logto-io · silverhand-bot · Sep 15, 2026
@@ -1,5 +1,13 @@
 # @logto/account
 
+## 0.7.0
+
+### Minor Changes
+
+- c5bd438f79: add MFA trusted devices with configurable policies and device management
+
+  Configure tenant-wide trusted-device policies and organization-level restrictions. After completing MFA, users can choose whether to trust their device on a dedicated page at the end of sign-in or sign-up, then skip repeated MFA on that browser. Manage trusted devices through Console, Account Center, the Management API, and the Account API, and subscribe to device lifecycle webhooks.
+
 ## 0.6.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
   "name": "@logto/account",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Logto account center app.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",

diff --git a/packages/api/CHANGELOG.md b/packages/api/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @logto/api
 
+## 1.44.0
+
+### Minor Changes
+
+- 1bac1b7cda: add a typed async iterator for paginated Management API endpoints
+- fd41d8fdf7: improve API SDK client reliability and ergonomics
+
+  - reject token request redirects, support custom abort signals and a configurable 10-second timeout, and share one token fetch across concurrent requests
+  - invalidate a rejected cached token once without continuously fetching tokens for permanent `401` responses
+  - normalize trailing slashes in custom base URLs
+  - support object-style Management API client configuration with a tenant ID or explicit base URL and API indicator
+  - support lowercase API client methods such as `.get()` and `.post()` while keeping the uppercase methods available
+  - apply a configurable 10-second timeout to Management API network requests while preserving per-request cancellation
+  - emit scope mismatch warnings once per distinct scope and preserve token request failure causes
+
 ## 1.43.0
 
 ## 1.42.0

diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/api",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "description": "Logto API types and clients.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Change Log
 
+## 1.44.0
+
+### Patch Changes
+
+- a2d6e83a4f: explain existing PostgreSQL tenant roles before database seeding stops
+
+  The database seed command now checks for the roles it needs before creating tables. If roles from a previous Logto database remain in the PostgreSQL cluster, the command reports the conflict and explains why dropping the database did not remove them, so an administrator can clean them up safely before retrying.
+
+- Updated dependencies [3f9fd15331]
+- Updated dependencies [c5bd438f79]
+  - @logto/schemas@1.44.0
+
 ## 1.43.0
 
 ### Patch Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/cli",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "description": "Logto CLI.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",

@@ -1,5 +1,15 @@
 # @logto/connector-apple
 
+## 1.6.10
+
+### Patch Changes
+
+- bad3854bfa: clarify that the Apple connector's identifier is a Services ID
+
+  The connector's identifier field is now labeled "Services ID" and states that an App ID (bundle ID) is not a valid value, which Apple rejects with an `invalid_client` error.
+
+  Setup instructions cover the Apple Developer portal, so enabling Sign in with Apple no longer appears to require Xcode. Troubleshooting guidance explains `invalid_client` and `invalid_request`, including Apple's caching of identifier configuration, which has been observed to take up to 24 hours to refresh and can make a correct configuration look broken.
+
 ## 1.6.9
 
 ### Patch Changes

@@ -1,6 +1,6 @@
 {
   "name": "@logto/connector-apple",
-  "version": "1.6.9",
+  "version": "1.6.10",
   "description": "Apple web connector implementation.",
   "dependencies": {
     "@logto/connector-kit": "workspace:^",

@@ -1,5 +1,21 @@
 # Change Log
 
+## 1.41.0
+
+### Minor Changes
+
+- 3f9fd15331: add authentication policies for SAML applications
+
+  SAML applications force fresh authentication by default, as before. To let a SAML application reuse an existing Logto session, turn off "Always force authentication" in the application settings, or set `authnRequestConfig.forceAuthn` to `false` using the SAML application Management API. The service provider can still require fresh authentication for a single sign-in with `ForceAuthn="true"` (SAML 2.0 core, section 3.4.1).
+
+  SAML assertions report the actual authentication time.
+
+  To require signed authentication requests, set `authnRequestConfig.requireSignedAuthnRequests` to `true` and provide the service provider’s PEM-encoded RSA X.509 certificate in `authnRequestConfig.signingCertificate`. Both HTTP-POST and HTTP-Redirect signatures are verified. Unsigned requests remain accepted by default.
+
+- c5bd438f79: add MFA trusted devices with configurable policies and device management
+
+  Configure tenant-wide trusted-device policies and organization-level restrictions. After completing MFA, users can choose whether to trust their device on a dedicated page at the end of sign-in or sign-up, then skip repeated MFA on that browser. Manage trusted devices through Console, Account Center, the Management API, and the Account API, and subscribe to device lifecycle webhooks.
+
 ## 1.40.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
   "name": "@logto/console",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "> TODO: description",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",

@@ -1,5 +1,42 @@
 # Change Log
 
+## 1.44.0
+
+### Minor Changes
+
+- 3f9fd15331: add authentication policies for SAML applications
+
+  SAML applications force fresh authentication by default, as before. To let a SAML application reuse an existing Logto session, turn off "Always force authentication" in the application settings, or set `authnRequestConfig.forceAuthn` to `false` using the SAML application Management API. The service provider can still require fresh authentication for a single sign-in with `ForceAuthn="true"` (SAML 2.0 core, section 3.4.1).
+
+  SAML assertions report the actual authentication time.
+
+  To require signed authentication requests, set `authnRequestConfig.requireSignedAuthnRequests` to `true` and provide the service provider’s PEM-encoded RSA X.509 certificate in `authnRequestConfig.signingCertificate`. Both HTTP-POST and HTTP-Redirect signatures are verified. Unsigned requests remain accepted by default.
+
+- c5bd438f79: add MFA trusted devices with configurable policies and device management
+
+  Configure tenant-wide trusted-device policies and organization-level restrictions. After completing MFA, users can choose whether to trust their device on a dedicated page at the end of sign-in or sign-up, then skip repeated MFA on that browser. Manage trusted devices through Console, Account Center, the Management API, and the Account API, and subscribe to device lifecycle webhooks.
+
+### Patch Changes
+
+- 7d54310ee0: use a supported base language for API error messages when the requested regional language is unavailable
+- 3da75ce7cf: support a trailing slash in the issuer of OIDC enterprise SSO connectors
+
+  The discovery path is now joined onto the connector's `Issuer`, so `https://idp.example.com/` and `https://idp.example.com` both resolve to `https://idp.example.com/.well-known/openid-configuration`. The stored issuer value stays exactly as configured, so existing SSO identities keep resolving.
+
+  Failed outbound requests made by an OIDC SSO connector now report a concise reason: the error message, or the status code alongside the response body for an HTTP failure.
+
+- Updated dependencies [3f9fd15331]
+- Updated dependencies [a2d6e83a4f]
+- Updated dependencies [c5bd438f79]
+  - @logto/console@1.41.0
+  - @logto/phrases@1.32.0
+  - @logto/schemas@1.44.0
+  - @logto/cli@1.44.0
+  - @logto/experience@1.23.0
+  - @logto/account@0.7.0
+  - @logto/demo-app@1.5.0
+  - @logto/device-demo-app@0.1.0
+
 ## 1.43.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
   "name": "@logto/core",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "description": "The open source identity solution.",
   "main": "build/index.js",
   "author": "Silverhand Inc. <contact@silverhand.io>",

diff --git a/packages/create/CHANGELOG.md b/packages/create/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 1.44.0
+
+### Patch Changes
+
+- Updated dependencies [a2d6e83a4f]
+  - @logto/cli@1.44.0
+
 ## 1.43.0
 
 ### Patch Changes

diff --git a/packages/create/package.json b/packages/create/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/create",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -15,6 +15,6 @@
     "node": "^22.14.0"
   },
   "dependencies": {
-    "@logto/cli": "workspace:^1.43.0"
+    "@logto/cli": "workspace:^1.44.0"
   }
 }
@@ -1,5 +1,13 @@
 # Change Log
 
+## 1.23.0
+
+### Minor Changes
+
+- c5bd438f79: add MFA trusted devices with configurable policies and device management
+
+  Configure tenant-wide trusted-device policies and organization-level restrictions. After completing MFA, users can choose whether to trust their device on a dedicated page at the end of sign-in or sign-up, then skip repeated MFA on that browser. Manage trusted devices through Console, Account Center, the Management API, and the Account API, and subscribe to device lifecycle webhooks.
+
 ## 1.22.0
 
 ### Minor Changes

@@ -1,6 +1,6 @@
 {
   "name": "@logto/experience",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "license": "MPL-2.0",
   "type": "module",
   "private": true,

diff --git a/packages/phrases/CHANGELOG.md b/packages/phrases/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Change Log
 
+## 1.32.0
+
+### Minor Changes
+
+- 3f9fd15331: add authentication policies for SAML applications
+
+  SAML applications force fresh authentication by default, as before. To let a SAML application reuse an existing Logto session, turn off "Always force authentication" in the application settings, or set `authnRequestConfig.forceAuthn` to `false` using the SAML application Management API. The service provider can still require fresh authentication for a single sign-in with `ForceAuthn="true"` (SAML 2.0 core, section 3.4.1).
+
+  SAML assertions report the actual authentication time.
+
+  To require signed authentication requests, set `authnRequestConfig.requireSignedAuthnRequests` to `true` and provide the service provider’s PEM-encoded RSA X.509 certificate in `authnRequestConfig.signingCertificate`. Both HTTP-POST and HTTP-Redirect signatures are verified. Unsigned requests remain accepted by default.
+
 ## 1.31.0
 
 ### Minor Changes

diff --git a/packages/phrases/package.json b/packages/phrases/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/phrases",
-  "version": "1.31.0",
+  "version": "1.32.0",
   "description": "Logto shared phrases (i18n).",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",

diff --git a/packages/schemas/CHANGELOG.md b/packages/schemas/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Change Log
 
+## 1.44.0
+
+### Minor Changes
+
+- 3f9fd15331: add authentication policies for SAML applications
+
+  SAML applications force fresh authentication by default, as before. To let a SAML application reuse an existing Logto session, turn off "Always force authentication" in the application settings, or set `authnRequestConfig.forceAuthn` to `false` using the SAML application Management API. The service provider can still require fresh authentication for a single sign-in with `ForceAuthn="true"` (SAML 2.0 core, section 3.4.1).
+
+  SAML assertions report the actual authentication time.
+
+  To require signed authentication requests, set `authnRequestConfig.requireSignedAuthnRequests` to `true` and provide the service provider’s PEM-encoded RSA X.509 certificate in `authnRequestConfig.signingCertificate`. Both HTTP-POST and HTTP-Redirect signatures are verified. Unsigned requests remain accepted by default.
+
+- c5bd438f79: add MFA trusted devices with configurable policies and device management
+
+  Configure tenant-wide trusted-device policies and organization-level restrictions. After completing MFA, users can choose whether to trust their device on a dedicated page at the end of sign-in or sign-up, then skip repeated MFA on that browser. Manage trusted devices through Console, Account Center, the Management API, and the Account API, and subscribe to device lifecycle webhooks.
+
+### Patch Changes
+
+- Updated dependencies [3f9fd15331]
+  - @logto/phrases@1.32.0
+
 ## 1.43.0
 
 ### Minor Changes

diff --git a/...88946735-add-saml-authn-request-config.ts → ...88946735-add-saml-authn-request-config.ts b/...88946735-add-saml-authn-request-config.ts → ...88946735-add-saml-authn-request-config.ts
diff --git a/packages/schemas/package.json b/packages/schemas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",

diff --git a/packages/translate/CHANGELOG.md b/packages/translate/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @logto/translate
 
+## 0.2.18
+
+### Patch Changes
+
+- Updated dependencies [3f9fd15331]
+  - @logto/phrases@1.32.0
+
 ## 0.2.17
 
 ### Patch Changes

diff --git a/packages/translate/package.json b/packages/translate/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@logto/translate",
-  "version": "0.2.17",
+  "version": "0.2.18",
   "description": "A CLI tool that helps translate phrases and experience-phrases to i18n resources.",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "homepage": "https://github.com/logto-io/logto#readme",