issues/1358)

[Fix](#fix--issue-1362--thanks-ryandennis2018--ojz8)

Fixed the .NET client library's handling of `exp` and other JWT timestamp values.

Thanks to [@RyanDennis2018](https://github.com/RyanDennis2018)!

[1362](https://github.com/FusionAuth/fusionauth-issues/issues/1362)

[Fix](#since-1-28-0--fix--issue-1366--9p3f)

Fixed an exception when duplicating an Application that had SAML v2 configured but not enabled.

Since: [1.28.0](#version-1-28-0)

[1366](https://github.com/FusionAuth/fusionauth-issues/issues/1366)

[Fix](#fix--issue-1367--1j2u)

Fixed a regression where updating a connector added an additional `*` domain configuration.

[1367](https://github.com/FusionAuth/fusionauth-issues/issues/1367)

[Fix](#fix--issue-1368--6ggy)

Fixed the inability to specify a certain Id when generating an RSA Key.

[1368](https://github.com/FusionAuth/fusionauth-issues/issues/1368)

[Fix](#fix--issue-1369--62og)

Fixed an issue where users got stuck in the Setup Wizard if advanced threat detection was enabled via kickstart.

[1369](https://github.com/FusionAuth/fusionauth-issues/issues/1369)

[Fix](#since-1-30-0--fix--issue-1371--2g6r)

Fixed the inability to delete entries from an access control list using the admin UI.

Since: [1.30.0](#version-1-30-0)

[1371](https://github.com/FusionAuth/fusionauth-issues/issues/1371)

[Fix](#fix--issue-1373--49wg)

Restored default lambdas in Kickstart environment variables (regression introduced in 1.30.0).

[1373](https://github.com/FusionAuth/fusionauth-issues/issues/1373)

[Fix](#fix--issue-1375--tbcp)

Ensured complete event payloads for user deactivations initiated via the admin UI.

[1375](https://github.com/FusionAuth/fusionauth-issues/issues/1375)

[Fix](#fix--issue-1382--t87t)

Fixed a NullPointerException occurring during an upgrade if Kickstart, maintenance mode, and default tenant Id modification coincided.

[1382](https://github.com/FusionAuth/fusionauth-issues/issues/1382)

[Fix](#fix--issue-1391--5dms)

Fixed an issue where the IP address was missing from login records in certain circumstances.

[1391](https://github.com/FusionAuth/fusionauth-issues/issues/1391)

[Fix](#fix--issue-1392--vwxt)

Fixed NumberFormatExceptions caused by IPv6 addresses.

[1392](https://github.com/FusionAuth/fusionauth-issues/issues/1392)

[Fix](#fix--issue-1396--ds8k)

Fixed CAPTCHA functionality on the email verification required page.

[1396](https://github.com/FusionAuth/fusionauth-issues/issues/1396)

[Fix](#fix--issue-1398--ge6d)

Fixed rendering of the passwordValidationRules object on the register page in theme preview.

[1398](https://github.com/FusionAuth/fusionauth-issues/issues/1398)

[Fix](#fix--issue-1399--fumh)

Fixed an empty value in the User search widget if the user lacked a name.

[1399](https://github.com/FusionAuth/fusionauth-issues/issues/1399)

[Fix](#fix--issue-1400--997d)

Ensured device trust was saved after filling out a CAPTCHA.

[1400](https://github.com/FusionAuth/fusionauth-issues/issues/1400)

[Fix](#fix--issue-1402--d8x5)

Fixed the Setup Wizard displaying in a multi-node environment after it had completed.

[1402](https://github.com/FusionAuth/fusionauth-issues/issues/1402)

[Fix](#fix--issue-1407--sh0o)

Allowed setting the rate limit configuration to 1 for advanced threat detection.

[1407](https://github.com/FusionAuth/fusionauth-issues/issues/1407)

[Fix](#fix--issue-1422--xagx)

Displayed custom data for webhooks in the admin UI.

[1422](https://github.com/FusionAuth/fusionauth-issues/issues/1422)

[Fix](#fix--issue-1424--xgv9)

Improved handling of truncated deflated SAML AuthN requests.

[1424](https://github.com/FusionAuth/fusionauth-issues/issues/1424)

[Fix](#fix--issue-1430--s4t4)

Made all key pairs capable of signing a SAML request eligible in the UI.

[1430](https://github.com/FusionAuth/fusionauth-issues/issues/1430)

[Fix](#fix--issue-1435--e481)

Displayed custom data for connectors in the admin UI.

[1435](https://github.com/FusionAuth/fusionauth-issues/issues/1435)

[Enhancement](#enhancement--issue-480--thanks-nikos--cmqc)

Improved retrieval performance for MySQL databases with large numbers of applications and application roles.

Thanks to [@nikos](https://github.com/nikos)!

[480](https://github.com/FusionAuth/fusionauth-issues/issues/480)

[Enhancement](#enhancement--issue-1145--thanks-nulian--t7n5)

Improved the performance of the Public Key API endpoint for instances with many applications and keys.

Thanks to [@nulian](https://github.com/nulian) and [@Johpie](https://github.com/Johpie)!

[1145](https://github.com/FusionAuth/fusionauth-issues/issues/1145)

[Enhancement](#enhancement--issue-1390--28sa)

Displayed the database and Elasticsearch versions in the admin UI.

[1390](https://github.com/FusionAuth/fusionauth-issues/issues/1390)

[Enhancement](#enhancement--issue-1415--netf)

Improved User and Registration API performance at scale.

[1415](https://github.com/FusionAuth/fusionauth-issues/issues/1415)

[Enhancement](#enhancement--issue-1426--dv6e)

Attempted to support SAML POST bindings with SSO even when cookie `SameSite` policy was set to `SameSite=Lax`.

[1426](https://github.com/FusionAuth/fusionauth-issues/issues/1426)

[Enhancement](#enhancement--issue-1428--szey)

Added a default NameID format when one was omitted from SAML AuthN or Logout requests.

[1428](https://github.com/FusionAuth/fusionauth-issues/issues/1428)

[Internal](#internal--issue-1433--gu28)

Updated Apache Tomcat from `8.5.63` to `8.5.72`.

[1433](https://github.com/FusionAuth/fusionauth-issues/issues/1433)

## Version 1.30.1

25 August 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-30-2--known-issue--via-1498--6dyw)

Registration counts failed to be rolled up into reports when using PostgreSQL.

Resolved in version [1.30.2](#version-1-30-2) via [1498](https://github.com/FusionAuth/fusionauth-issues/issues/1498).

[Known Issue](#v-1-33-0--known-issue--via-1548--dxz4)

A potential memory leak was introduced in this version.

Resolved in version [1.33.0](#version-1-33-0) via [1548](https://github.com/FusionAuth/fusionauth-issues/issues/1548).

[Fix](#fix--issue-1122--thanks-soullivaneuh--9a1m)

Fixed an issue where the Text MIME type of an email did not render Unicode correctly if the host system lacked `UTF-8` as the default character set.

Thanks to [@soullivaneuh](https://github.com/soullivaneuh)!

[1122](https://github.com/FusionAuth/fusionauth-issues/issues/1122)

[Fix](#fix--issue-1349--c5ce)

Fixed the inability to assign an IP ACL to an application if one was not already assigned to the tenant.

[1349](https://github.com/FusionAuth/fusionauth-issues/issues/1349)

[Fix](#fix--issue-1350--bqmy)

Fixed the inability to delete an IP ACL currently in use by a tenant.

[1350](https://github.com/FusionAuth/fusionauth-issues/issues/1350)

[Enhancement](#enhancement--oae5)

Included general performance improvements for login, OAuth2 grants, and user create and registration processes.

[Enhancement](#enhancement--issue-1352--thanks-flangfeldt--ij2r)

Added User Two-Factor methods to the Elasticsearch index.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[1352](https://github.com/FusionAuth/fusionauth-issues/issues/1352)

## Version 1.30.0

12 August 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#known-issue--via-1373--bzhu)

Referencing Reconcile Lambda Ids using the syntax **`FUSIONAUTH_LAMBDA{type}_ID`** failed due to initialization changes. Workaround: modify kickstart to build a custom lambda.

[Breaking Change](#breaking-change--a28i)

Added a new themed page for Unauthorized access.

[Theme Upgrade](#theme-upgrade--uml3)

Modified the `[@helpers.input]` macro to build checkboxes, potentially requiring updates for existing custom themes.

[New Feature](#new-feature--issue-525--kllh)

Introduced the JWT Vending machine to create JWTs for non-existent users with a caller-defined payload.

[525](https://github.com/FusionAuth/fusionauth-issues/issues/525)

[New Feature](#new-feature--issue-933--rf2x)

Added robust Threat Detection features for enterprise customers, including:

*   Rate limiting per user for the following requests:
    *   Failed login (only used if Failed Login configuration is not in use)
    *   Forgot password
    *   Send email verification
    *   Send passwordless
    *   Send registration verification
    *   Send two-factor
*   IP location.
    *   When possible, an IP address will be resolved to include city, country, region, zip code, longitude and latitude.
    *   IP location will be included in login records and will be available in some email templates and webhook events
    *   Used to calculate impossible travel between login locations
*   New transactional emails:
    *   Email update
    *   Login Id duplicate on create
    *   Login Id duplicate on update
    *   Login with new device
    *   Suspicious login
    *   Password reset success
    *   Password update
    *   Two-factor method added
    *   Two-factor method removed

[933](https://github.com/FusionAuth/fusionauth-issues/issues/933)

[New Feature](#new-feature--issue-278--gsr3)

Added a CAPTCHA option (Google ReCaptcha v2, Google ReCaptcha v3, HCaptcha and HCaptcha Enterprise) for login and other end user forms to help ensure only humans are submitting forms.

This feature is in tech preview and is subject to change.

[278](https://github.com/FusionAuth/fusionauth-issues/issues/278)

[New Feature](#new-feature--issue-1308--thanks-adoliver--1gy7)

Introduced the following new Webhook events:

*   Audit Log Create `audit-log.create`
*   Event Log Create `event-log.create`
*   Kickstart Success `kickstart.success`
*   User Create Complete `user.create.complete`
*   User Delete Complete `user.delete.complete`
*   User Update Complete `user.update.complete`
*   User LoginId Duplicate On Create `user.loginId.duplicate.create`
*   User LoginId Duplicate Update `user.loginId.duplicate.update`
*   User Email Update `user.email.update`
*   User Login New Device `user.login.new-device`
*   User Login Suspicious `user.login.suspicious`
*   User Password Reset Success `user.password.reset.success`
*   User Password Reset Send `user.password.reset.send`
*   User Password Reset Start `user.password.reset.start`
*   User Password Update `user.password.update`
*   User Registration Create Complete `user.registration.create.complete`
*   User Registration Delete Complete `user.registration.delete.complete`
*   User Registration Update Complete `user.registration.update.complete`
*   User Two-Factor Method Added `user.two-factor.method.add`
*   User Two-Factor Method Removed `user.two-factor.method.remove` See the [Event Webhooks](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks.md) documentation for additional details.

Resolves GitHub Issues [1308](https://github.com/FusionAuth/fusionauth-issues/issues/1308), [1178](https://github.com/FusionAuth/fusionauth-issues/issues/1178), [1128](https://github.com/FusionAuth/fusionauth-issues/issues/1128), and [1129](https://github.com/FusionAuth/fusionauth-issues/issues/1129).

Thanks to [@adoliver](https://github.com/adoliver)!

[1308](https://github.com/FusionAuth/fusionauth-issues/issues/1308)

[New Feature](#new-feature--581x)

Added new transactional emails for events like Suspicious login, New device login, Password updates, and Two-factor method changes.

[Enhancement](#enhancement--erdd)

Allowed searching on `oldValue`, `newValue`, and `reason` within the Audit Log.

[Enhancement](#enhancement--utjg)

Made recently completed links available on the Device complete themed page via the **`completedLinks`** variable.

[Enhancement](#enhancement--ra31)

Exposed the currently logged in user to more themed pages using the **`currentUser`** variable.

[Fix](#fix--issue-1307--awqq)

Fixed the inability to enable `user.action` events at the tenant level via the UI.

[1307](https://github.com/FusionAuth/fusionauth-issues/issues/1307)

[Fix](#fix--issue-1330--jfrw)

Fixed an exception occurring when making an API request to `/api/two-factor/login` with an empty JSON body.

[1330](https://github.com/FusionAuth/fusionauth-issues/issues/1330)

[Fix](#fix--issue-1341--hp2f)

Fixed an issue where tokens were not correctly stored when using an IdP with a linking mode other than Create Pending Link.

[1341](https://github.com/FusionAuth/fusionauth-issues/issues/1341)

[Fix](#fix--issue-1331--xtqj)

Enabled the use of `idp_hint` to bypass the login page and federate to another provider when FusionAuth acted as a SAML v2 IdP.

[1331](https://github.com/FusionAuth/fusionauth-issues/issues/1331)

## Version 1.29.4

12 August 2021

[Fix](#since-1-28-0--fix--issue-1344--thanks-flangfeldt--eg50)

Fixed a regression where users required to complete registration after login were unable to login without a password reset.

Since: [1.28.0](#version-1-28-0)

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[1344](https://github.com/FusionAuth/fusionauth-issues/issues/1344)

## Version 1.29.3

6 August 2021

[Fix](#fix--issue-1333--1fm6)

Fixed an issue where a `404` was returned when attempting to update a user via `PUT` or `PATCH` if the user had an unverified email and email verification was disabled.

[1333](https://github.com/FusionAuth/fusionauth-issues/issues/1333)

## Version 1.29.2

31 July 2021

[Fix](#fix--issue-1332--ssg2)

Fixed an exception occurring when parsing a SAML v2 IdP response that lacked a `KeyInfo` element.

[1332](https://github.com/FusionAuth/fusionauth-issues/issues/1332)

## Version 1.29.1

26 July 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-1262--7kj9)

Fixed an issue where SSO sessions were prematurely terminated in multi-tenant configurations if one tenant had a lower TTL.

[1262](https://github.com/FusionAuth/fusionauth-issues/issues/1262)

[Fix](#fix--issue-1284--p7t6)

Corrected argument names in the `LambdaType` enum.

[1284](https://github.com/FusionAuth/fusionauth-issues/issues/1284)

[Fix](#fix--issue-1315--t60v)

Fixed an issue where an IdP Debug event log was not produced when a unique Id could not be resolved.

[1315](https://github.com/FusionAuth/fusionauth-issues/issues/1315)

[Fix](#fix--issue-1317--sv1t)

Fixed an exception occurring when enabling the SAML v2 IdP debug log.

[1317](https://github.com/FusionAuth/fusionauth-issues/issues/1317)

## Version 1.29.0

10 July 2021

[Enhancement](#enhancement--issue-1277--cjw7)

Enhanced the Link API to retrieve a user by a 3rd party unique Id.

[1277](https://github.com/FusionAuth/fusionauth-issues/issues/1277)

[Enhancement](#enhancement--issue-1287--j9lx)

Showed an intermediate page during a device link request asking the user to sign in with an existing user or create a new one.

[1287](https://github.com/FusionAuth/fusionauth-issues/issues/1287)

[Enhancement](#enhancement--issue-1288--1q69)

Allowed the IdP Login API to optionally bypass establishing a link and return a `404`.

[1288](https://github.com/FusionAuth/fusionauth-issues/issues/1288)

[Enhancement](#enhancement--issue-1290--xq0y)

Added configuration to support always appending a suffix to unique usernames even when the username is not in use.

[1290](https://github.com/FusionAuth/fusionauth-issues/issues/1290)

[Enhancement](#enhancement--issue-1293--sn48)

Added an additional debug event log for the SAML IdP to debug the `AuthN` request sent to the IdP.

[1293](https://github.com/FusionAuth/fusionauth-issues/issues/1293)

[Enhancement](#enhancement--issue-1294--1sfw)

Allowed FusionAuth to accept `NameID` values if the format was returned as `unspecified` from the SAML v2 IdP.

[1294](https://github.com/FusionAuth/fusionauth-issues/issues/1294)

[Enhancement](#enhancement--issue-1299--h287)

Produced an event log instead of logging FreeMarker exceptions to the system log, improving UI error handling depending on the runtime mode.

[1299](https://github.com/FusionAuth/fusionauth-issues/issues/1299)

[Fix](#fix--issue-1276--kum8)

Fixed an error logged when viewing the theme preview for the `oauth2/start-idp-link.ftl` template.

[1276](https://github.com/FusionAuth/fusionauth-issues/issues/1276)

[Fix](#fix--issue-1279--6sp0)

Fixed an issue where a non-themed error page displayed when a webhook transaction failed to create a user/registration.

[1279](https://github.com/FusionAuth/fusionauth-issues/issues/1279)

[Internal](#internal--issue-1300--84au)

Updated HikariCP to `4.0.3` and PostgreSQL JDBC driver to `42.2.22`.

[1300](https://github.com/FusionAuth/fusionauth-issues/issues/1300)

## Version 1.28.1

21 June 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-1258--pc4q)

Allowed self-consent form fields on self-service forms.

[1258](https://github.com/FusionAuth/fusionauth-issues/issues/1258)

[Fix](#fix--issue-1260--o8wu)

Corrected validation of consent form fields during edits.

[1260](https://github.com/FusionAuth/fusionauth-issues/issues/1260)

[Fix](#fix--issue-1265--brys)

Fixed an issue where imported users requiring password changes failed email verification with an email verification gate.

[1265](https://github.com/FusionAuth/fusionauth-issues/issues/1265)

[Fix](#fix--issue-1267--qzn3)

Improved parsing of the `X-Forwarded-For` HTTP header to strictly preserve only the first IP address for login records.

[1267](https://github.com/FusionAuth/fusionauth-issues/issues/1267)

[Fix](#fix--issue-1268--k3vg)

Correctly displayed the Verification URL in the OAuth2 configuration when the `Device` grant was selected.

[1268](https://github.com/FusionAuth/fusionauth-issues/issues/1268)

[Fix](#fix--issue-1269--nq13)

Used the correct FusionAuth redirect URL for the Sony PlayStation Network IdP.

[1269](https://github.com/FusionAuth/fusionauth-issues/issues/1269)

[Fix](#fix--issue-1272--x3ow)

Used the correct FusionAuth implicit callback URL for the Steam IdP.

[1272](https://github.com/FusionAuth/fusionauth-issues/issues/1272)

[Fix](#fix--issue-1273--jxzw)

Allowed the Epic Games IdP to function properly when omitting the `scope` configuration property.

[1273](https://github.com/FusionAuth/fusionauth-issues/issues/1273)

[New Feature](#new-feature--issue-1274--worl)

(Tech Preview) Permitted starting an account link when beginning a Device grant.

[1274](https://github.com/FusionAuth/fusionauth-issues/issues/1274)

## Version 1.28.0

7 June 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-29-4--known-issue--via-1344--thanks-flangfeldt--gtnf)

Self-service registration users lacking required fields could get locked out post-login.

Resolved in version [1.29.4](#version-1-29-4) via [1344](https://github.com/FusionAuth/fusionauth-issues/issues/1344).

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[Known Issue](#known-issue--dird)

SAML v2 Populate/Reconcile Lambdas changed the `NameID` field to an array, requiring code updates.

[Breaking Change](#breaking-change--1u29)

Removed the ability to build synthetic email addresses using a lambda for OpenID Connect identity providers.

[Breaking Change](#breaking-change--prgm)

Accepted `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` in addition to `emailAddress` when FusionAuth acted as a SAML IdP.

[Breaking Change](#breaking-change--pkye)

Stored tokens from IdPs with the IdP link instead of on the User Registration object.

[New Feature](#new-feature--issue-1232--ai6x)

Introduced the Reindex API to rebuild the Elasticsearch index.

[1232](https://github.com/FusionAuth/fusionauth-issues/issues/1232)

[New Feature](#new-feature--orda)

Introduced the Account Link API to link/un-link 3rd party identity provider users with a FusionAuth user.

[New Feature](#new-feature--8yi0)

Added comprehensive IdP Linking options, including linking by email, username, anonymous, or existing user links.

[New Feature](#new-feature--issue-743--a64l)

Allowed the Email Send API to send to un-registered email addresses instead of only existing FusionAuth `userId`s.

[743](https://github.com/FusionAuth/fusionauth-issues/issues/743)

[New Feature](#new-feature--m9rw)

Enabled SAML Identity Providers to use any NameID format.

[New Feature](#new-feature--issue-1205--xwm7)

(Tech Preview) Added new IdPs for EpicGames, Nintendo, Sony PlayStation Network, Steam, Twitch, and Xbox.

[1205](https://github.com/FusionAuth/fusionauth-issues/issues/1205)

[New Feature](#new-feature--v9mb)

(Tech Preview) Added Development kickstart reset capability in the System navigation menu.

[New Feature](#new-feature--issue-1233--hj7y)

(Tech Preview) Added a JWT populate lambda for the Client Credentials grant.

[1233](https://github.com/FusionAuth/fusionauth-issues/issues/1233)

[Enhancement](#enhancement--issue-522--xwc2)

Allowed FusionAuth (as SAML IdP) to send NameID formats of Email or Persistent.

[522](https://github.com/FusionAuth/fusionauth-issues/issues/522)

[Enhancement](#enhancement--issue-909--esr9)

Changed Facebook and Google IdPs to default to redirects instead of popups, and added support for the `idp_hint` parameter.

[909](https://github.com/FusionAuth/fusionauth-issues/issues/909)

[Enhancement](#enhancement--issue-1152--f2ns)

Added flexible PKCE configuration options (required, not required, or required for public clients).

[1152](https://github.com/FusionAuth/fusionauth-issues/issues/1152)

[Enhancement](#enhancement--issue-1237--thanks-flangfeldt--vv9h)

Added the currently selected Two-Factor method object to the Themed Two-Factor page.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[1237](https://github.com/FusionAuth/fusionauth-issues/issues/1237)

[Enhancement](#enhancement--issue-554--thanks-gordody--40df)

Allowed using IdP buttons on the Themed registration page.

Thanks to [@gordody](https://github.com/gordody)!

[554](https://github.com/FusionAuth/fusionauth-issues/issues/554)

[Enhancement](#enhancement--issue-1247--thanks-lliu-20200701--p6j9)

Added the option to resend verification emails to users entering a gated page.

Thanks to [@lliu-20200701](https://github.com/lliu-20200701)!

[1247](https://github.com/FusionAuth/fusionauth-issues/issues/1247)

[Fix](#fix--issue-1215--thanks-pakomp--a4r8)

Removed the `NotBefore` assertion on the SAML AuthN response on the subject confirmation.

Thanks to [@pakomp](https://github.com/pakomp)!

[1215](https://github.com/FusionAuth/fusionauth-issues/issues/1215)

[Fix](#fix--issue-1245--thanks-lliu-20200701--3fg5)

Fixed exceptions when importing users with `passwordChangeRequired=true` without specifying a change reason.

Thanks to [@lliu-20200701](https://github.com/lliu-20200701)!

[1245](https://github.com/FusionAuth/fusionauth-issues/issues/1245)

[Fix](#fix--issue-1246--thanks-lliu-20200701--jeiy)

Fixed gating behavior for self-service registration users requiring email verification.

Thanks to [@lliu-20200701](https://github.com/lliu-20200701)!

[1246](https://github.com/FusionAuth/fusionauth-issues/issues/1246)

[Fix](#fix--issue-1228--thanks-flangfeldt--cesp)

Fixed a JavaScript bug causing theme pages to render incorrectly in the view window.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[1228](https://github.com/FusionAuth/fusionauth-issues/issues/1228)

## Version 1.27.2

10 May 2021

[Breaking Change](#since-1-26-0--breaking-change--issue-1204--thanks-mcs--2tkd)

Restored the ability to use `user.data.email` for Forgot Password and Passwordless login flows.

Since: [1.26.0](#version-1-26-0)

Thanks to [@mcs](https://github.com/mcs)!

[1204](https://github.com/FusionAuth/fusionauth-issues/issues/1204)

[Fix](#fix--issue-1216--67xu)

Fixed JavaScript errors during page render for new themes that prevented proper browser type capture.

[1216](https://github.com/FusionAuth/fusionauth-issues/issues/1216)

## Version 1.27.1

7 May 2021

[Fix](#since-1-27-0--fix--issue-1196--t62m)

Fixed an issue where the add Tenant panel failed to render during migration from versions prior to `1.26.0`.

Since: [1.27.0](#version-1-27-0)

[1196](https://github.com/FusionAuth/fusionauth-issues/issues/1196)

[Fix](#fix--issue-1198--9as8)

Simplified the verification flow when enabling both email and registration verification during self-service registration.

[1198](https://github.com/FusionAuth/fusionauth-issues/issues/1198)

[Fix](#fix--issue-1200--iexo)

Fixed rendering issues for the SAML v2 IdP Initiated configuration view dialog.

[1200](https://github.com/FusionAuth/fusionauth-issues/issues/1200)

[Fix](#fix--issue-1203--4y3t)

Fixed validation failures for SAML v2 IdP Initiated configurations lacking a URL-based `issuer`.

[1203](https://github.com/FusionAuth/fusionauth-issues/issues/1203)

## Version 1.27.0

5 May 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--ntz1)

Returned a `213` status code for "Registration Not Verified" on the Login API.

[Breaking Change](#breaking-change--lkgf)

Allowed the Login API and User API to optionally return `emailVerificationId` or `registrationVerificationId` to assist verification workflows utilizing short codes.

[Breaking Change](#breaking-change--5b0w)

Updated the Verify Email and Verify Registration APIs to take the `verificationId` in the request body instead of a URL segment.

[Breaking Change](#breaking-change--egrb)

Returned verification IDs during `PUT` requests to the Login API (ping) when utilizing short code strategies.

[New Feature](#new-feature--issue-769--rcgb)

(Tech Preview) Added Application Themes, allowing specific themes to override tenant configurations.

[769](https://github.com/FusionAuth/fusionauth-issues/issues/769)

[New Feature](#new-feature--issue-1191--qnae)

(Tech Preview) Added an Email verification gate forcing users to verify emails before redirection.

[1191](https://github.com/FusionAuth/fusionauth-issues/issues/1191)

[New Feature](#new-feature--issue-1191--kys4)

(Tech Preview) Added configurable verification strategies to use interactive forms instead of clickable links.

[1191](https://github.com/FusionAuth/fusionauth-issues/issues/1191)

[New Feature](#new-feature--issue-1190--wpum)

(Tech Preview) Allowed unique usernames by managing a unique suffix for duplicate selections.

[1190](https://github.com/FusionAuth/fusionauth-issues/issues/1190)

[New Feature](#new-feature--issue-1193--thanks-jegger--vlgm)

Introduced the Product Version API to retrieve the system version.

Thanks to [@jegger](https://github.com/jegger)!

[1193](https://github.com/FusionAuth/fusionauth-issues/issues/1193)

[Enhancement](#enhancement--issue-629--lvk0)

Added support to better handle Microsoft Outlook Safe Links.

[629](https://github.com/FusionAuth/fusionauth-issues/issues/629)

[Enhancement](#enhancement--issue-1189--3otr)

Supported HTTP Basic Auth using an API key for the Prometheus Metrics endpoint.

[1189](https://github.com/FusionAuth/fusionauth-issues/issues/1189)

[Fix](#fix--issue-1158--dvk0)

Fixed CleanSpeak username filtering for single-step advanced self-service registration forms.

[1158](https://github.com/FusionAuth/fusionauth-issues/issues/1158)

[Fix](#fix--issue-1181--8m1l)

Fixed the missing link to SAML v2 IdP Initiated Add in the admin UI.

[1181](https://github.com/FusionAuth/fusionauth-issues/issues/1181)

[Fix](#fix--issue-1174--c9yz)

Allowed the admin UI to upgrade and downgrade API keys for Key Manager.

[1174](https://github.com/FusionAuth/fusionauth-issues/issues/1174)

## Version 1.26.1

20 April 2021

[Fix](#fix--issue-1175--wax5)

Fixed login errors to the admin UI after upgrading for instances using non-default themes for the default tenant.

[1175](https://github.com/FusionAuth/fusionauth-issues/issues/1175)

[Known Issue](#known-issue--via-1181--xkkd)

Users could not create a "SAML v2 IdP Initiated" Identity Provider in the admin UI dropdown.

## Version 1.26.0

20 April 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-26-1--known-issue--via-1175--p78e)

Using a non-default theme for the FusionAuth default tenant caused an error when trying to log in to the admin UI.

Resolved in version [1.26.1](#version-1-26-1) via [1175](https://github.com/FusionAuth/fusionauth-issues/issues/1175).

[Breaking Change](#breaking-change--hg5o)

Changed the Two-Factor API to allow enabling/disabling methods and sending codes.

[Breaking Change](#breaking-change--pliy)

Updated the Two-Factor Login API to return a `409` for too many attempts, matching standard Login API locking capabilities.

[Breaking Change](#breaking-change--7n11)

Changed the Import API and User API regarding enabling Two-Factor methods.

[Breaking Change](#breaking-change--auvk)

Required a paid FusionAuth plan for Email and SMS Two-Factor methods (Authenticator/TOTP remained free).

[Breaking Change](#breaking-change--ii7w)

Required a two-stage upgrade process for versions older than `1.7.0`.

[New Feature](#new-feature--issue-881--v3lh)

(Tech Preview) Added Entity Management.

[881](https://github.com/FusionAuth/fusionauth-issues/issues/881)

[New Feature](#new-feature--issue-362--f92t)

Added a Prometheus Metrics endpoint.

[362](https://github.com/FusionAuth/fusionauth-issues/issues/362)

[New Feature](#new-feature--issue-566--f4sa)

Added IdP initiated SSO.

[566](https://github.com/FusionAuth/fusionauth-issues/issues/566)

[New Feature](#new-feature--issue-887--thanks-tintwo--q8ti)

Introduced an API key capable of creating other API keys.

Thanks to [@Tintwo](https://github.com/Tintwo)!

[887](https://github.com/FusionAuth/fusionauth-issues/issues/887)

[New Feature](#new-feature--issue-960--uf06)

Delivered Two-Factor step-up APIs, configurable SMS delivery methods, and Localized Message Templates.

[960](https://github.com/FusionAuth/fusionauth-issues/issues/960)

[New Feature](#new-feature--issue-682--yzkm)

Added a self-service user profile page.

[682](https://github.com/FusionAuth/fusionauth-issues/issues/682)

[New Feature](#new-feature--issue-378--f1ct)

Added a themeable root page.

[378](https://github.com/FusionAuth/fusionauth-issues/issues/378)

[New Feature](#new-feature--helt)

Added Messengers to send SMS via Twilio, Kafka, or generic JSON REST APIs.

[New Feature](#new-feature--bf1o)

Supported air-gapped deployments for licensing.

[New Feature](#new-feature--issue-155--7vve)

Introduced the Client Credentials grant.

[155](https://github.com/FusionAuth/fusionauth-issues/issues/155)

[Enhancement](#enhancement--issue-1162--ywkf)

Added IP address information to login success and failed events.

[1162](https://github.com/FusionAuth/fusionauth-issues/issues/1162)

[Fix](#fix--issue-1148--wg40)

Allowed deleting user registrations for inactive applications.

[1148](https://github.com/FusionAuth/fusionauth-issues/issues/1148)

[Fix](#fix--issue-1151--thanks-nikolaymetchev--fhqk)

Fixed spurious text `[object Object]` appearing on the admin UI due to certain Chrome extensions.

Thanks to [@NikolayMetchev](https://github.com/NikolayMetchev)!

[1151](https://github.com/FusionAuth/fusionauth-issues/issues/1151)

## Version 1.25.0

10 March 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--aumt)

Added the `SAMLv2 logout template` to themes in support of the SAML v2 Logout feature.

[New Feature](#new-feature--issue-1137--1yol)

Added full support for SAML v2 Logout.

[1137](https://github.com/FusionAuth/fusionauth-issues/issues/1137)

[Enhancement](#enhancement--issue-1094--jtwm)

Added a button to the Sessions tab to delete all user sessions simultaneously.

[1094](https://github.com/FusionAuth/fusionauth-issues/issues/1094)

[Enhancement](#enhancement--issue-781--b7rs)

Added Debug output to OAuth grants, primarily to assist Authorization Code grant exchanges.

[781](https://github.com/FusionAuth/fusionauth-issues/issues/781)

[Enhancement](#enhancement--issue-1126--g96t)

Added CORS Debug to assist in troubleshooting `403` HTTP status codes.

[1126](https://github.com/FusionAuth/fusionauth-issues/issues/1126)

[Enhancement](#enhancement--issue-1064--8pq0)

Improved SMTP debug context regarding tenants and templates during async connection exceptions.

[1064](https://github.com/FusionAuth/fusionauth-issues/issues/1064)

[Enhancement](#enhancement--issue-1127--2d7v)

Allowed the Registration API to accept the `applicationId` as a URL segment.

[1127](https://github.com/FusionAuth/fusionauth-issues/issues/1127)

[Enhancement](#enhancement--issue-1073--7ak6)

Allowed the Twitter IdP Login API to optionally accept an access token (`oauth_token` and `oauth_token_secret`).

[1073](https://github.com/FusionAuth/fusionauth-issues/issues/1073)

[Enhancement](#enhancement--issue-1136--2z0g)

Generated JWK thumbprints for Key Master `kid` identifiers when a public key was present.

[1136](https://github.com/FusionAuth/fusionauth-issues/issues/1136)

[Enhancement](#enhancement--thoz)

Ensured pagination results reflected accurate representation of matching users when using advanced search controls in the admin UI.

[Enhancement](#enhancement--ei0b)

SAML v2 Logout is now fully supported. No action should be required. If you are currently using FusionAuth as a SAML v2 IdP, please verify your configuration as you may want to provide additional configuration to take full advantage of the SAML v2 Logout configuration.

[Fix](#fix--issue-1135--l81a)

Fixed errors when using the Search API with Elasticsearch version 6 by providing the `accurateTotal=true` workaround parameter.

[1135](https://github.com/FusionAuth/fusionauth-issues/issues/1135)

[Fix](#fix--issue-1110--kh5z)

Fixed erroneous validation errors when using the HTTP `PATCH` method on the FusionAuth application.

[1110](https://github.com/FusionAuth/fusionauth-issues/issues/1110)

[Fix](#fix--issue-1065--thanks-nikolaymetchev--blvy)

Fixed issues adding Java options containing spaces in the configuration file.

Thanks to [@NikolayMetchev](https://github.com/NikolayMetchev)!

[1065](https://github.com/FusionAuth/fusionauth-issues/issues/1065)

[Fix](#fix--issue-1115--84vn)

Fixed a `NullPointerException` when generating login reports for applications in non-default tenants.

[1115](https://github.com/FusionAuth/fusionauth-issues/issues/1115)

[Fix](#fix--issue-1113--8tmm)

Fixed unexpected `state` parameters appearing on the `redirect_uri` when omitting them from Authorization requests.

[1113](https://github.com/FusionAuth/fusionauth-issues/issues/1113)

[Internal](#internal--issue-1119--3pmf)

Upgraded Tomcat from `8.5.57` to `8.5.63`.

[1119](https://github.com/FusionAuth/fusionauth-issues/issues/1119)

## Version 1.24.0

11 February 2021

[Known Issue](#v-1-25-0--known-issue--via-1135--2240)

Errors occurred when using the Search API on Elasticsearch version 6.

Resolved in version [1.25.0](#version-1-25-0) via [1135](https://github.com/FusionAuth/fusionauth-issues/issues/1135).

[Security](#security--issue-1103--vqbs)

Implemented consistent usage of the `Cache-Control` HTTP response headers to limit caching of sensitive pages.

[1103](https://github.com/FusionAuth/fusionauth-issues/issues/1103)

[Security](#security--mfbu)

Resolved vulnerabilities in the underlying SAML v2 library (CVE-2021-27736, CSNC-2021-004).

[Breaking Change](#breaking-change--issue-1102--zgy5)

Removed the `applicationId` and `roles` claims from the `id_token` issued via the `openid` scope to prevent authorization misuse.

[1102](https://github.com/FusionAuth/fusionauth-issues/issues/1102)

[Fix](#fix--issue-1057--gfq8)

Fixed truncated form requests for instances with over 2,000 applications by increasing maximum parameter limits.

[1057](https://github.com/FusionAuth/fusionauth-issues/issues/1057)

[Fix](#fix--issue-1063--ksxo)

Fixed the Tenant View dialog failing to render when custom password hashing plugins were registered.

[1063](https://github.com/FusionAuth/fusionauth-issues/issues/1063)

[Fix](#fix--issue-1081--i309)

Restored the ability to remove a User from a Group using the admin UI dialog.

[1081](https://github.com/FusionAuth/fusionauth-issues/issues/1081)

[Fix](#fix--issue-1088--tvkn)

Ensured user delete requests succeeded even if the user was missing from the Elasticsearch index.

[1088](https://github.com/FusionAuth/fusionauth-issues/issues/1088)

[Fix](#fix--issue-1106--1njw)

Fixed missing `roles` claims when creating a User and Registration simultaneously without explicitly assigned roles.

[1106](https://github.com/FusionAuth/fusionauth-issues/issues/1106)

[Fix](#fix--issue-1087--td97)

Ensured users remained searchable by Group memberships immediately after updates.

[1087](https://github.com/FusionAuth/fusionauth-issues/issues/1087)

[Fix](#fix--issue-1107--thanks-chris-bridges--25qt)

Allowed Kafka Producer configurations containing equals signs (`=`) in property values to parse correctly.

Thanks to [@chris-bridges](https://github.com/chris-bridges)!

[1107](https://github.com/FusionAuth/fusionauth-issues/issues/1107)

[Enhancement](#enhancement--issue-1080--fg44)

Supported Kickstart files utilizing only a `licenseId` without requiring API keys.

[1080](https://github.com/FusionAuth/fusionauth-issues/issues/1080)

[Enhancement](#enhancement--issue-1085--6avr)

Allowed importing RSA certificates with key bit lengths less than `2048` into Key Master.

[1085](https://github.com/FusionAuth/fusionauth-issues/issues/1085)[1091](https://github.com/FusionAuth/fusionauth-issues/issues/1091)

[Enhancement](#enhancement--issue-1086--nv00)

Added the `accurateTotal` Search API parameter to fetch exact hit counts from Elasticsearch.

[1086](https://github.com/FusionAuth/fusionauth-issues/issues/1086)

[Enhancement](#enhancement--issue-1093--68l8)

Allowed users to click the 'Enabled' column header to toggle all Webhook events simultaneously.

[1093](https://github.com/FusionAuth/fusionauth-issues/issues/1093)

[Enhancement](#enhancement--issue-1104--ozst)

Added item counts to the bottom of non-paginated lists in the admin UI.

[1104](https://github.com/FusionAuth/fusionauth-issues/issues/1104)

[Internal](#internal--issue-1105--c5dm)

Enhanced JavaScript event handlers to perform better on pages with thousands of applications.

[1105](https://github.com/FusionAuth/fusionauth-issues/issues/1105)

## Version 1.23.3

21 January 2021

[Fix](#fix--issue-1075--nojv)

Fixed an issue where tenant delete requests failed.

[1075](https://github.com/FusionAuth/fusionauth-issues/issues/1075)

## Version 1.23.2

20 January 2021

[Fix](#fix--issue-1074--83lt)

Fixed a bug in the PostgreSQL migration that caused the loss of SAML v2 IdP configurations.

[1074](https://github.com/FusionAuth/fusionauth-issues/issues/1074)

## Version 1.23.1

13 January 2021

[Fix](#fix--issue-1067--xro7)

Corrected the SAML v2 SP metadata to properly reflect the `AuthnRequestsSigned` configuration.

[1067](https://github.com/FusionAuth/fusionauth-issues/issues/1067)

## Version 1.23.0

11 January 2021

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#known-issue--39ep)

Using PostgreSQL with the provided LinkedIn Reconcile lambda required a manual edit to remove empty lines in the lambda body.

[Known Issue](#v-1-24-0--known-issue--via-1081--q1h6)

Users were unable to remove a User from a group using the admin UI dialog.

Resolved in version [1.24.0](#version-1-24-0) via [1081](https://github.com/FusionAuth/fusionauth-issues/issues/1081).

[Fix](#fix--issue-951--ksrz)

Fixed an issue where validation errors were not visible when selecting self-service registration options on unlicensed installations.

[951](https://github.com/FusionAuth/fusionauth-issues/issues/951)

[Fix](#fix--issue-991--thanks-hkolbeck-streem--ynf6)

Changed the User Action API to correctly return a `404` status code instead of `200` when requesting an action by a non-existent Id.

Thanks to [@hkolbeck-streem](https://github.com/hkolbeck-streem)!

[991](https://github.com/FusionAuth/fusionauth-issues/issues/991)

[Fix](#fix--issue-1030--e479)

Fixed a cosmetic issue where the About panel displayed the same IP address for each node in a multi-node instance.

[1030](https://github.com/FusionAuth/fusionauth-issues/issues/1030)

[Fix](#fix--issue-1047--thanks-mrchrisrodriguez--kpa1)

Fixed SAML Response XML XSD validation failures regarding the `Signature` element location.

Thanks to [@MrChrisRodriguez](https://github.com/MrChrisRodriguez)!

[1047](https://github.com/FusionAuth/fusionauth-issues/issues/1047)

[Fix](#fix--issue-1052--thanks-atrauzzi--ogdz)

Fixed a potential NPE when making an Update request to a group in a multi-tenant environment.

Thanks to [@atrauzzi](https://github.com/atrauzzi)!

[1052](https://github.com/FusionAuth/fusionauth-issues/issues/1052)

[Fix](#fix--issue-1058--oim1)

Ignored requested Ids on the API when creating fixed IdPs (Google, Facebook, Twitter, HYPR) and set the correct Id instead.

[1058](https://github.com/FusionAuth/fusionauth-issues/issues/1058)

[Fix](#fix--issue-1060--thanks-rhofland--yy43)

Fixed Kickstart failures caused by using variables in the `tenantId` field for an API key.

Thanks to [@rhofland](https://github.com/rhofland)!

[1060](https://github.com/FusionAuth/fusionauth-issues/issues/1060)

[New Feature](#new-feature--issue-34--9w9c)

Added Sign in with LinkedIn as a new identity provider type.

[34](https://github.com/FusionAuth/fusionauth-issues/issues/34)

[New Feature](#new-feature--issue-1027--tzey)

Added new FusionAuth roles (`user_support_viewer` and `user_support_manager`) oriented for Level 1 support personnel.

[1027](https://github.com/FusionAuth/fusionauth-issues/issues/1027)

[Enhancement](#enhancement--issue-900--2gnj)

Added validation on the length of an email address on the User and Import APIs to provide better error messages.

[900](https://github.com/FusionAuth/fusionauth-issues/issues/900)

[Internal](#internal--issue-1049--thanks-atrauzzi--z7y1)

Enhanced the .NET Core client library to better support requests in a multi-tenant environment and to use the `IDictionary` reference instead of `Dictionary`.

Thanks to [@atrauzzi](https://github.com/atrauzzi)!

[1049](https://github.com/FusionAuth/fusionauth-issues/issues/1049)[1050](https://github.com/FusionAuth/fusionauth-issues/issues/1050)

## Version 1.22.2

10 December 2020

[Fix](#fix--issue-1020--thanks-ckolbeck-streem--itht)

Changed connector behavior so that password constraints were validated according to the tenant policy only if the connector migrated the user.

Thanks to [@ckolbeck-streem](https://github.com/ckolbeck-streem)!

[1020](https://github.com/FusionAuth/fusionauth-issues/issues/1020)

[Fix](#fix--issue-1034--kcte)

Fixed an issue where Verify Email workflows on themed pages failed to send emails if the address contained a plus sign (`+`).

[1034](https://github.com/FusionAuth/fusionauth-issues/issues/1034)

## Version 1.22.1

8 December 2020

[Fix](#fix--issue-794--xpzj)

Prevented OpenID Connect endpoint validation errors from being hidden when endpoint discovery was disabled in the UI.

[794](https://github.com/FusionAuth/fusionauth-issues/issues/794)

[Fix](#fix--issue-1012--thanks-pamcpd--69pz)

Fixed an issue where the Manage User page failed to render if an action/comment was made by a user without an email address.

Thanks to [@pamcpd](https://github.com/pamcpd)!

[1012](https://github.com/FusionAuth/fusionauth-issues/issues/1012)

[Fix](#fix--issue-1016--thanks-jedisquirrel--f81r)

Ensured the `tenantId` parameter was preserved correctly in multi-tenant configurations during Device authorization grants.

Thanks to [@JediSquirrel](https://github.com/JediSquirrel) and [@jerryhopper](https://github.com/jerryhopper)!

[1016](https://github.com/FusionAuth/fusionauth-issues/issues/1016)

[Enhancement](#enhancement--issue-1018--thanks-eirikur-grid--aopw)

Limited origin validation during OAuth2 grants occurring as a result of redirects from FusionAuth.

Thanks to [@eirikur-grid](https://github.com/eirikur-grid)!

[1018](https://github.com/FusionAuth/fusionauth-issues/issues/1018)

[Enhancement](#enhancement--issue-1026--thanks-dan-barrett--fnaq)

Exposed the default signing key Id as a Kickstart variable.

Thanks to [@dan-barrett](https://github.com/dan-barrett)!

[1026](https://github.com/FusionAuth/fusionauth-issues/issues/1026)

## Version 1.22.0

1 December 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--v00d)

Replaced the `active` boolean on the Application object/API with a new `state` field on Application and Tenant domain objects.

[New Feature](#new-feature--issue-631--thanks-chrishare08--t8en)

Allowed configuration of the Elasticsearch index name (`fusionauth-app.user-search-index.name`).

Thanks to [@chrishare08](https://github.com/chrishare08)!

[631](https://github.com/FusionAuth/fusionauth-issues/issues/631)

[New Feature](#new-feature--issue-990--xz0i)

Added async support for the Delete Tenant API.

[990](https://github.com/FusionAuth/fusionauth-issues/issues/990)

[Enhancement](#enhancement--issue-918--5pz0)

Significantly improved Elasticsearch reindex performance.

[918](https://github.com/FusionAuth/fusionauth-issues/issues/918)

[Enhancement](#enhancement--issue-998--4f0n)

Clarified the warning message regarding required CORS configurations for specific IdPs.

[998](https://github.com/FusionAuth/fusionauth-issues/issues/998)

[Enhancement](#enhancement--issue-1010--thanks-thekoding--ci1o)

Increased the read timeout for third-party identity providers (e.g., Apple).

Thanks to [@thekoding](https://github.com/thekoding)!

[1010](https://github.com/FusionAuth/fusionauth-issues/issues/1010)

[Fix](#fix--issue-975--zaji)

Fixed the required column value not being correct when viewing forms in the UI.

[975](https://github.com/FusionAuth/fusionauth-issues/issues/975)

[Fix](#fix--issue-980--thanks-daviddh--sjvg)

Fixed the inability to request a second 2FA code on the themed login page during a 2FA login request.

Thanks to [@DaviddH](https://github.com/DaviddH)!

[980](https://github.com/FusionAuth/fusionauth-issues/issues/980)

[Fix](#fix--issue-981--thanks-uckc--i6wp)

Fixed an exception during LDAP connector login attempts caused by a missing message.

Thanks to [@uckc](https://github.com/uckc)!

[981](https://github.com/FusionAuth/fusionauth-issues/issues/981)

[Fix](#fix--issue-983--65mv)

Corrected the message shown on a registration form when no fields had been added.

[983](https://github.com/FusionAuth/fusionauth-issues/issues/983)

[Fix](#fix--issue-999--s8do)

Fixed the Google IdP view dialog incorrectly showing the client secret for both Client Id and Client secret fields.

[999](https://github.com/FusionAuth/fusionauth-issues/issues/999)

[Fix](#fix--issue-1006--thanks-arni-inaba--svfg)

Fixed an issue where selecting a preferred language during login appended values, causing duplicate locales.

Thanks to [@arni-inaba](https://github.com/arni-inaba)!

[1006](https://github.com/FusionAuth/fusionauth-issues/issues/1006)

[Fix](#since-1-20-0--fix--issue-1008--731v)

Fixed validation failures when using the Import API to import users to non-default tenants.

Since: [1.20.0](#version-1-20-0)

[1008](https://github.com/FusionAuth/fusionauth-issues/issues/1008)

[Fix](#fix--issue-1017--ltk1)

Fixed an exception logged when logging out of SSO with webhooks configured to receive the Refresh Token Revoke event.

[1017](https://github.com/FusionAuth/fusionauth-issues/issues/1017)

## Version 1.21.0

10 November 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-23-2--known-issue--xaqp)

Upgrading broke the SAML v2 IdP configuration for users running PostgreSQL.

[Fix](#fix--issue-963--pdwf)

Fixed exceptions when starting a SAML v2 Login Request without additional custom data on the API request.

[963](https://github.com/FusionAuth/fusionauth-issues/issues/963)

[Fix](#fix--issue-966--uhmw)

Fixed exceptions occurring in some circumstances when using Bcrypt as the default hashing scheme.

[966](https://github.com/FusionAuth/fusionauth-issues/issues/966)

[Fix](#fix--issue-970--thanks-mgetka--hicb)

Added custom data to the Consent object view dialog and fixed issues where editing in the UI caused custom data loss.

Thanks to [@mgetka](https://github.com/mgetka)!

[970](https://github.com/FusionAuth/fusionauth-issues/issues/970)

[Enhancement](#enhancement--issue-365--thanks-mikerees--67te)

Allowed configuring the location of the XML signature in the SAML response as a child of the `Assertion` or the `Response`.

Thanks to [@mikerees](https://github.com/mikerees)!

[365](https://github.com/FusionAuth/fusionauth-issues/issues/365)

[Enhancement](#enhancement--issue-968--thanks-jandillmann--cl8e)

Utilized the PKCE extension for OpenID Connect IdP configurations to ensure compatibility.

Thanks to [@jandillmann](https://github.com/jandillmann)!

[968](https://github.com/FusionAuth/fusionauth-issues/issues/968)

[Enhancement](#enhancement--issue-976--iadz)

Added the `application` domain object to email templates when available.

[976](https://github.com/FusionAuth/fusionauth-issues/issues/976)

## Version 1.20.1

30 October 2020

[Fix](#fix--issue-461--thanks-mreschke--u9eu)

Ensured UI sorting preferences were preserved after a page refresh.

Thanks to [@mreschke](https://github.com/mreschke)!

[461](https://github.com/FusionAuth/fusionauth-issues/issues/461)

[Fix](#fix--issue-654--thanks-juliuspc--cdz7)

Updated a tooltip to better describe the "Require authentication" setting in OAuth configurations.

Thanks to [@JuliusPC](https://github.com/JuliusPC)!

[654](https://github.com/FusionAuth/fusionauth-issues/issues/654)

[Fix](#fix--issue-758--thanks-srothery--n4dm)

Fixed an exception that occurred if attempting to change a password immediately after installation before modifying Tenant configurations.

Thanks to [@srothery](https://github.com/srothery)!

[758](https://github.com/FusionAuth/fusionauth-issues/issues/758)

[Fix](#fix--issue-917--j8up)

Fixed an exception caused by providing duplicate connector policies on the Tenant API.

[917](https://github.com/FusionAuth/fusionauth-issues/issues/917)

[Fix](#fix--issue-937--thanks-lohithblaze--91zr)

Set the Twitter tokens in the User Registration after logging in with Twitter.

Thanks to [@LohithBlaze](https://github.com/LohithBlaze)!

[937](https://github.com/FusionAuth/fusionauth-issues/issues/937)

[Fix](#fix--issue-947--thanks-shaymoshe--4u40)

Allowed Refresh Token metadata fields to be set during the Password Grant.

Thanks to [@ShayMoshe](https://github.com/ShayMoshe)!

[947](https://github.com/FusionAuth/fusionauth-issues/issues/947)

[Enhancement](#enhancement--issue-803--thanks-seanadkinson--qu5b)

Added additional Kickstart settings to modify default timeouts used to make API calls.

Thanks to [@seanadkinson](https://github.com/seanadkinson)!

[803](https://github.com/FusionAuth/fusionauth-issues/issues/803)

[Enhancement](#enhancement--issue-836--thanks-lohithblaze--c0qp)

Exposed default Lambda and Form Ids to Kickstart for assignment to identity provider configurations.

Thanks to [@LohithBlaze](https://github.com/LohithBlaze)!

[836](https://github.com/FusionAuth/fusionauth-issues/issues/836)

[Enhancement](#enhancement--issue-955--5j5r)

Returned the `encryptionScheme` on the User API response when authenticated using an API key.

[955](https://github.com/FusionAuth/fusionauth-issues/issues/955)

## Version 1.20.0

23 October 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--3ia8)

Updated the base Docker image from `alpine` to `ubuntu:focal` to use the official AdoptOpenJDK build.

This is a non-functional change, but please be aware of this change if you're building Docker images using ours as a base.

In order to run on `alpine` without including the GNU C Library (`glibc`) we had to use a custom build of OpenJDK compiled using the `musl` C library. Due to some possible performance concerns, we have moved to an official build of JDK provide by AdoptOpenJDK compiled using `glibc`. The `ubuntu:focal` base image added ~ 30 MB in size compared to our previous (compressed) image size, but until we can obtain builds from AdoptOpenJDK based upon the `musl` C library, we will not likely ship an official image on `alpine`.

*   [fusionauth-containers / docker / fusionauth / fusionauth-app / Dockerfile](https://github.com/FusionAuth/fusionauth-containers/blob/main/docker/fusionauth/fusionauth-app/Dockerfile)
*   [hub.docker.com / fusionauth / fusionauth-app](https://hub.docker.com/r/fusionauth/fusionauth-app/tags)

[Fix](#fix--issue-721--m86y)

Resolved a noisy warning message about an upcoming deprecated use of reflection in a dependency.

[721](https://github.com/FusionAuth/fusionauth-issues/issues/721)

[Fix](#fix--issue-799--thanks-gurupras--1f5r)

Fixed negative counts displayed in the dashboard and reports by safely updating tracking paths during tenant deletion.

Thanks to [@gurupras](https://github.com/gurupras)!

[799](https://github.com/FusionAuth/fusionauth-issues/issues/799)

[Fix](#fix--issue-861--7cfz)

Improved the user experience for advanced self-service forms once a license had been de-activated.

[861](https://github.com/FusionAuth/fusionauth-issues/issues/861)

[Fix](#fix--issue-863--69xq)

Fixed self-service registration form validation when using custom options with `select`, `radio`, or `checkbox` types.

[863](https://github.com/FusionAuth/fusionauth-issues/issues/863)

[Fix](#fix--issue-866--sdac)

Fixed UI form validation when adding and removing fields from an existing self-service registration form.

[866](https://github.com/FusionAuth/fusionauth-issues/issues/866)

[Fix](#fix--issue-915--ik4k)

Fixed developer-unfriendly error responses when `applicationId` was not validated on the Import User API.

[915](https://github.com/FusionAuth/fusionauth-issues/issues/915)

[Fix](#fix--issue-945--davk)

Fixed a typo on the Activate Reactor page in the UI.

[945](https://github.com/FusionAuth/fusionauth-issues/issues/945)

[Fix](#fix--issue-948--vg48)

Ensured the `authenticationType` claim in the JWT accurately reflected IdP logins during self-service registration.

[948](https://github.com/FusionAuth/fusionauth-issues/issues/948)

[New Feature](#new-feature--issue-845--76vt)

Supported SAML v2 POST bindings to a third-party SAML v2 IdP when FusionAuth acted as the SP.

[845](https://github.com/FusionAuth/fusionauth-issues/issues/845)

[New Feature](#new-feature--issue-896--1xvi)

Added the SAML v2 `SessionIndex` to the SAML v2 AuthN request.

[896](https://github.com/FusionAuth/fusionauth-issues/issues/896)

[New Feature](#new-feature--issue-753--m37i)

Allowed customization of the Add and Edit forms for Users and User Registrations in the admin UI (paid plan feature).

[753](https://github.com/FusionAuth/fusionauth-issues/issues/753)

[Enhancement](#enhancement--issue-502--4871)

Allowed configuring one-to-many redirect URLs (ACS URLs) when configuring FusionAuth as a SAML v2 IdP.

[502](https://github.com/FusionAuth/fusionauth-issues/issues/502)

[Enhancement](#enhancement--issue-925--a268)

Ensured the correct tenant was identified during logout when only the `id_token_hint` was provided.

[925](https://github.com/FusionAuth/fusionauth-issues/issues/925)

[Enhancement](#enhancement--issue-49--938s)

Added initial base image build support for multi-arch Docker images (ARM, IBM Power, etc.).

*Thanks to a bunch of our FusionAuth MVPs including, but not limited to [@jerryhopper](https://github.com/jerryhopper), [@arslanakhtar61](https://github.com/arslanakhtar61), and [@ceefour](https://github.com/ceefour), for helping with this work through code, advice and domain knowledge that we don't have!*

[49](https://github.com/FusionAuth/fusionauth-issues/issues/49)

## Version 1.19.8

28 September 2020

[Fix](#fix--issue-891--85po)

Ensured FusionAuth used the overriden local port defined by `fusionauth-app.http.port` to connect to itself.

[891](https://github.com/FusionAuth/fusionauth-issues/issues/891)

[Fix](#fix--issue-892--tou3)

Fixed PostgreSQL exceptions occurring when importing users with a wide distribution of `insertInstant` values via the Import API.

[892](https://github.com/FusionAuth/fusionauth-issues/issues/892)

[Fix](#fix--issue-893--xwxs)

Disabled the Elasticsearch Sniffer by default to prevent issues in cloud managed or containerized environments.

[893](https://github.com/FusionAuth/fusionauth-issues/issues/893)

[Enhancement](#enhancement--issue-894--e8q9)

Added a `referrer` meta tag to ensure secure default browser policies.

[894](https://github.com/FusionAuth/fusionauth-issues/issues/894)

## Version 1.19.7

23 September 2020

[Fix](#fix--issue-868--tufn)

Added an exception handler to the Elasticsearch REST client to prevent underlying HTTP exceptions from causing failures.

[868](https://github.com/FusionAuth/fusionauth-issues/issues/868)

[Fix](#fix--issue-879--wlu4)

Fixed PostgreSQL exceptions caused by embedded `null` characters in LDAP exception messages.

[879](https://github.com/FusionAuth/fusionauth-issues/issues/879)

[Fix](#fix--issue-880--f8l7)

Fixed an issue where users were stuck in a password change loop when both "Re-validate password on login" and "restrict previous passwords" were selected.

[880](https://github.com/FusionAuth/fusionauth-issues/issues/880)

[Fix](#fix--issue-890--nd01)

Fixed a duplicate key issue in the MySQL migration script due to a poor random Id generator for refresh tokens.

[890](https://github.com/FusionAuth/fusionauth-issues/issues/890)

[Enhancement](#enhancement--issue-822--g3t4)

Added a helper for Active Directory LDAP to handle the conversion of base64-encoded Microsoft `objectGuid` to a Java UUID.

[822](https://github.com/FusionAuth/fusionauth-issues/issues/822)

## Version 1.19.6

16 September 2020

[Fix](#fix--issue-870--v46v)

Fixed startup failures on version `1.19.5` of the Docker image caused by an invalid variable name in `setenv.sh`.

[870](https://github.com/FusionAuth/fusionauth-issues/issues/870)

## Version 1.19.5

15 September 2020

[Fix](#fix--issue-831--35aw)

Fixed an exception occurring when deleting an application role that was in use by a Group.

[831](https://github.com/FusionAuth/fusionauth-issues/issues/831)

[Fix](#fix--issue-859--f0h4)

Fixed possible errors when upgrading to version `1.19.0` on managed MySQL services like Google Cloud SQL.

[859](https://github.com/FusionAuth/fusionauth-issues/issues/859)

[Enhancement](#enhancement--issue-635--4smk)

Made URL path and query parsing more forgiving of un-escaped characters.

[635](https://github.com/FusionAuth/fusionauth-issues/issues/635)

## Version 1.19.4

12 September 2020

[Fix](#fix--issue-856--kwdr)

Fixed an issue where the `registration` or `roles` arguments were missing in the JWT Populate lambda during a combined User + Registration API request.

[856](https://github.com/FusionAuth/fusionauth-issues/issues/856)

[Fix](#fix--issue-857--bx5o)

Fixed an `IllegalStateException` or missing driver error occurring when using MySQL and Silent Mode database configurations.

[857](https://github.com/FusionAuth/fusionauth-issues/issues/857)

## Version 1.19.3

10 September 2020

[Security](#security--ufkb)

Proactively upgraded Apache Commons File Upload to `1.4.0` (CVE-2016-1000031).

[Breaking Change](#breaking-change--krj0)

Upgraded Kafka client to `2.6.0`, MySQL connector to `8.0.21`, and PostgreSQL connector to `42.2.14`.

[Fix](#fix--s7hz)

Corrected the clock skew calculation used when verifying a SAML AuthN response from a SAML v2 IdP to prevent incorrect validation errors.

[Enhancement](#enhancement--7xa1)

Implemented better email address validation to ensure addresses were deliverable.

## Version 1.19.2

6 September 2020

[Fix](#fix--issue-850--asuv)

Fixed an issue where using the External JWT Identity Provider with the Lookup API failed to validate a JWT.

[850](https://github.com/FusionAuth/fusionauth-issues/issues/850)

## Version 1.19.1

4 September 2020

[Fix](#fix--issue-846--thanks-motzel--7265)

Fixed an issue where FusionAuth failed to start up correctly if using the database search engine.

Thanks to [@motzel](https://github.com/motzel)!

[846](https://github.com/FusionAuth/fusionauth-issues/issues/846)

[Fix](#fix--issue-847--thanks-soullivaneuh--xpw8)

Ensured the legacy environment variable **`FUSIONAUTH_SEARCH_SERVERS`** was honored appropriately.

Thanks to [@soullivaneuh](https://github.com/soullivaneuh)!

[847](https://github.com/FusionAuth/fusionauth-issues/issues/847)

## Version 1.19.0

3 September 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#known-issue--via-934--dvrr)

MySQL users encountered an issue logging into the admin console, resulting in an empty page.

[Known Issue](#v-1-19-1--known-issue--rr69)

FusionAuth failed to start up correctly when using the database search engine.

[Known Issue](#v-1-19-1--known-issue--mqgj)

The legacy environment variable **`FUSIONAUTH_SEARCH_SERVERS`** was ignored.

[Breaking Change](#breaking-change--nhdp)

Required the use of the Start Identity Provider API prior to sending SAML v2 AuthN requests for custom integrations.

[Breaking Change](#breaking-change--c5ar)

Made the FusionAuth SSO and admin UI stateless, removing the requirement for session pinning.

[Breaking Change](#breaking-change--nwms)

Allowed Silent Mode while in `production` runtime mode to upgrade database schemas.

[Breaking Change](#breaking-change--pyr1)

Changed the Status API to no longer return full JSON responses unless authenticated by an API key or admin.

[Breaking Change](#breaking-change--51wf)

Updated customized field error message formats for custom Registration forms (e.g., from `[missing]` to `[blank]`).

[Breaking Change](#breaking-change--ce0e)

Shipped a `systemd` service definition for Linux Debian and RPM packages instead of legacy Sys V init scripts.

[Breaking Change](#breaking-change--ic59)

Flipped `client_id` and `redirect_uri` parameter positions in the Python client library for consistency.

[New Feature](#new-feature--issue-358--uz5m)

Made FusionAuth admin UI and FusionAuth pages stateless.

[358](https://github.com/FusionAuth/fusionauth-issues/issues/358)

[New Feature](#new-feature--issue-355--thanks-unkis--1530)

Introduced Multi-tenant SSO allowing users to utilize SSO across different tenants simultaneously.

Thanks to [@unkis](https://github.com/unkis)!

[355](https://github.com/FusionAuth/fusionauth-issues/issues/355)

[New Feature](#new-feature--issue-178--thanks-davidmw--uge0)

Added IdP and Email hinting for FusionAuth login pages to bypass the login page directly to a third-party IdP.

Thanks to [@davidmw](https://github.com/davidmw)!

[178](https://github.com/FusionAuth/fusionauth-issues/issues/178)

[New Feature](#new-feature--issue-835--2h5o)

Introduced a new API to import Refresh Tokens.

[835](https://github.com/FusionAuth/fusionauth-issues/issues/835)

[New Feature](#new-feature--issue-834--k6qz)

Allowed application-specific email templates for Passwordless, Email Verification, Setup Password, and Change Password.

[834](https://github.com/FusionAuth/fusionauth-issues/issues/834)

[Enhancement](#enhancement--issue-95--tsob)

Enhanced Maintenance Mode support for initial DB schema setups on third-party cloud managed database services.

[95](https://github.com/FusionAuth/fusionauth-issues/issues/95)

[Enhancement](#enhancement--issue-575--thanks-oottinger--3xec)

Shipped a log rotation strategy for `fusionauth-app.log`.

Thanks to [@oottinger](https://github.com/oottinger)!

[575](https://github.com/FusionAuth/fusionauth-issues/issues/575)

[Enhancement](#enhancement--issue-752--bjiy)

Exposed all configurations via `fusionauth.properties`, environment variables, or Java System Properties.

[752](https://github.com/FusionAuth/fusionauth-issues/issues/752)

[Enhancement](#enhancement--issue-473--yhy0)

Restricted the response body on the Status API unless authenticated and provided granular HTTP response codes.

[473](https://github.com/FusionAuth/fusionauth-issues/issues/473)

[Fix](#fix--issue-828--nga4)

Fixed the missing `Control` type display on the View dialog for custom form fields.

[828](https://github.com/FusionAuth/fusionauth-issues/issues/828)[827](https://github.com/FusionAuth/fusionauth-issues/issues/827)

[Fix](#fix--issue-827--dt04)

Fixed validation errors occurring when submitting custom Registration Forms with non-required fields of type `number`, `date`, or `bool`.

[827](https://github.com/FusionAuth/fusionauth-issues/issues/827)

[Fix](#fix--issue-798--lkpn)

Allowed `database.mysql.enforce-utf8mb4` to be configured via environment variables for Docker.

[798](https://github.com/FusionAuth/fusionauth-issues/issues/798)

[Fix](#fix--issue-833--thanks-atrauzzi--622j)

Fixed a `404` status code returned from the Start Passwordless API in multi-tenant instances.

Thanks to [@atrauzzi](https://github.com/atrauzzi)!

[833](https://github.com/FusionAuth/fusionauth-issues/issues/833)

[Fix](#fix--issue-832--thanks-motzel--1bvc)

Normalized the use of the `aud` claim between OAuth2 grants, ensuring it was consistently populated.

Thanks to [@motzel](https://github.com/motzel)!

[832](https://github.com/FusionAuth/fusionauth-issues/issues/832)

[Fix](#fix--issue-838--l425)

Fixed an issue where both Login Success and Login Failed events triggered during failed attempts.

[838](https://github.com/FusionAuth/fusionauth-issues/issues/838)

[Fix](#fix--1wfl)

Fixed Custom Form validation errors.

*Resolves GitHub Issues [827](https://github.com/FusionAuth/fusionauth-issues/issues/827), [810](https://github.com/FusionAuth/fusionauth-issues/issues/810), [828](https://github.com/FusionAuth/fusionauth-issues/issues/828), and [829](https://github.com/FusionAuth/fusionauth-issues/issues/829).*

[Fix](#since-1-18-0--fix--issue-838--ics8)

Fixed an issue where both the Login Success and Login Failed events are triggered during a failed login attempt.

Since: [1.18.0](#version-1-18-0)

[838](https://github.com/FusionAuth/fusionauth-issues/issues/838)

## Version 1.18.8

25 August 2020

[Security](#security--w2wy)

Improved SAML AuthN Response validation.

## Version 1.18.7

12 August 2020

[Fix](#fix--issue-808--1amz)

Ensured the `loginId` was properly validated to exist in FusionAuth when initiating the HYPR authentication workflow.

[808](https://github.com/FusionAuth/fusionauth-issues/issues/808)

## Version 1.18.6

10 August 2020

[Fix](#fix--issue-802--mfn2)

Fixed an issue where the `registration` parameter to the JWT Populate lambda was `null` during self-service registration and Implicit Grant.

[802](https://github.com/FusionAuth/fusionauth-issues/issues/802)

## Version 1.18.5

3 August 2020

[Fix](#fix--issue-783--yptd)

Fixed a JavaScript bug that caused some reports not to render correctly in the admin UI.

[783](https://github.com/FusionAuth/fusionauth-issues/issues/783)

[Fix](#fix--issue-786--sh1a)

Resolved a poor performing SQL query occurring in MySQL when rendering dashboard charts with millions of login records.

[786](https://github.com/FusionAuth/fusionauth-issues/issues/786)

[Enhancement](#enhancement--issue-788--hcsi)

Added localized number formatting on the y-axis of charts in the admin UI.

[788](https://github.com/FusionAuth/fusionauth-issues/issues/788)

## Version 1.18.4

30 July 2020

[Fix](#fix--issue-716--thanks-ulybu--v187)

Fixed an exception occurring when attempting to use a refresh token from one tenant with another tenant.

Thanks to [@ulybu](https://github.com/ulybu)!

[716](https://github.com/FusionAuth/fusionauth-issues/issues/716)

[Fix](#fix--issue-776--lmhh)

Fixed an exception that disrupted the user registration workflow during self-service registration.

[776](https://github.com/FusionAuth/fusionauth-issues/issues/776)

[Fix](#fix--issue-780--11md)

Fixed an issue where the registration object was `null` in the JWT Populate function when used with self-service registration.

[780](https://github.com/FusionAuth/fusionauth-issues/issues/780)

[Fix](#fix--t7bc)

Fixed an exception caused by SAML responses containing an attribute element with `xsi:nil="true"`.

## Version 1.18.3

24 July 2020

[Fix](#fix--issue-630--typp)

Fixed an exception when attempting to add a registration for an user in the admin UI if no available registrations existed.

[630](https://github.com/FusionAuth/fusionauth-issues/issues/630)

[Fix](#fix--issue-749--thanks-eddiewhi--bcrl)

Ensured a verification email was sent when updating a previously undefined email address with "verify email on change" enabled.

Thanks to [@EddieWhi](https://github.com/EddieWhi)!

[749](https://github.com/FusionAuth/fusionauth-issues/issues/749)

[Fix](#fix--issue-750--thanks-brennan-karrer--37w6)

Ensured the search index correctly reflected registration removals before the next user index event.

Thanks to [@brennan-karrer](https://github.com/brennan-karrer)!

[750](https://github.com/FusionAuth/fusionauth-issues/issues/750)

[Fix](#fix--issue-761--22mx)

Fixed form field name validation to limit spaces and other special characters.

[761](https://github.com/FusionAuth/fusionauth-issues/issues/761)

[Fix](#fix--issue-762--cjsj)

Fixed Form and field issues including JavaScript errors and complete registration workflows using custom forms.

[762](https://github.com/FusionAuth/fusionauth-issues/issues/762)

[Fix](#fix--issue-770--thanks-seanadkinson--hhqs)

Relaxed email template validation to allow `${tenant.issuer}` references to be saved despite preview warnings.

Thanks to [@seanadkinson](https://github.com/seanadkinson)!

[770](https://github.com/FusionAuth/fusionauth-issues/issues/770)

[Enhancement](#enhancement--uzlf)

Email template validation has been relaxed to allow the Preview API and UI action to report errors and warnings but still allow the changes to be saved. Due to the complexity of validating the email template without the exact data to be used at runtime, validation has been relaxed to ensure we do not prohibit a valid template from being saved. When using the UI to manage your templates, you will now find a test button which will allow you to send a template to an end user to test the rendering and delivery with a real user.

## Version 1.18.2

20 July 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--issue-759--1xkk)

Fixed a table sequence issue in PostgreSQL preventing new user creation during migrations.

[759](https://github.com/FusionAuth/fusionauth-issues/issues/759)

## Version 1.18.1

19 July 2020

[Fix](#fix--issue-760--2saa)

Fixed a `500` error occurring when using the edit Application action in the admin UI.

[760](https://github.com/FusionAuth/fusionauth-issues/issues/760)

## Version 1.18.0

19 July 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-18-1--known-issue--via-760--nrmw)

Editing an application in the admin UI resulted in a `500 Internal Server Error`.

Resolved in version [1.18.1](#version-1-18-1) via [760](https://github.com/FusionAuth/fusionauth-issues/issues/760).

[Known Issue](#known-issue--via-759--4swc)

PostgreSQL database sequences were not set correctly, causing a `500` status code when creating new users.

[Known Issue](#known-issue--via-776--ebhs)

An exception occurred when using self service registration that disrupted the user registration workflow.

[Known Issue](#known-issue--via-780--po4y)

A JWT populate lambda using the `registration` parameter failed when using self service registration.

[Breaking Change](#breaking-change--fp07)

Moved Users, Groups, Applications, and Tenants to the top level of the left navigation sidebar.

[New Feature](#new-feature--issue-680--fr1o)

Introduced Advanced Forms allowing custom multi-step registration forms for self-service registration.

[680](https://github.com/FusionAuth/fusionauth-issues/issues/680)

[New Feature](#new-feature--issue-219--tbma)

Introduced the Initial Tech Preview of Connectors to authenticate against external systems (e.g., LDAP).

[219](https://github.com/FusionAuth/fusionauth-issues/issues/219)

[Enhancement](#enhancement--issue-686--thanks-ashokgelal--n5wb)

Added the `Registration URL` property to the Application view dialog.

Thanks to [@ashokgelal](https://github.com/ashokgelal)!

[686](https://github.com/FusionAuth/fusionauth-issues/issues/686)

[Enhancement](#enhancement--issue-754--ro9z)

Reported the node IP address on the About panel in the administrative UI.

[754](https://github.com/FusionAuth/fusionauth-issues/issues/754)

[Enhancement](#enhancement--issue-409--ig6r)

Included the `jti` claim in JSON Web Tokens issued by FusionAuth.

[409](https://github.com/FusionAuth/fusionauth-issues/issues/409)

[Enhancement](#enhancement--issue-755--x0et)

Added `insertInstant` and `lastUpdateInstant` properties to all objects in the JSON API response.

[755](https://github.com/FusionAuth/fusionauth-issues/issues/755)

[Enhancement](#enhancement--issue-715--28ti)

Provided the `x5t` property in the JSON Web Key Set response for public keys stored with a certificate.

[715](https://github.com/FusionAuth/fusionauth-issues/issues/715)

[Fix](#fix--issue-714--thanks-joydeb28--g9yt)

Fixed an issue where the user registration event missed the `registration` property.

Thanks to [@joydeb28](https://github.com/joydeb28)!

[714](https://github.com/FusionAuth/fusionauth-issues/issues/714)

[Fix](#fix--issue-719--thanks-mgetka--u9c5)

Fixed failures when deleting a user with one or more granted consents.

Thanks to [@mgetka](https://github.com/mgetka)!

[719](https://github.com/FusionAuth/fusionauth-issues/issues/719)

[Fix](#fix--issue-724--1oum)

Fixed an issue where the second email was not sent to the parent when using COPPA consent with Email+.

[724](https://github.com/FusionAuth/fusionauth-issues/issues/724)

[Fix](#fix--issue-726--thanks-satazor--ociq)

Fixed an issue where the Refresh Token cookie lacked a `Max-Age` attribute on the JWT Refresh API response.

Thanks to [@satazor](https://github.com/satazor)!

[726](https://github.com/FusionAuth/fusionauth-issues/issues/726)

## Version 1.17.5

3 July 2020

[Fix](#fix--issue-605--gy2k)

Fixed API validation failures on the Audit Log API when a JSON body was omitted.

[605](https://github.com/FusionAuth/fusionauth-issues/issues/605)

[Fix](#fix--issue-649--thanks-joydeb28--who0)

Fixed a bug preventing the Kafka integration from working correctly.

Thanks to [@joydeb28](https://github.com/joydeb28)!

[649](https://github.com/FusionAuth/fusionauth-issues/issues/649)

[Fix](#fix--issue-710--vv30)

Fixed an error caused by invalid Elasticsearch queries generated when selecting an Application in the user search UI on Elasticsearch 7.7.0.

[710](https://github.com/FusionAuth/fusionauth-issues/issues/710)

[Enhancement](#enhancement--issue-666--thanks-soullivaneuh--ec2a)

Added a return to login link to default templates for Passwordless, Register, Forgot, and Password Sent workflows.

Thanks to [@soullivaneuh](https://github.com/soullivaneuh)!

[666](https://github.com/FusionAuth/fusionauth-issues/issues/666)

## Version 1.17.4

25 June 2020

[Fix](#fix--issue-692--gigi)

Fixed a cosmetic JavaScript bug causing the device verification URL field to toggle when grants were enabled/disabled.

[692](https://github.com/FusionAuth/fusionauth-issues/issues/692)

[Fix](#fix--issue-697--k459)

Included Elasticsearch explanation details in Search API error messages when `valid: false` was returned.

[697](https://github.com/FusionAuth/fusionauth-issues/issues/697)

[Fix](#fix--issue-703--thanks-ulybu--8lkh)

Ensured the Apple Service Id override provided per application was correctly utilized instead of the global value.

Thanks to [@ulybu](https://github.com/ulybu)!

[703](https://github.com/FusionAuth/fusionauth-issues/issues/703)

## Version 1.17.3

23 June 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Enhancement](#enhancement--flun)

Allowed modification of the OpenID Connect Identity Provider email claim to support non-standard providers like LinkedIn.

## Version 1.17.2

17 June 2020

[Fix](#fix--issue-685--xo2p)

Fixed validation failures for `parent`, `child`, and other references in email templates requiring null-safe usage.

[685](https://github.com/FusionAuth/fusionauth-issues/issues/685)

## Version 1.17.1

15 June 2020

[Fix](#fix--issue-665--thanks-mgetka--prtd)

Fixed an error occurring when importing a standalone RSA private key via the Key Master UI.

Thanks to [@mgetka](https://github.com/mgetka)!

[665](https://github.com/FusionAuth/fusionauth-issues/issues/665)

[Fix](#fix--issue-671--thanks-maurobennici--87e2)

Fixed an unexpected error displaying for expired Forgot Password links omitting the `client_id` in the URL.

Thanks to [@maurobennici](https://github.com/maurobennici)!

[671](https://github.com/FusionAuth/fusionauth-issues/issues/671)

## Version 1.17.0

2 June 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--6zac)

Migrated Identity Provider configurations lacking reconcile lambdas to utilize lambdas, granting full control over claim extraction.

[Breaking Change](#breaking-change--eos9)

Moved claim mapping functionality into user-modifiable OpenID Connect and SAML v2 reconcile lambdas.

[New Feature](#new-feature--issue-336--w0mr)

Added Sign in with Apple as a new Identity Provider.

[336](https://github.com/FusionAuth/fusionauth-issues/issues/336)

[New Feature](#new-feature--issue-394--ucve)

Introduced One time Use Refresh Tokens, configured at the tenant or application level.

[394](https://github.com/FusionAuth/fusionauth-issues/issues/394)

[New Feature](#new-feature--p81r)

Introduced Sliding Window Refresh Token Expiration based on last usage.

[New Feature](#new-feature--cf7r)

Allowed assigning User Reconcile Lambdas to Facebook, Google, HYPR, and Twitter Identity Providers.

[Enhancement](#enhancement--issue-535--ph1k)

Localized development and runtime errors for external logins.

[535](https://github.com/FusionAuth/fusionauth-issues/issues/535)

[Enhancement](#enhancement--issue-608--24v6)

Made maximum header sizes configurable to prevent `400` errors caused by large cookies.

[608](https://github.com/FusionAuth/fusionauth-issues/issues/608)

[Enhancement](#enhancement--issue-626--kucj)

Stopped returning refresh tokens upon user registration, making the API response consistent with the User Create API.

[626](https://github.com/FusionAuth/fusionauth-issues/issues/626)

[Enhancement](#enhancement--issue-641--b7b6)

Added a warning for SAML v2 Identity Providers regarding CORS filter configurations to assist integration testing.

[641](https://github.com/FusionAuth/fusionauth-issues/issues/641)

[Fix](#fix--issue-587--wfc8)

Displayed errors when attempting to import a key with an invalid length in the Key Master UI.

[587](https://github.com/FusionAuth/fusionauth-issues/issues/587)

[Fix](#fix--issue-623--thanks-flangfeldt--bf9h)

Fixed OAuth errors occurring when changing locales on subsequent themed pages after the initial login panel.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[623](https://github.com/FusionAuth/fusionauth-issues/issues/623)

[Fix](#fix--issue-645--thanks-s-vlade--ob6s)

Fixed a startup failure on Ubuntu caused by a non-POSIX compliant function definition in `setenv.sh`.

Thanks to [@s-vlade](https://github.com/s-vlade)!

[645](https://github.com/FusionAuth/fusionauth-issues/issues/645)

[Fix](#fix--issue-648--thanks-thekoding--ee2t)

Fixed User reconcile process failures when specifying `picture` as a requested field in the Facebook IdP configuration.

Thanks to [@thekoding](https://github.com/thekoding)!

[648](https://github.com/FusionAuth/fusionauth-issues/issues/648)

## Version 1.16.1

18 May 2020

[Fix](#fix--issue-618--thanks-mgetka--uqat)

Fixed an issue where attempting to use silent configurations to set up the database schema without Elasticsearch forced Maintenance Mode.

Thanks to [@mgetka](https://github.com/mgetka)!

[618](https://github.com/FusionAuth/fusionauth-issues/issues/618)

## Version 1.16.0

8 May 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Security](#security--nrh2)

Resolved vulnerabilities in the underlying SAML v2 library (CVE-2020-12676, CSNC-2020-002).

[Breaking Change](#breaking-change--22n6)

Updated the favicon configuration in the default theme.

[New Feature](#new-feature--bnrm)

Returned a list of `applicationIds` from the Identity Provider Lookup API.

[New Feature](#new-feature--sfyg)

Returned the SAML v2 `idpEndpoint` from the Identity Provider Lookup API.

[Fix](#fix--issue-531--thanks-joshuaavalon--pgn6)

Allowed Elasticsearch URLs containing basic auth credentials to function properly.

Thanks to [@joshuaavalon](https://github.com/joshuaavalon)!

[531](https://github.com/FusionAuth/fusionauth-issues/issues/531)

[Fix](#fix--issue-520--thanks-smcoll--l4ad)

Fixed validation errors to correctly return a `400` status code with JSON when using the Import User API with an empty list.

Thanks to [@smcoll](https://github.com/smcoll)!

[520](https://github.com/FusionAuth/fusionauth-issues/issues/520)

[Fix](#fix--issue-423--thanks-downagain--iwmf)

Fixed JavaScript failing on Internet Explorer 11 via the `Helper.js` during external logins.

Thanks to [@downagain](https://github.com/downagain)!

[423](https://github.com/FusionAuth/fusionauth-issues/issues/423)

[Fix](#fix--issue-546--thanks-mgetka--a755)

Ensured the OAuth2 Token endpoint returned the appropriate validation error instead of a general error.

Thanks to [@mgetka](https://github.com/mgetka)!

[546](https://github.com/FusionAuth/fusionauth-issues/issues/546)

[Fix](#fix--issue-583--3tre)

Prevented login failures by handling Facebook `/me/picture` URLs that exceeded 255 characters.

*Thanks to our friends at [famous.co](https://famous.co/) and [frontdoorhome.com](https://www.frontdoorhome.com/) for letting us know!*

[583](https://github.com/FusionAuth/fusionauth-issues/issues/583)

[Fix](#fix--issue-598--ttft)

Fixed validation exceptions caused by email templates referencing values stored in user data.

[598](https://github.com/FusionAuth/fusionauth-issues/issues/598)

[Fix](#fix--issue-600--thanks-arni-inaba--ve98)

Synchronized the Elasticsearch index properly when a webhook failed due to transaction settings.

Thanks to [@arni-inaba](https://github.com/arni-inaba)!

[600](https://github.com/FusionAuth/fusionauth-issues/issues/600)

[Fix](#fix--issue-606--thanks-nscarlson--s3ti)

Fixed SQL migration failures in PostgreSQL due to an extra curly bracket when upgrading without modifying the default tenant.

Thanks to [@nscarlson](https://github.com/nscarlson)!

[606](https://github.com/FusionAuth/fusionauth-issues/issues/606)

## Version 1.16.0

21 April 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--55l6)

Email Send API no longer requires a from email or a default from name, defaults may be taken from the tenant. See the [Emails API](https://4002.18-224-161-104.sslip.io/docs/apis/emails.md) documentation for reference.

[Breaking Change](#breaking-change--nt95)

The OpenID Connect [JSON Web Key Set](https://4002.18-224-161-104.sslip.io/docs/apis/oauth/jwks.md) API endpoint returns only public keys generated by FusionAuth. This endpoint previously also returned imported public keys, for which we do not hold the private key.

[Breaking Change](#breaking-change--issue-596--thanks-ceefour--p6h5)

Next time a release candidate is built, the `latest` tag will be preserved to always be the latest stable release. This way if you are always using the `latest` tag you will not automatically upgrade to a release candidate.

Thanks to [@ceefour](https://github.com/ceefour)!

[596](https://github.com/FusionAuth/fusionauth-issues/issues/596)

[Breaking Change](#breaking-change--8ybi)

The reference `docker-compose.yml` provided by the [fusionauth-containers](https://github.com/FusionAuth/fusionauth-containers) GitHub repo has been modified to install leveraging database as the User search engine. You will need to include the reference `docker-compose.override.yml` in order to install and configure Elasticsearch as the User search engine. See the [Docker installation guide](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/docker.md) for reference.

[New Feature](#new-feature--issue-199--n2fp)

Support for Elasticsearch version 7

*   FusionAuth maintains backward-compatibility with Elasticsearch 6.3.x clusters and indexes.
*   `fusionauth-app.search-engine-type` configuration property and **`FUSIONAUTH_SEARCH_ENGINE_TYPE`** environment variable exposed for configuring the search engine, see the [Configuration](https://4002.18-224-161-104.sslip.io/docs/reference/configuration.md) documentation for reference.
*   A reindex may be necessary depending on how you have upgraded your Elasticsearch cluster. You may issue a reindex in the FusionAuth admin UI under System -> Reindex .

[199](https://github.com/FusionAuth/fusionauth-issues/issues/199)

[New Feature](#new-feature--issue-427--vssd)

Support for using the database as the user search engine. This is now the default configuration. See the [Core Concepts - Users](https://4002.18-224-161-104.sslip.io/docs/get-started/core-concepts/types/users.md#user-search) documentation for details.

*   Use of the database search engine provides limited search capabilities, and has limitations for the Users API, see the [Bulk Delete Users API](https://4002.18-224-161-104.sslip.io/docs/apis/users/bulk-delete.md) and [Search for Users API](https://4002.18-224-161-104.sslip.io/docs/apis/users/search.md) documentation for details.

[427](https://github.com/FusionAuth/fusionauth-issues/issues/427)

[New Feature](#new-feature--pfas)

The Registration API returns an access token within the `token` field of responses to `POST` requests. See the [Registrations API](https://4002.18-224-161-104.sslip.io/docs/apis/registrations.md) documentation for reference.

*   Application registration records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

[New Feature](#new-feature--hkju)

The `applicationId` is now optional for `PUT` requests (update login instants) to the Login API. See the [Login API](https://4002.18-224-161-104.sslip.io/docs/apis/login/update-instant.md) documentation for reference.

*   `PUT` requests to the Login API records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

[New Feature](#new-feature--q02k)

The User API returns an access token within the `token` field of responses to `POST` requests creating a user. See the [User API](https://4002.18-224-161-104.sslip.io/docs/apis/users/create.md) documentation for reference.

*   User creation records a login and will be reflected in the Login, Daily Active User, and Monthly Active User reports within the FusionAuth admin UI.

[New Feature](#new-feature--issue-540--54rw)

System logs can be viewed from the Admin interface. Navigate to System -> Log to view and download the system logs.

*   This feature is available in the UI and via a new API.

[540](https://github.com/FusionAuth/fusionauth-issues/issues/540)

[New Feature](#new-feature--3pbv)

System log export API has been added for retrieving a node's system logs as a compressed zip file. See the [System Logs API](https://4002.18-224-161-104.sslip.io/docs/apis/system.md) documentation for reference.

[New Feature](#new-feature--issue-539--ww3z)

There is a Test SMTP button that you can utilize during an Edit or Add Tenant operation to ensure the correct SMTP configuration.

[539](https://github.com/FusionAuth/fusionauth-issues/issues/539)

[New Feature](#new-feature--7bwe)

Production runtime mode disables maintenance mode, database migrations must be applied manually in this runtime mode. See the [FusionAuth App Installation Guide](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/fusionauth-app.md#runtime-modes) documentation for reference.

[New Feature](#new-feature--clem)

Advanced configuration exposed for search engine type, runtime mode, and Same-Site cookie policy. See the [Configuration](https://4002.18-224-161-104.sslip.io/docs/reference/configuration.md) documentation for reference.

[New Feature](#new-feature--c9ey)

JWT Refresh webhook event, issued when an access token is refreshed by refresh token, see the [Events](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/events/jwt/jwt-refresh.md) documentation for reference.

[New Feature](#new-feature--issue-262--thanks-engineertdog--djt6)

Tenant email configuration provides a default from email and a default from name. See the [Tenants API](https://4002.18-224-161-104.sslip.io/docs/apis/tenants/create-a-tenant.md) documentation for reference.

Thanks to [@engineertdog](https://github.com/engineertdog)!

[262](https://github.com/FusionAuth/fusionauth-issues/issues/262)

[Enhancement](#enhancement--issue-536--thanks-sedough--k4zv)

The OpenID Connect and SAML v2 Reconcile Lambda may now modify the assigned user roles. Prior to this version any changes to the roles were intentionally not preserved. This restriction has been lifted.

Thanks to [@sedough](https://github.com/sedough)!

[536](https://github.com/FusionAuth/fusionauth-issues/issues/536)

[Enhancement](#enhancement--yu6p)

In some cases the `state` parameter returning from external SAML v2 & OpenID Connect identity providers is decoded incorrectly. We are now Base64 encoding this value to preserve it's integrity.

[Security](#security--oo6q)

Updated default CORS configuration for clean installs, see the [CORS Reference](https://4002.18-224-161-104.sslip.io/docs/operate/secure/cors.md#default-configuration) for details. It is highly recommended you modify your CORS configuration to match our new default values unless you have a technical requirement for your existing CORS configuration.

[Security](#security--issue-564--thanks-michael-burt--n301)

Upgrade Handlebars to version `4.7.6` due to a known vulnerability. There is no known exploit of this vulnerability in FusionAuth, this is a pro-active upgrade. FusionAuth uses this JavaScript library in the administrative UI to build dynamic table roles.

*   [https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988](https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988)

Thanks to [@michael-burt](https://github.com/michael-burt)!

[564](https://github.com/FusionAuth/fusionauth-issues/issues/564)

[Internal](#internal--issue-481--r44a)

Java 14. Upgrade from Java 8. The FusionAuth Java runtime has been upgraded to version 14. All external Java packages such as the Java REST client and the Plugin interface are all still compiled against Java 8 so this upgrade should not impact any users.

[481](https://github.com/FusionAuth/fusionauth-issues/issues/481)

[Internal](#internal--2p75)

Upgrade Apache Tomcat to the latest patch version `8.5.53`.

[Internal](#internal--9iv5)

Much smaller Docker images based upon Alpine Linux! Compressed size changed from ~ 150 MB to 76 MB. More features, less size? Yeah, that's right.

*   Check it out for yourself. See the [fusionauth/fusionauth-app](https://hub.docker.com/r/fusionauth/fusionauth-app/tags) repo.

## Version 1.15.8

10 April 2020

[Fix](#fix--issue-548--thanks-lamuertepeluda--oxpr)

When more than one tenant is defined, the redirect to `/oauth2/callback` which is used for 3rd Party SAML v2 or OpenID Connect identity providers will fail unless the corresponding application is in the default tenant. This issue was introduced in `1.15.6` which means it only affects version `1.15.6`. If you encounter this issue you may be shown an error on the login page indicating `A validation error occurred during the login attempt. An event log was created for the administrator to review.`.

Thanks to [@lamuertepeluda](https://github.com/lamuertepeluda)!

[548](https://github.com/FusionAuth/fusionauth-issues/issues/548)

[Fix](#fix--issue-553--thanks-ulybu--sriw)

A callback from a Social IdP configuration may fail to complete the login workflow. This issue was introduced in `1.15.6` which means it only affects version `1.15.6` and `1.15.7`.

Thanks to [@ulybu](https://github.com/ulybu)!

[553](https://github.com/FusionAuth/fusionauth-issues/issues/553)

[Enhancement](#enhancement--issue-468--thanks-davidmw--kx7l)

When a user attempts to utilize an expired Passwordless or Forgot Password link, FusionAuth will now still be able to allow the user to restart the login workflow.

*   In order to take advantage of this enhancement, you will need to upgrade your email template for one or both of these workflows. See the [Email Templates](https://4002.18-224-161-104.sslip.io/docs/email/email-templates.md) documentation for a reference usage.

Thanks to [@davidmw](https://github.com/davidmw)!

[468](https://github.com/FusionAuth/fusionauth-issues/issues/468)

## Version 1.15.7

30 March 2020

[Fix](#fix--5s77)

Due to a change in how FusionAuth encodes the `RelayState` value when redirecting to a 3rd party SAML v2 identity providers, the authentication request will fail with an OAuth2 error. This issue was introduced in `1.15.6` which means it only affects version `1.15.6`.

## Version 1.15.6

27 March 2020

[Fix](#fix--issue-524--thanks-mgetka--woiv)

Handle tabs and other control characters in an included text file when parsing the Kickstart configuration files.

Thanks to [@mgetka](https://github.com/mgetka)!

[524](https://github.com/FusionAuth/fusionauth-issues/issues/524)

[Fix](#fix--issue-533--ih8o)

When the FusionAuth Reactor is enabled, a breach detection is incorrectly requested during a user update when the password is not being modified. You may see errors in the Event Log indicating Reactor returned a status code of `400`, this error is just noise and it did not affect the requested action.

[533](https://github.com/FusionAuth/fusionauth-issues/issues/533)

[Fix](#fix--issue-537--wzfn)

When running FusionAuth on an un-secured connection during development, newer versions of the Chrome browser will reject the `Set-Cookie` request in the HTTP response because the `SameSite` attribute is not set.

[537](https://github.com/FusionAuth/fusionauth-issues/issues/537)

[Enhancement](#enhancement--issue-538--tbgu)

When integrating with 3rd Party Identity Providers FusionAuth will build a `state` parameter in order to complete the FusionAuth OAuth2 or SAML v2 request on the callback from the 3rd Party IdP. There are times when a 3rd Party IdP may un-intentionally modify the `state` parameter by decoding the value. When the `state` parameter is not returned to FusionAuth the way it was sent the integration breaks. FusionAuth will now Bas64 encode the `state` value to better defend against 3rd Party IdP integrations.

[538](https://github.com/FusionAuth/fusionauth-issues/issues/538)

## Version 1.15.5

16 March 2020

[Fix](#fix--issue-512--thanks-mgetka--9orb)

Adding a Consent to a User that does not have a First or Last Name. This was causing an error in the UI where the Add Consent dialog was not rendering and instead displaying a stack trace.

Thanks to [@mgetka](https://github.com/mgetka)!

[512](https://github.com/FusionAuth/fusionauth-issues/issues/512)

[Fix](#fix--issue-514--a6o8)

When Reactor is enabled and more than one user requires action due to a breached password the Reactor index page will fail to render.

*   Thanks to our friends at Frontdoor for reporting the issue.

[514](https://github.com/FusionAuth/fusionauth-issues/issues/514)

[Fix](#fix--issue-517--thanks-vburghelea--56z4)

When adding a new Tenant in the UI you may encounter a `500` status code with a `FusionAuth encountered an unexpected error.` message. If you encounter this error, edit the default tenant, click save and then retry the add operation.

Thanks to [@vburghelea](https://github.com/vburghelea)!

[517](https://github.com/FusionAuth/fusionauth-issues/issues/517)

[Fix](#since-1-15-3--fix--issue-518--thanks-irzhywau--1cvg)

A JavaScript exception was causing the ExternalJWT identity mapping dialog to fail. A work around is to use the API to add these claim mappings.

Since: [1.15.3](#version-1-15-3)

Thanks to [@irzhywau](https://github.com/irzhywau)!

[518](https://github.com/FusionAuth/fusionauth-issues/issues/518)

## Version 1.15.4

10 March 2020

[Fix](#fix--issue-505--thanks-leafknode--9erg)

When using PostgreSQL and using the Import User API with a large amount of roles assigned to user FusionAuth may exceed the maximum allowed parameterized values in a prepared statement causing a SQL exception. If you encounter this issue you may work around the issue by reducing the size of your import request to 200-500 users per request.

Thanks to [@leafknode](https://github.com/leafknode)!

[505](https://github.com/FusionAuth/fusionauth-issues/issues/505)

[Fix](#fix--issue-509--thanks-mgetka--2ksr)

When creating a user through Kickstart with `passwordChangeRequired` set to `true` and exception will occur during the next login request. This issue was introduced in version 1.15.0.

Thanks to [@mgetka](https://github.com/mgetka)!

[509](https://github.com/FusionAuth/fusionauth-issues/issues/509)

[Fix](#fix--issue-510--thanks-mgetka--lihq)

When a Kickstart file contains multi-byte characters the string value may not be encoded properly if the default file encoding is not UTF-8. This has now been resolved by explicitly requesting UTF-8 encoding during file I/O.

Thanks to [@mgetka](https://github.com/mgetka)!

[510](https://github.com/FusionAuth/fusionauth-issues/issues/510)

[Fix](#fix--issue-511--co4z)

When using the SAML IdP configuration where FusionAuth is the SAML service provider if the base64 encoded SAML response from the IdP contains line returns FusionAuth will fail to parse the request and the login request will fail.

[511](https://github.com/FusionAuth/fusionauth-issues/issues/511)

## Version 1.15.3

27 February 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--ov3b)

The External JWT Identity Provider now manages keys used for token verification in the Key Master. All keys have been migrated to Key Master, and going forward all keys can be managed through the Key Master.

[Breaking Change](#breaking-change--6l47)

Prior to this version the OpenID Connect IdP would send the client secret using the `client_secret_basic` and the `client_secret_post` method. This was done for compatibility with providers that did not utilize the `client_secret_basic` method. Now this configuration is now provided and only the configured client authentication method will be used.

[Fix](#fix--issue-399--thanks-johnmaia--qt03)

Using the JWT Refresh API with a JWT issued from one tenant for a user in another tenant. This error was causing an exception instead of the proper validation error being returned to the caller. A `404` will now properly be returned when this scenario occurs.

Thanks to [@johnmaia](https://github.com/johnmaia)!

[399](https://github.com/FusionAuth/fusionauth-issues/issues/399)

[Fix](#fix--issue-450--thanks-graafg--6i2i)

Missing API validation on the `/oauth2/passwordless` endpoint. A `500` was returned instead of the correct validation errors.

Thanks to [@GraafG](https://github.com/GraafG)!

[450](https://github.com/FusionAuth/fusionauth-issues/issues/450)

[Fix](#fix--issue-482--thanks-nulian--wl7k)

On systems running MySQL, the SQL migration for `1.15.0` on the `DELIMITER` command and causes the instance table to have a null `license_id`. If you have previously connected your support contract Id with your instance and upgraded to a previous `1.15.x` version, you will need to reconnect your license Id in the Reactor tab. This issue was introduced in version 1.15.0.

Thanks to [@nulian](https://github.com/nulian)!

[482](https://github.com/FusionAuth/fusionauth-issues/issues/482)

[Fix](#fix--issue-11--thanks-minjup--u3gz)

The `CancelAction` method in the .NET Core client returning field error due to incorrect method definition.

Thanks to [@minjup](https://github.com/minjup)!

[11](https://github.com/FusionAuth/fusionauth-issues/issues/11)

[Fix](#since-1-15-3--fix--issue-445--thanks-ovrdoz--d24i)

The OpenID Connect IdP client authentication method is now configurable as `client_secret_basic`, `client_secret_post`, or `none` and will authenticate solely with the configured method. See the [OIDC spec concerning Client Authentication](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication) for more information.

*   The `1.15.3` database migration configures the client authentication method to `client_secret_basic` for identity provider configurations with a client secret defined, and `none` for those without a client secret defined. If your OpenID Connect provider requires `client_secret_post` you will need to update your configuration to ensure the integration continues to function properly. Discord is one of the known IdPs that requires the `client_secret_post` client authentication method.
*   See the [OpenID Connect Identity Providers](https://4002.18-224-161-104.sslip.io/docs/apis/identity-providers/openid-connect.md) APIs, the [OpenID Connect Identity Provider Overview](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers.md) and the [Discord OIDC integration tutorial](https://4002.18-224-161-104.sslip.io/docs/lifecycle/authenticate-users/identity-providers/gaming/discord.md) for more detail.

Since: [1.15.3](#version-1-15-3)

Thanks to [@ovrdoz](https://github.com/ovrdoz)!

[445](https://github.com/FusionAuth/fusionauth-issues/issues/445)

[Fix](#fix--issue-496--qud6)

When you have enabled Self Service Registration and Registration Verification FusionAuth will fail to send the email to the end user during this workflow.

[496](https://github.com/FusionAuth/fusionauth-issues/issues/496)

[Fix](#fix--issue-495--izmh)

If a Two-Factor Trust has been established with a particular browser through the user of a cookie, it was not being honored during the Passwordless Email workflow and the user would be prompted for the Two-Factor challenge during each login attempt.

[495](https://github.com/FusionAuth/fusionauth-issues/issues/495)

[Fix](#fix--issue-488--thanks-sedough--v3ef)

When using managed domains with the OpenID Connect or SAML v2 Identity Provider configurations the callback to FusionAuth may fail with an error.

Thanks to [@sedough](https://github.com/sedough)!

[488](https://github.com/FusionAuth/fusionauth-issues/issues/488)

[Fix](#fix--issue-489--thanks-snmed--nhsi)

When a stylesheet in your theme contains `>` the new HTML escaping strategy introduced in version X causes this value in the CSS to be incorrectly escaped. If you encounter this problem in your current them, update the usage of the stylesheet to `${theme.stylesheet()?no_esc}` instead of the previous usage of `${theme.stylesheet()}`.

Thanks to [@snmed](https://github.com/snmed)!

[489](https://github.com/FusionAuth/fusionauth-issues/issues/489)

[Fix](#fix--issue-493--thanks-tst-dhudlow--qaou)

Fix a Kickstart bug, when a variable is used in the very first API key the replacement was not honored.

Thanks to [@tst-dhudlow](https://github.com/tst-dhudlow)!

[493](https://github.com/FusionAuth/fusionauth-issues/issues/493)

[Enhancement](#enhancement--issue-491--gc25)

When the External JWT Identity Provider does not have any managed domains defined, allow a JWT from any domain to be reconciled. This change makes this IdP configuration more consistent with our IdP configurations that allow for managed domains.

[491](https://github.com/FusionAuth/fusionauth-issues/issues/491)

## Version 1.15.2

19 February 2020

[Known Issue](#v-1-15-3--known-issue--ocza)

On systems running MySQL, the `1.15.0` migration fails on a `DELIMITER` command and causes the instance table to have a null `license_id`. If you upgraded to `1.15.1`, have connected our instance to a support contract, and ran the `1.15.0` migration using maintenance mode, you will need to reconnect your license Id in the Reactor tab.

*   A workaround for this issue is to download the `fusionauth-database-schema-1.15.0.zip` from [our direct download page](https://4002.18-224-161-104.sslip.io/direct-download.md), unzip and manually apply the `migrations/mysql/1.15.0.sql` migration. You may also wait to upgrade until `1.15.3` is available and allow maintenance mode to run the fixed migration.

[Fix](#fix--em3f)

Password breached fixes. On some systems running PostgreSQL a portion of the breach detections features may not function properly. If you are running MySQL this will not affect you, and only certain PostgreSQL versions are affected. If you are not using FusionAuth Reactor this issue will not affect you.

## Version 1.15.1

18 February 2020

[Known Issue](#v-1-15-3--known-issue--ocza)

On systems running MySQL, the `1.15.0` migration fails on a `DELIMITER` command and causes the instance table to have a null `license_id`. If you upgraded to `1.15.1`, have connected our instance to a support contract, and ran the `1.15.0` migration using maintenance mode, you will need to reconnect your license Id in the Reactor tab.

*   A workaround for this issue is to download the `fusionauth-database-schema-1.15.0.zip` from [our direct download page](https://4002.18-224-161-104.sslip.io/direct-download.md), unzip and manually apply the `migrations/mysql/1.15.0.sql` migration. You may also wait to upgrade until `1.15.3` is available and allow maintenance mode to run the fixed migration.

[Fix](#fix--lc0t)

A SQL statement in PostgreSQL may cause some `9.x` versions to fail to store breach metrics once FusionAuth Reactor has been enabled. If you are running MySQL this will not affect you, and only certain PostgreSQL versions are affected. If you are not using FusionAuth Reactor this issue will not affect you.

## Version 1.15.0

17 February 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Known Issue](#v-1-15-1--known-issue--xs7r)

Some versions of PostgreSQL may cause an exception when storing breach metrics after enabling FusionAuth Reactor. If you are not using FusionAuth Reactor or you are using MySQL instead of PostgreSQL this issue will not affect you.

[Known Issue](#v-1-15-3--known-issue--vxcx)

On systems running MySQL, the `1.15.0` migration fails on a `DELIMITER` command and causes the instance table to have a null `license_id`. If you upgraded to `1.15.0`, have connected our instance to a support contract, and ran the `1.15.0` migration using maintenance mode, you will need to reconnect your license Id in the Reactor tab.

*   A workaround for this issue is to download the `fusionauth-database-schema-1.15.0.zip` from [our direct download page](https://4002.18-224-161-104.sslip.io/direct-download.md), unzip and manually apply the `migrations/mysql/1.15.0.sql` migration. You may also wait to upgrade until `1.15.3` is available and allow maintenance mode to run the fixed migration.

[Breaking Change](#breaking-change--658o)

In the FusionAuth admin UI you will notice that User, Groups, Applications and Tenants are all now at the top level of the left navigation sidebar. This change has been done to provide quicker access to these frequently accessed menus.

[New Feature](#new-feature--9i97)

FusionAuth Reactor ™. FusionAuth Reactor is available with all paid plans of FusionAuth. The first feature in the Reactor suite will be breached password detection. All passwords will be checked against a breached list during all password change events, and optionally during login based upon your configuration.

[New Feature](#new-feature--tiv6)

New webhook event for use with FusionAuth Reactor breached password detection. This event when enabled will be fired during login if the user is using a vulnerable password.

*   User Password Breach (`user.password.breach`), see [Webhook Events](https://4002.18-224-161-104.sslip.io/docs/extend/events-and-webhooks/events.md) for additional information.

[New Feature](#new-feature--uiuy)

New Tenant configuration in support of FusionAuth Reactor and additional password validation rules. This configuration can be found in the Password tab of the Tenant configuration on the [Tenant](https://4002.18-224-161-104.sslip.io/docs/apis/tenants.md) API.

*   `tenant.passwordValidationRules.validateOnLogin` - When enabled the user's password will be validated during login. If the password does not meet the currently configured validation rules the user will be required to change their password. Prior to this release password validation was only ever performed during a change event, you may now optionally enforce your password policy during login.
*   `tenant.passwordValidationRules.breachDetection` - A new object to provide configuration per tenant for password breach detection.

[New Feature](#new-feature--m9ez)

During login, if the user is required to change their password, the Login API, Authorization Code Grant, Implicit Grant and Password Grant will now also return a change reason. This additional value in the response will indicate why the user is being required to change their password.

*   See the [Login](https://4002.18-224-161-104.sslip.io/docs/apis/login.md) API, and corresponding [OAuth endpoints](https://4002.18-224-161-104.sslip.io/docs/apis/oauth.md) for more detail.

[Security](#security--issue-454--thanks-johnmaia--3eia)

A small window exists after a Refresh Token has expired when this token can still be used under specific circumstances. This symptom only occurs when using the `/api/jwt/refresh` API, and not when using the Refresh Grant using the `/oauth/token` endpoint. In a worst case scenario the Refresh Token may be honored up to 5 hours after the expiration date, in most circumstances it will be much less. This only applies to expired Refresh Tokens, revoking a Refresh Token is not affected.

Thanks to [@johnmaia](https://github.com/johnmaia)!

[454](https://github.com/FusionAuth/fusionauth-issues/issues/454)

[Fix](#fix--issue-471--thanks-dhait--21ra)

Editing a Group in a Tenant that does not yet have any Applications created causes and exception when you attempt to save the edit form in the FusionAuth admin UI.

Thanks to [@dhait](https://github.com/dhait)!

[471](https://github.com/FusionAuth/fusionauth-issues/issues/471)

[Fix](#fix--issue-472--ua8s)

When Self Service Registration, if Registration Verification is enabled and Email Verification is disabled the user will not receive a Registration Verification email.

[472](https://github.com/FusionAuth/fusionauth-issues/issues/472)

[Fix](#fix--issue-479--a5u3)

An exception may occur when using the Import User API if you are missing the `applicationId` property in a User Registration. This error should have been found as a validation error and instead an exception occurred.

*   Thanks to our friends at Integra Financial Services for reporting the error.

[479](https://github.com/FusionAuth/fusionauth-issues/issues/479)

[Enhancement](#enhancement--issue-477--qdof)

Allow Kickstart to better handle varying startup times and delays. A few users reported scenarios where Kickstart would begin before FusionAuth was ready causing Kickstart to fail.

[477](https://github.com/FusionAuth/fusionauth-issues/issues/477)

## Version 1.14.0

22 January 2020

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Theme Upgrade](#theme-upgrade--vacd)

Made a change to themes that only impacts advanced HTML escaping in themed templates. Removed any usage of `?html` in themed templates; FusionAuth now handles this automatically.

[Breaking Change](#breaking-change--issue-387--eyh7)

A JWT Populate Lambda now has fewer reserved claims. All claims can now be removed or modified except for `exp`, `iat` and the `sub` claims by the JWT Populate Lambda. You remove or modify claims added by FusionAuth at your own peril.

*   See [JWT Populate](https://4002.18-224-161-104.sslip.io/docs/extend/code/lambdas/jwt-populate.md) for additional details.

[387](https://github.com/FusionAuth/fusionauth-issues/issues/387)

[Breaking Change](#breaking-change--issue-424--shve)

Added additional fields that can be merged by the `PATCH` HTTP method. The following fields were not being merge, but replaced. The limitation of this change is that it is difficult to remove fields from values from arrays. A future enhancement may be to support the [JSON Patch](https://github.com/FusionAuth/fusionauth-issues/issues/441) specification which provides semantics for add, replace and remove.

*   `User.preferredLanguages`
*   `User.memberships`
*   `User.registrations`
*   `User.data`
*   `UserRegistration.data`
*   `UserRegistration.preferredLanguages`
*   `UserRegistration.roles`
*   `Application.data`

[424](https://github.com/FusionAuth/fusionauth-issues/issues/424)

[New Feature](#new-feature--issue-170--le9h)

[Kickstart](https://4002.18-224-161-104.sslip.io/docs/get-started/download-and-install/development/kickstart.md)™ allows you bypass the Setup Wizard in order to FusionAuth up and running quickly. Deploy development or production instances of FusionAuth using a pre-defined configuration of Users, Groups, Applications, Tenants, Templates, API keys, etc.

*   This feature is in *Tech Preview* which means if we find shortcomings with the design as we gather feedback from end users it is possible we will make breaking changes to the feature to correct or enhance the functionality. Any such changes will be documented in future release notes as appropriate.

[170](https://github.com/FusionAuth/fusionauth-issues/issues/170)

[New Feature](#new-feature--issue-311--itaj)

The Tenant API can optionally take a new `sourceTenantId` parameter to allow you to create a new Tenant using the values from an existing Tenant. Using the `sourceTenantId` limits the required parameters to the Tenant name.

[311](https://github.com/FusionAuth/fusionauth-issues/issues/311)

[New Feature](#new-feature--issue-413--s8r7)

Add a View action to a Group Membership in the Membership tab of the Manage User panel in the UI.

[413](https://github.com/FusionAuth/fusionauth-issues/issues/413)

[Fix](#fix--soa1)

A memory leak in the Nashorn JavaScript engine used to execute FusionAuth Lambdas has been resolved.

[Fix](#fix--issue-432--mp9u)

The OAuth2 Authorization Code grant was required to complete a SAMLv2 login, this grant is no longer required to be enabled.

[432](https://github.com/FusionAuth/fusionauth-issues/issues/432)

[Fix](#fix--17i5)

Added missing `theme_manager` role to the FusionAuth application

## Version 1.13.2

30 December 2019

[Fix](#fix--l6kv)

Displayed the status properly on every node during a reindex operation when viewing the User Search or the Reindex pages in the UI.

[Fix](#fix--issue-318--thanks-nikos--le3j)

Improved Kafka configuration validation when using the Test button in the UI.

Thanks to [@nikos](https://github.com/nikos)!

[318](https://github.com/FusionAuth/fusionauth-issues/issues/318)

[Fix](#fix--issue-414--thanks-karice--tmbm)

Resolved an exception that occurred when using ReactNative with FusionAuth when an HTTP Origin header was sent with a value of `file://`.

Thanks to [@karice](https://github.com/karice)!

[414](https://github.com/FusionAuth/fusionauth-issues/issues/414)

[Fix](#fix--issue-416--thanks-downagain--9zt5)

Resolved an exception that occurred when an invalid or expired code was used on a Passwordless login request.

Thanks to [@downagain](https://github.com/downagain)!

[416](https://github.com/FusionAuth/fusionauth-issues/issues/416)

[Fix](#fix--issue-418--thanks-jonasdoe--bx6s)

Sent the `user.verified` event when a user email was verified implicitly due to a change password action that originated via an email request.

Thanks to [@JonasDoe](https://github.com/JonasDoe)!

[418](https://github.com/FusionAuth/fusionauth-issues/issues/418)

## Version 1.13.1

19 December 2019

[Breaking Change](#breaking-change--i4m1)

Rebuilt the Elasticsearch index as part of the upgrade due to a modification supporting searches on nested collections.

[Fix](#since-1-13-0--fix--yp9x)

Kicked off an Elasticsearch reindex operation to correct the search index state caused by the 1.13.0 migration not running as intended.

Since: [1.13.0](#version-1-13-0)

## Version 1.13.0

18 December 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#v-1-13-1--breaking-change--l5an)

Required a manual search index rebuild if it was not automatically started during the upgrade.

[New Feature](#new-feature--issue-360--pibz)

Deleted users who had not verified their email address after a specified duration.

[360](https://github.com/FusionAuth/fusionauth-issues/issues/360)

[New Feature](#new-feature--issue-360--hhfd)

Deleted application registrations of users who had not verified their registration after a specified duration.

[360](https://github.com/FusionAuth/fusionauth-issues/issues/360)

[New Feature](#new-feature--issue-361--fqk8)

Supported deleting Users by Search Query in the Bulk Delete Users API.

[361](https://github.com/FusionAuth/fusionauth-issues/issues/361)

[Fix](#fix--issue-402--thanks-radicaljohan--r9wj)

Allowed the newly supported `PATCH` HTTP method to be selected from the API key endpoint security settings.

Thanks to [@radicaljohan](https://github.com/radicaljohan)!

[402](https://github.com/FusionAuth/fusionauth-issues/issues/402)

[Fix](#fix--a66s)

Made the newly supported `PATCH` HTTP method configurable in the CORS filter.

[Fix](#fix--issue-410--thanks-tanguygiton--bekn)

Resolved an issue where an empty salt value recommended in an error message was failing validation during Import.

Thanks to [@TanguyGiton](https://github.com/TanguyGiton)!

[410](https://github.com/FusionAuth/fusionauth-issues/issues/410)

[Fix](#fix--issue-400--thanks-jesperwe--isxl)

Resolved an exception that occurred when using the `PATCH` method on the User API when more than one tenant existed.

Thanks to [@JesperWe](https://github.com/JesperWe)!

[400](https://github.com/FusionAuth/fusionauth-issues/issues/400)

[Enhancement](#enhancement--issue-361--jlef)

Allowed `DELETE /api/user/bulk` to take `queryString` and `query` parameters to search for users to delete by Elasticsearch.

[361](https://github.com/FusionAuth/fusionauth-issues/issues/361)

[Enhancement](#enhancement--issue-361--2v17)

Allowed `POST /api/user/search` and `GET /api/user/search` to take a `query` parameter for raw JSON queries.

[361](https://github.com/FusionAuth/fusionauth-issues/issues/361)

[Enhancement](#enhancement--tnjk)

Added new `sortFields` parameter to `/api/user/search` for sorting results.

[Enhancement](#enhancement--issue-386--thanks-davidmw--vpcx)

Removed the 191-character constraint on Webhook URLs as they are no longer required to be unique.

Thanks to [@davidmw](https://github.com/davidmw)!

[386](https://github.com/FusionAuth/fusionauth-issues/issues/386)

## Version 1.12.0

8 December 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--1s8g)

Added `OAuth device complete` and `OAuth2 wait` templates, requiring existing themes to be upgraded instead of auto-migrating templates.

[Breaking Change](#breaking-change--iupj)

Added new theme messages for external authentication waiting states.

[Breaking Change](#breaking-change--khgj)

Changed how events are sent to Webhooks when the Transaction configuration does not require any webhooks to succeed, processing them asynchronously to increase performance.

[New Feature](#new-feature--hq9m)

Supported HYPR IdP native integration to bring passwordless and biometric options.

[New Feature](#new-feature--issue-351--thanks-nicholasbutlin--mchj)

Added "Send password reset" administrative action to the Manage Users panel.

Thanks to [@nicholasbutlin](https://github.com/nicholasbutlin)!

[351](https://github.com/FusionAuth/fusionauth-issues/issues/351)

[New Feature](#new-feature--lj19)

Added "Resend email verification" and "Resend verification" administrative actions.

[Fix](#fix--issue-328--thanks-alvmf1--80yj)

Resolved a missing tenant error when modifying user actions with multi-tenants.

Thanks to [@AlvMF1](https://github.com/AlvMF1)!

[328](https://github.com/FusionAuth/fusionauth-issues/issues/328)

[Fix](#fix--issue-347--thanks-uncledent--h2ut)

Resolved an issue where the JWT Validate endpoint returned the wrong precision for `iat` and `exp` claims.

Thanks to [@uncledent](https://github.com/uncledent)!

[347](https://github.com/FusionAuth/fusionauth-issues/issues/347)

[Fix](#fix--issue-382--thanks-colingm--zd8l)

Resolved an issue where a Refresh Token was not returned from the Login API when using the OTP from the Change Password API.

Thanks to [@colingm](https://github.com/colingm)!

[382](https://github.com/FusionAuth/fusionauth-issues/issues/382)

[Fix](#fix--issue-379--thanks-karice--oa8k)

Handled "null" Origin headers to prevent exceptions when validating authorized origins.

Thanks to [@karice](https://github.com/karice)!

[379](https://github.com/FusionAuth/fusionauth-issues/issues/379)

[Fix](#fix--issue-377--thanks-smoorsausje--hybw)

Improved handling on the Start Passwordless API when a user does not exist.

Thanks to [@smoorsausje](https://github.com/smoorsausje)!

[377](https://github.com/FusionAuth/fusionauth-issues/issues/377)

[Enhancement](#enhancement--2rom)

Disassociated UserActions instead of deleting them when a user is deleted via the User Delete API.

[Enhancement](#enhancement--sbjt)

Supported taking a User Action on a user in a different tenant via the admin UI.

[Enhancement](#enhancement--issue-121--f6pb)

Supported the `PATCH` HTTP method across multiple APIs and FusionAuth client libraries.

[121](https://github.com/FusionAuth/fusionauth-issues/issues/121)

[Enhancement](#enhancement--9lcs)

Accepted encoded JWTs in the Authorization header under both `Bearer` and `JWT` schemas.

[Enhancement](#enhancement--issue-331--thanks-davidmw--jbhh)

Added an in-progress indicator to the login panel during external logins.

Thanks to [@davidmw](https://github.com/davidmw)!

[331](https://github.com/FusionAuth/fusionauth-issues/issues/331)

## Version 1.11.0

29 October 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Security](#security--p0s7)

Removed the possibility of malicious code execution through a FreeMarker template (CVE-2020-7799).

[Breaking Change](#breaking-change--issue-332--thanks-davidmw--67r8)

Removed the `sid` and `iss` request parameters from the URL provided by `post_logout_redirect_uri`.

Thanks to [@davidmw](https://github.com/davidmw)!

[332](https://github.com/FusionAuth/fusionauth-issues/issues/332)

[Breaking Change](#breaking-change--hw7f)

Added the `OAuth device` themed template and associated theme messages to support the OAuth Device Grant feature.

[Breaking Change](#breaking-change--fj1q)

Added `response_mode` and `user_code` hidden fields to `_helpers.ftl` for device grant support.

[New Feature](#new-feature--issue-320--ygpc)

Added support for the OAuth2 Device Authorization Grant.

[320](https://github.com/FusionAuth/fusionauth-issues/issues/320)

[New Feature](#new-feature--issue-159--thanks-bertiehub--wibl)

Supported the `response_mode` request parameter during the Authorization Code grant and Implicit grant workflows.

Thanks to [@bertiehub](https://github.com/bertiehub)!

[159](https://github.com/FusionAuth/fusionauth-issues/issues/159)

[New Feature](#new-feature--issue-175--ntk7)

Added an additional API in support of Passwordless Login (Start, Send, Complete workflow).

[175](https://github.com/FusionAuth/fusionauth-issues/issues/175)

[New Feature](#new-feature--issue-121--gr9x)

Provided a developer preview of the `PATCH` HTTP method on select APIs.

[121](https://github.com/FusionAuth/fusionauth-issues/issues/121)

[Fix](#fix--issue-317--thanks-alvmf1--26lm)

Returned a `400` status code on the Import API when a foreign key constraint caused the import to fail.

Thanks to [@AlvMF1](https://github.com/AlvMF1)!

[317](https://github.com/FusionAuth/fusionauth-issues/issues/317)

[Fix](#fix--issue-321--i5m1)

Returned a `401` status code on the `Userinfo` endpoint for invalid tokens.

[321](https://github.com/FusionAuth/fusionauth-issues/issues/321)

[Fix](#fix--issue-322--thanks-pawpro--nmcl)

Fixed Passwordless login external identifier complexity settings.

Thanks to [@pawpro](https://github.com/pawpro)!

[322](https://github.com/FusionAuth/fusionauth-issues/issues/322)

[Fix](#fix--issue-330--thanks-jesperwe--yayh)

Resolved an error incorrectly displayed on the Forgot Password form when the code was valid.

Thanks to [@JesperWe](https://github.com/JesperWe)!

[330](https://github.com/FusionAuth/fusionauth-issues/issues/330)

[Fix](#fix--issue-326--thanks-johnmaia--grg0)

Resolved an exception thrown during a key cache reload request when a large number of tenants existed.

Thanks to [@johnmaia](https://github.com/johnmaia)!

[326](https://github.com/FusionAuth/fusionauth-issues/issues/326)

[Fix](#fix--issue-350--thanks-paulspencerwilliams--hplt)

Resolved logout issues by adopting an alternative strategy for resolving `client_id` when using `id_token_hint`.

Thanks to [@paulspencerwilliams](https://github.com/paulspencerwilliams)!

[350](https://github.com/FusionAuth/fusionauth-issues/issues/350)

[Fix](#fix--q1qb)

Supported SAML SPs that do not send the `<samlp:NameIDPolicy />` constraint, defaulting to email address format.

[Enhancement](#enhancement--issue-324--v9xc)

Added a new `Logout behavior` attribute to make front-channel logout more flexible.

[324](https://github.com/FusionAuth/fusionauth-issues/issues/324)

[Enhancement](#enhancement--qw7n)

Defaulted `fields` and `permissions` parameters to `email` on create for the Facebook IdP configuration.

[Enhancement](#enhancement--npd3)

Allowed the Passwordless Send API to accept an optional `code` parameter generated by the Passwordless Start API.

## Version 1.10.1

1 October 2019

[Fix](#since-1-9-0--fix--w06t)

Resolved an issue where logging into Google or other external IdPs for an Application outside the default tenant failed.

Since: [1.9.0](#version-1-9-0)

[Fix](#fix--issue-314--thanks-raghavsalotra--ydec)

Resolved a `500` status code error during the processing of the SAML v2 response from a SAML v2 IdP.

Thanks to [@Raghavsalotra](https://github.com/Raghavsalotra)!

[314](https://github.com/FusionAuth/fusionauth-issues/issues/314)

## Version 1.10.0

30 September 2019

[Breaking Change](#breaking-change--tzzu)

Added an `OAuth logout` themed template and associated messages to support the OpenID Connect Front Channel logout feature.

[New Feature](#new-feature--issue-256--5imz)

Added support for the OpenID Connect Front Channel logout draft specification.

[256](https://github.com/FusionAuth/fusionauth-issues/issues/256)

[Fix](#since-1-9-0--fix--fadu)

Resolved an issue where the Send email API could fail with a `500`.

Since: [1.9.0](#version-1-9-0)

[Fix](#fix--issue-287--thanks-prasanna10021991--rnql)

Fixed a SAML v2 Invalid Redirect issue.

Thanks to [@prasanna10021991](https://github.com/prasanna10021991)!

[287](https://github.com/FusionAuth/fusionauth-issues/issues/287)

[Enhancement](#enhancement--issue-309--thanks-tauinger-de--stm3)

Allowed request parameters on the Authorization endpoint in the OIDC relying party configuration to integrate with Twitch.

Thanks to [@tauinger-de](https://github.com/tauinger-de)!

[309](https://github.com/FusionAuth/fusionauth-issues/issues/309)

## Version 1.9.2

24 September 2019

[Fix](#fix--issue-306--thanks-flangfeldt--rm42)

Resolved an inability to login if one or more themes were defined prior to the upgrade.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[306](https://github.com/FusionAuth/fusionauth-issues/issues/306)

## Version 1.9.1

23 September 2019

[Fix](#fix--qtxt)

Resolved an exception that occurred when attempting to edit and save the name of the default FusionAuth theme.

## Version 1.9.0

23 September 2019

[New Feature](#new-feature--6677)

Added full theme localization support for errors and all other text.

[Fix](#fix--issue-294--thanks-tauinger-de--nxbf)

Resolved a template validation failure when editing an email template containing `${user.tenantId}`.

Thanks to [@tauinger-de](https://github.com/tauinger-de)!

[294](https://github.com/FusionAuth/fusionauth-issues/issues/294)

[Fix](#fix--issue-301--thanks-jerryhopper--i1be)

Prevented soft-locked accounts from logging in via Google or other external identity providers by returning a `423` status code.

Thanks to [@jerryhopper](https://github.com/jerryhopper)!

[301](https://github.com/FusionAuth/fusionauth-issues/issues/301)

## Version 1.8.1 RC1

10 September 2019

[Fix](#fix--e7gf)

Resolved a SQL migration issue present in `1.8.0-RC.1` related to `null` values in the `applications_id` column.

[Fix](#fix--wa3f)

Resolved an issue where performing a clean install of `1.8.0-RC.1` failed in some cases.

[Fix](#fix--6iw6)

Resolved an issue where external IdP logins redirected users to an invalid `/password/change` state when a password change was required.

## Version 1.8.0 RC1

8 September 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#v-1-8-0--breaking-change--txgg)

Noted a known SQL issue that may cause migration to fail if `user_external_ids` contained null `applications_id` values.

[Breaking Change](#breaking-change--lkbg)

Moved previously global configurations (SMTP, Events, Passwords, JWT, Themes) to the Tenant configuration for multi-tenant flexibility.

[Breaking Change](#breaking-change--9kfs)

Required `tenantId` to be provided on requests using an HTTP request parameter when utilizing themes to ensure correct rendering.

[Breaking Change](#breaking-change--cnoh)

Changed themed stylesheet access from `${loginTheme.stylesheet}` to `${theme.stylesheet()}`.

[New Feature](#new-feature--e09e)

Added a top-level theme menu in the FusionAuth UI for managing and previewing themes per tenant.

[New Feature](#new-feature--issue-180--3fri)

Exposed a user-modifiable CORS configuration.

[180](https://github.com/FusionAuth/fusionauth-issues/issues/180)

[New Feature](#new-feature--issue-227--4raa)

Allowed public keys to be retrieved by `kid` in addition to `applicationId`.

[227](https://github.com/FusionAuth/fusionauth-issues/issues/227)

[New Feature](#new-feature--8i50)

Added PKCE support for use during the Implicit Grant.

[New Feature](#new-feature--issue-163--thanks-unkis--dfgv)

Added new User Email Verified and User Registration Verified events.

Thanks to [@unkis](https://github.com/unkis)!

[163](https://github.com/FusionAuth/fusionauth-issues/issues/163)

[New Feature](#new-feature--issue-269--thanks-zbruhnke--nslq)

Allowed verification and passwordless codes to optionally use digits instead of long strings.

Thanks to [@zbruhnke](https://github.com/zbruhnke)!

[269](https://github.com/FusionAuth/fusionauth-issues/issues/269)

[Fix](#since-1-6-0--fix--qfv1)

Resolved an issue where an Id Token signed by FusionAuth could not be verified if sent back to FusionAuth.

Since: [1.6.0](#version-1-6-0)

[Fix](#fix--issue-231--thanks-lechu67--shlt)

Resolved subject text rendering issues for multi-byte characters when the host OS was not configured for `UTF-8`.

Thanks to [@Lechu67](https://github.com/Lechu67)!

[231](https://github.com/FusionAuth/fusionauth-issues/issues/231)

[Fix](#fix--issue-260--thanks-snmed--ddwe)

Resolved a toggle rendering issue in Firefox.

Thanks to [@snmed](https://github.com/snmed)!

[260](https://github.com/FusionAuth/fusionauth-issues/issues/260)

[Fix](#fix--issue-252--thanks-johnmaia--c7np)

Resolved unexpected "Application does not exist" errors caused by timing issues during programmatic creation.

Thanks to [@johnmaia](https://github.com/johnmaia)!

[252](https://github.com/FusionAuth/fusionauth-issues/issues/252)

[Fix](#fix--issue-249--thanks-damienherve--lmiq)

Resolved exceptions during Google login when the returned `picture` claim was not a valid URI.

Thanks to [@damienherve](https://github.com/damienherve)!

[249](https://github.com/FusionAuth/fusionauth-issues/issues/249)

[Fix](#fix--issue-221--thanks-johnmaia--nz2h)

Resolved an issue where deleting a tenant failed if the search index was not updated first.

Thanks to [@johnmaia](https://github.com/johnmaia)!

[221](https://github.com/FusionAuth/fusionauth-issues/issues/221)

[Fix](#fix--issue-280--thanks-flangfeldt--atum)

Fixed the broken relative link to restart the Forgot Password workflow on the Change Password themed template.

Thanks to [@flangfeldt](https://github.com/flangfeldt)!

[280](https://github.com/FusionAuth/fusionauth-issues/issues/280)

[Fix](#fix--issue-272--thanks-tombeany--dktj)

Resolved Import API failures caused by false positives during password salt validation.

Thanks to [@tombeany](https://github.com/tombeany)!

[272](https://github.com/FusionAuth/fusionauth-issues/issues/272)

[Fix](#fix--issue-245--thanks-fabiojvalente--x3hh)

Resolved UI errors when modifying an Identity Provider configuration if an Application was disabled.

Thanks to [@fabiojvalente](https://github.com/fabiojvalente)!

[245](https://github.com/FusionAuth/fusionauth-issues/issues/245)

[Fix](#fix--issue-237--thanks-whiskerch--g7k1)

Corrected PostgreSQL schema detection logic during database maintenance mode reconnections.

Thanks to [@whiskerch](https://github.com/whiskerch)!

[237](https://github.com/FusionAuth/fusionauth-issues/issues/237)

[Fix](#fix--issue-282--thanks-petechungtuyco--sd2c)

Fixed a typo in the Java client that failed the `generateEmailVerificationId` request.

Thanks to [@petechungtuyco](https://github.com/petechungtuyco)!

[282](https://github.com/FusionAuth/fusionauth-issues/issues/282)

[Enhancement](#enhancement--issue-255--thanks-alvmf1--glbm)

Included a User object in the JWT Refresh Token Revoke event when available.

Thanks to [@AlvMF1](https://github.com/AlvMF1)!

[255](https://github.com/FusionAuth/fusionauth-issues/issues/255)

[Enhancement](#enhancement--issue-263--thanks-alvmf1--op75)

Made `passwordValidationRules` always available in themed templates when choosing to display them.

Thanks to [@AlvMF1](https://github.com/AlvMF1)!

[263](https://github.com/FusionAuth/fusionauth-issues/issues/263)

[Enhancement](#enhancement--issue-209--thanks-colundrum--2v80)

Updated PostgresSQL connector to support `SCRAM-SHA-256`.

Thanks to [@colundrum](https://github.com/colundrum)!

[209](https://github.com/FusionAuth/fusionauth-issues/issues/209)

[Enhancement](#enhancement--oirf)

Accepted optional `tenantId` request parameter on the OpenID Connect discovery endpoint.

## Version 1.7.4

22 August 2019

[Fix](#fix--thanks-johan--xwfh)

Resolved an issue where configured ACS endpoints may not work properly when setting up a SAML v2 IdP relying party.

Thanks to [@johan](https://github.com/johan)!

## Version 1.7.3

15 August 2019

[New Feature](#new-feature--s8kv)

Added a debug flag to IdP configurations to assist in logging and debugging integration issues.

[New Feature](#new-feature--v10z)

Added SAML v2 Service Provider (Relaying Party) Metadata URL.

[Fix](#fix--wu98)

Corrected URLs in the OpenID Configuration discovery document when running behind a proxy without `X-Forwarded-Port`.

[Fix](#fix--issue-205--thanks-mikerees--xsb0)

Resolved SAML v2 issues when using transient or persistent Name Id formats.

Thanks to [@mikerees](https://github.com/mikerees)!

[205](https://github.com/FusionAuth/fusionauth-issues/issues/205)

[Fix](#fix--issue-235--audv)

Added missing `protocolSupportEnumeration` to the `IDPSSODescriptor` in SAML v2 IdP Metadata.

[235](https://github.com/FusionAuth/fusionauth-issues/issues/235)

[Fix](#fix--issue-240--vdwe)

Ensured the `issuer` attribute value matched the `entityId` in SAML v2 IdP Metadata.

[240](https://github.com/FusionAuth/fusionauth-issues/issues/240)

[Fix](#fix--issue-268--hzud)

Ensured audit log entries were created for FusionAuth admins without an email address modifying configuration in the UI.

[268](https://github.com/FusionAuth/fusionauth-issues/issues/268)

[Enhancement](#enhancement--w6dc)

Moved integration details to a view dialog for each Identity Provider configuration.

## Version 1.7.2

19 June 2019

[Fix](#fix--issue-184--thanks-gmpreussner--c681)

Resolved an issue preventing the deletion of a user with recent failed logins when tracking is enabled.

Thanks to [@gmpreussner](https://github.com/gmpreussner)!

[184](https://github.com/FusionAuth/fusionauth-issues/issues/184)

[Fix](#fix--issue-181--thanks-davidmw--heyq)

Resolved login failures to third-party SAML IdPs.

Thanks to [@davidmw](https://github.com/davidmw)!

[181](https://github.com/FusionAuth/fusionauth-issues/issues/181)

[Fix](#fix--1bhz)

Fixed the uptime calculation for nodes displayed in the System -> About panel.

## Version 1.7.1

13 June 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Fix](#fix--ka7v)

Resolved a possible migration error for PostgreSQL users.

## Version 1.7.0

13 June 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--kftp)

Enforced that the `timezone` field in User and UserRegistration must be a valid IANA time zone.

[New Feature](#new-feature--io6x)

Introduced Family and relationship modeling, including concepts and Family APIs.

[New Feature](#new-feature--e1kt)

Introduced Consent management (COPPA VPC, COPPA Email+) and Consent APIs.

[New Feature](#new-feature--dmij)

Allowed exporting Audit Logs to a zipped CSV in the UI and via the Export API.

[New Feature](#new-feature--dcxs)

Allowed exporting Login Records to a zipped CSV in the UI and via the Export API.

[New Feature](#new-feature--2n9u)

Added a Login Record view with limited search and pagination capabilities.

[New Feature](#new-feature--ujxf)

Added an optional retention policy to retain a configured number of days worth of Audit Logs.

[New Feature](#new-feature--8v5q)

Added an optional retention policy to retain a configured number of days worth of Login Records.

[Fix](#fix--9c2e)

Corrected handling of timezones that were incorrectly discovered as `undefined` during login.

[Fix](#fix--dd5o)

Supported importing Bcrypt hashes that contain a `.` (dot) in the Base64 encoding.

[Fix](#fix--16ud)

Improved support for third-party 2FA devices by accepting secrets in Base32 or Base64 encoded formats.

[Fix](#fix--pbnh)

Correctly returned managed domains for SAML v2 IdP configurations.

[Enhancement](#enhancement--5n6b)

Made the User Registration object available as a top-level object `registration` in the Verify Registration email template.

[Enhancement](#enhancement--issue-58--v5vn)

Supported arbitrary URIs for OAuth redirects.

[58](https://github.com/FusionAuth/fusionauth-issues/issues/58)

[Enhancement](#enhancement--issue-165--thanks-petechungtuyco--96i1)

Added `user.mobilePhone` to the search index.

Thanks to [@petechungtuyco](https://github.com/petechungtuyco)!

[165](https://github.com/FusionAuth/fusionauth-issues/issues/165)

## Version 1.6.0

28 April 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--l3wb)

Deprecated JWT-related properties in `SystemConfiguration` and `Application` domains in favor of Key Master.

[Breaking Change](#breaking-change--yyxd)

Deprecated `SystemConfiguration.jwtConfiguration.issuer`, moving it to `SystemConfiguration.issuer`.

[Breaking Change](#breaking-change--phqs)

Added a new macro to `_helpers.ftl`. Existing themes need to merge this update to render properly.

[New Feature](#new-feature--issue-3--f219)

Added support for SAMLv2 IdP.

[3](https://github.com/FusionAuth/fusionauth-issues/issues/3)

[New Feature](#new-feature--issue-104--p8nv)

Added support for SAMLv2 Service Provider to federate authentication.

[104](https://github.com/FusionAuth/fusionauth-issues/issues/104)

[New Feature](#new-feature--ikrc)

Introduced Lambda support for user-defined JavaScript functions to customize claims and reconcile IdP responses.

[New Feature](#new-feature--q74v)

Introduced the Event Log to assist developers in debugging integrations.

[New Feature](#new-feature--e9wp)

Introduced Key Master to manage HMAC, Elliptic, and RSA keys.

[New Feature](#new-feature--snie)

Added new events for user logins and registrations.

[New Feature](#new-feature--issue-142--2du6)

Added the ability to duplicate email templates using the Duplicate action.

[142](https://github.com/FusionAuth/fusionauth-issues/issues/142)

[New Feature](#new-feature--q8y0)

Separated the management of Access Token and Id Token signing.

[Enhancement](#enhancement--issue-144--a0mi)

Reflected the insert instant provided on the Import API in historical registration reports.

[144](https://github.com/FusionAuth/fusionauth-issues/issues/144)

[Enhancement](#enhancement--qzcz)

Displayed additional node information on the About panel in clustered environments.

[Fix](#fix--8jte)

Gracefully handled disabled Passwordless login attempts by displaying a proper error to the user.

[Fix](#fix--issue-102--thanks-whiskerch--rpf9)

Fixed an issue where combining Implicit Grant with Self Service Registration assumed the Authorization Code grant.

Thanks to [@whiskerch](https://github.com/whiskerch)!

[102](https://github.com/FusionAuth/fusionauth-issues/issues/102)

[Fix](#fix--jrom)

Fixed OpenID Connect federated login exceptions caused by the removal of the `device` field from OAuth.

[Fix](#fix--issue-110--thanks-fabiosimeoni--2nbt)

Ensured `id_token` is included when using the Refresh Grant with a token obtained via the `openid` scope.

Thanks to [@fabiosimeoni](https://github.com/fabiosimeoni)!

[110](https://github.com/FusionAuth/fusionauth-issues/issues/110)

[Fix](#fix--issue-118--99x1)

Resolved failures with OpenID Connect Identity Providers that require client authentication.

[118](https://github.com/FusionAuth/fusionauth-issues/issues/118)

## Version 1.5.0

25 March 2019

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--nt8a)

Removed `/oauth2/token` from the CORS configuration, preventing OAuth2 Password grants directly from JavaScript.

[Breaking Change](#breaking-change--7yk7)

Ignored the `device` parameter on the Login API or Authorized endpoint, as it is no longer required for Refresh Tokens.

[Breaking Change](#breaking-change--mteh)

Corrected the Refresh API JSON response body to match the documentation.

[New Feature](#new-feature--1rmk)

Added support for Passwordless login via email.

[New Feature](#new-feature--s3v6)

Added support for the OAuth2 Implicit Grant.

[New Feature](#new-feature--vq10)

Allowed specific OAuth grants to be enabled or disabled per application.

[New Feature](#new-feature--7pyv)

Supported calling the Change Password API using a JWT for SPA workflows.

[New Feature](#new-feature--fb1j)

Returned a One Time Password (OTP) from the Change Password API that can be exchanged for new tokens.

[New Feature](#new-feature--xmr4)

Allowed the Login API to optionally require an API key and restrict Refresh Token returns.

[New Feature](#new-feature--mldk)

Added `c_hash`, `at_hash`, and `nonce` claims to the `id_token` payload.

[New Feature](#new-feature--e85p)

Added support for the `client_secret_post` Client Authentication method.

[Enhancement](#enhancement--wlsu)

Improved ECDSA private and public key validation.

[Enhancement](#enhancement--i91g)

Automatically logged in users upon completing a required change password workflow in OAuth2 grants.

[Enhancement](#enhancement--mjcp)

Returned the `twoFactorTrustId` as an HTTP Only secure cookie from the Two-Factor Login API.

[Fix](#fix--i2eh)

Resolved an error when searching the Login Report by user across multiple tenants.

[Fix](#fix--ja2w)

Displayed validation errors correctly in the Add Claim dialog.

[Fix](#fix--ytm7)

Returned a `400` status code instead of `500` for empty `POST` or `PUT` bodies on the Tenant API.

[Fix](#fix--u2kt)

Corrected date formatting for administrators using the English locale without a set preference.

[Fix](#fix--6udj)

Fixed form validation errors during self-registration.

[Fix](#fix--q0yz)

Opened the correct Action user dialog from the Manage User panel.

[Fix](#fix--d01e)

Ensured 2FA occurred before the change password workflow during login.

[Fix](#fix--lqob)

Fixed the Forgot Password link on the login page in multi-tenant environments.

[Fix](#fix--v4vh)

Ensured the Logout API reliably deleted the `access_token` and `refresh_token` cookies.

[Fix](#fix--issue-57--thanks-anbraten--rnmp)

Signed the `id_token` with the `client_secret` when an HMAC algorithm is selected.

Thanks to [@anbraten](https://github.com/anbraten)!

[57](https://github.com/FusionAuth/fusionauth-issues/issues/57)

[Fix](#fix--mw3q)

Returned a `400` error from the Login API when an invalid `applicationId` was provided.

[Fix](#fix--h2fj)

Reduced the overall `fusionauth-app` Docker image size by ~200 MB via permissions changes.

## Version 1.4.0

4 February 2019

[Breaking Change](#breaking-change--coa3)

Renamed `Type` enum in `DeviceInfo` class to `DeviceType` (affects Java and C# clients).

[Breaking Change](#breaking-change--5pv3)

Allowed multiple authorization codes to exist for a single user simultaneously.

[New Feature](#new-feature--8bg1)

Added Self-service registration forms per application.

[New Feature](#new-feature--jcvt)

Added JSON Web Key set support endpoint at `/.well-known/jwks.json`.

[New Feature](#new-feature--7s6w)

Added Elliptic Curve signature support for JSON Web Tokens (ES256, ES384, ES512).

[New Feature](#new-feature--cqa5)

Released the Typescript client library.

[New Feature](#new-feature--lqzv)

Added filtering by `loginId` or `userId` in the Login Report UI and API.

[Fix](#fix--lu8b)

Ensured silent configuration executed database schema updates properly during Docker Compose upgrades.

[Fix](#fix--smcc)

Prevented tenants from being deleted with API keys assigned to another tenant.

[Fix](#fix--u7t3)

Updated Maintenance Mode to correctly handle public keys for MySQL 8.0.13 and above.

[Fix](#fix--j63z)

Resolved an issue where Social Logins caused users to become unable to login with native credentials.

[Fix](#fix--afb6)

Correctly saved the `given_name` claim into `firstName` instead of `fullName` for OpenID Connect IdPs.

[Fix](#fix--issue-59--xd7h)

Invalidated SSO sessions immediately when users were soft deleted, actioned, or changed passwords.

[59](https://github.com/FusionAuth/fusionauth-issues/issues/59)

## Version 1.3.1

19 December 2018

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[Breaking Change](#breaking-change--issue-43--1do9)

Preferred API keys over JWTs if both were provided on a request, ensuring the API key retrieved the correct user data.

[43](https://github.com/FusionAuth/fusionauth-issues/issues/43)

[Breaking Change](#breaking-change--issue-54--kw91)

Removed the requirement for the `client_id` on the OAuth Token endpoint when client authentication was provided via Basic Auth.

[54](https://github.com/FusionAuth/fusionauth-issues/issues/54)

[Fix](#since-1-3-0--fix--jych)

Resolved a JavaScript error in the UI that prevented JWT settings from rendering properly.

Since: [1.3.0](#version-1-3-0)

[Fix](#fix--myad)

Added missing properties to the Application view dialog in the FusionAuth UI.

[Fix](#fix--issue-53--w35g)

Honored the `openid` scope during login when a user had Two-Factor authentication enabled.

[53](https://github.com/FusionAuth/fusionauth-issues/issues/53)

[Fix](#fix--issue-54--q055)

Returned a `400` status code instead of `500` when the `client_id` request body parameter was omitted.

[54](https://github.com/FusionAuth/fusionauth-issues/issues/54)

[Fix](#fix--issue-55--p239)

Correctly built OAuth2 redirect URIs when they were registered with existing query parameters.

[55](https://github.com/FusionAuth/fusionauth-issues/issues/55)

[Fix](#fix--kkgs)

Resolved an issue where FusionAuth stayed in maintenance mode when connecting to AWS Elasticsearch clusters.

## Version 1.3.0

5 December 2018

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[New Feature](#new-feature--1t1e)

Allowed applications to disable the issuance of refresh tokens through configuration.

[New Feature](#new-feature--m5dl)

Allowed the OAuth2 client secret to be optionally regenerated via the UI.

[New Feature](#new-feature--mncw)

Supported OAuth2 confidential clients by optionally requiring client authentication.

[Fix](#fix--s46z)

Included the `aud` claim in tokens to resolve Introspect endpoint failures.

[Fix](#fix--issue-48--thanks-anbraten--b64l)

Replaced `random_bytes` in the MySQL schema to ensure MariaDB compatibility.

Thanks to [@anbraten](https://github.com/anbraten)!

[48](https://github.com/FusionAuth/fusionauth-issues/issues/48)

[Fix](#fix--issue-41--hdn8)

Resolved a JavaScript error that autofilled the `Birthdate` field unexpectedly.

[41](https://github.com/FusionAuth/fusionauth-issues/issues/41)

## Version 1.2.2

27 November 2018

[Fix](#fix--issue-44--r3ug)

Added `X-FusionAuth-TenantId` to allowed CORS headers.

[44](https://github.com/FusionAuth/fusionauth-issues/issues/44)

[Fix](#fix--slnc)

Corrected redirect URI resolution when running FusionAuth behind a proxy like an AWS ALB/ELB.

[Fix](#fix--t0hk)

Resolved minor usability issues in the Identity Provider configuration UI.

## Version 1.2.1

16 November 2018

[Enhancement](#enhancement--issue-17--vy2r)

Consistently returned a `400` status code with a descriptive JSON body for invalid JSON payloads.

[17](https://github.com/FusionAuth/fusionauth-issues/issues/17)

[Enhancement](#enhancement--n08g)

Allowed Identity Providers to be globally enabled or disabled from the UI.

[Fix](#fix--hp8m)

Preserved Application Identity Provider configuration for disabled Applications when editing from the UI.

## Version 1.2.0

15 November 2018

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[New Feature](#new-feature--1xir)

Added TTL configuration for Refresh Tokens at the Application level.

[Fix](#fix--x04g)

Resolved an error in the Twitter OAuth v1 workflow.

## Version 1.1.1

13 November 2018

[Fix](#fix--n4ra)

Resolved a database migration failure for instances with existing Identity Providers for federated JWTs prior to `1.1.0`.

## Version 1.1.0

13 November 2018

[Database Migration](#database-migration--66ca)

This version makes significant changes to the database schema. Upgrading to this version requires a migration. While in development mode you will be prompted to upgrade the database by maintenance mode before you may login. In a production runtime mode, or with silent configuration enabled, the upgrade will occur automatically during startup.

For more information about database migrations, see [Database Migrations](https://4002.18-224-161-104.sslip.io/docs/operate/deploy/upgrade.md#downtime-and-database-migrations).

[New Feature](#new-feature--6i47)

Added Social login support for Facebook, Google, Twitter, and OpenID Connect.

[New Feature](#new-feature--3uz2)

Introduced full theme support for customizing the login experience.

[New Feature](#new-feature--fc1o)

Added localization support in the UI for preferred language formatting (e.g., date formats).

[Enhancement](#enhancement--mhum)

Displayed start and expiration times for sessions (refresh tokens) on the Manage User panel.

## Version 1.0.18

29 October 2018

[Fix](#fix--r40g)

Resolved an issue where FusionAuth became stuck in maintenance mode if left idle for extended periods.

## Version 1.0.17

5 October 2018

[Fix](#fix--vvvj)

Resolved an issue where FusionAuth could not connect to the search service when exiting the setup wizard in Docker Compose.

## Version 1.0.16

5 October 2018

[Enhancement](#enhancement--49nc)

Made silent configuration for database and search engine bootstrap more resilient in Docker Compose.

[Fix](#fix--i7jz)

Prevented custom data loss when editing Application, Group, or Tenant objects in the UI.

## Version 1.0.15

1 October 2018

[New Feature](#new-feature--kovr)

Allowed configurations to be overridden using environment variables in Docker.

[Fix](#fix--84vv)

Ensured a JSON response body was returned correctly the first time a user reached the failed login threshold.

## Version 1.0.14

17 September 2018

[Fix](#fix--5kjh)

Resolved an exception that occurred during internal cache reloads when using PostgreSQL.

## Version 1.0.13

12 September 2018

[New Feature](#new-feature--wzwv)

First made FusionAuth generally available!

Related

[Operate Releases Learn about how to be notified of new versions of FusionAuth. changelogrelease notes](https://4002.18-224-161-104.sslip.io/docs/operate/roadmap/releases.md)

[Operate Deprecation Policy Learn more about the FusionAuth deprecation policy. release notes](https://4002.18-224-161-104.sslip.io/docs/operate/roadmap/deprecation-policy.md)