Release notes — Versola Docs
VersolaVersola/docs
Pre-1.00.7.1versola.kzGitHub
RUEN

Release notes

The key changes of the latest Versola releases, with a link to the full release notes on GitHub.

The full release notes of every version are on GitHub: Versola releases and versola-cli releases. This page lists only the key changes.

Pre-1.0: Versola does not guarantee compatibility before 1.0.0. Configuration, database schema and APIs can change between 0.x releases without a migration path. Back up your database before upgrading.

0.7.1 — 2026-10-13

  • /logout accepts an expired id_token_hint.
  • The SMS code names the app when the client is a partner client.
  • The vps deployment can trust a Postgres CA (--postgres-ca) and use a database name of your choice (--postgres-db): CLI reference.

0.7.0 — 2026-10-13

  • FAPI 2.0 is the default security profile. A new tenant is created as fapi2 and the profile cannot be changed afterwards. The standard profile is kept for compatibility: Security profiles.
  • Mobile apps through edge. Native apps sign in through edge with DPoP-bound tokens: Native apps.
  • mTLS and private_key_jwt. Clients can authenticate with a certificate or a key, and tokens can be bound to a key or a certificate: Sender-constrained tokens.
  • Admin console. A client creation wizard per client kind, and a page per client: Admin console.
  • A fresh database is required. The migrations were squashed, so a database created by an earlier release is not migrated.
  • Postgres TLS. Connections verify the server certificate by default, and env = "prod" refuses an unverified connection: Configuration.
  • Behaviour changes. The ID token no longer carries claims implied by scope (read them from /userinfo), /userinfo takes the token only from the Authorization header, and phone numbers are stored in E.164 form.
  • Trade-offs for speed. Login state is not written to the WAL, refresh tokens have a fixed lifetime of 180 days by default, and the session cookie carries the access token: Compromises.
  • Operations. A Grafana board, HorizontalPodAutoscaler and PodDisruptionBudget in the Helm chart, and an outbound HTTP client pool you can configure: Operations.

Known limitations in 0.7.0: edge does not attest the app at /native/start, and there are no published FAPI 2.0 conformance results yet.