Release notes — Versola Docs
/docs
Pre-1.00.7.5versola.ioGitHub
RUEN

Release notes

The key changes of the latest Versola releases, with a link to the full release notes on GitHub.

The full release notes of every version are on GitHub: Versola releases and versola-cli releases. This page lists only the key changes.

Pre-1.0: Versola does not guarantee compatibility before 1.0.0. Configuration, database schema and APIs can change between 0.x releases without a migration path. Back up your database before upgrading.

Unreleased

  • Crypto. A deployment generated by versola-cli signs tokens with ES256 by default: JWT_PRIVATE_KEY is an EC P-256 key and the published discovery lists ES256 for ID tokens. Existing RSA deployments keep signing as before; to move one, see Keys & metadata.

0.7.2 — 2026-10-17

  • Themeable login forms. The forms are redesigned around a brand colour. Build a theme from a base plus overrides, set a background, give a partner app its own appearance, and let visitors choose Auto, Light or Dark: Themes, Forms.
  • Phone sign-in by country. Length, regex and self-registration are set per region, with presets. The per-client sign-up switch is gone: self-registration is decided by the tenant: Security.
  • Offline start. auth and edge start from a locally kept configuration snapshot when central is unreachable.
  • Admin console redesign, first steps. A new design system, light and dark schemes, and Scopes, Permissions, Roles, Tenants and Edges on a table with a side panel.
  • Identity. Email and phone are marked verified after a successful OTP, and a client can mark consent scopes as required. New clients offer passkeys by default.
  • Crypto. The native crypto provider is required in the auth and edge images, and new tenants default to ES256.
  • Reliability. edge serializes concurrent refresh of one session, and expired user_consents are cleaned up.
  • Operations. New database and ingress Grafana boards, tail quantiles up to p99.999, and an Env selector.

0.7.1 — 2026-10-13

  • /logout accepts an expired id_token_hint.
  • The SMS code names the app when the client is a partner client.
  • The vps deployment can trust a Postgres CA (--postgres-ca) and use a database name of your choice (--postgres-db): CLI reference.

0.7.0 — 2026-10-13

  • FAPI 2.0 is the default security profile. A new tenant is created as fapi2 and the profile cannot be changed afterwards. The standard profile is kept for compatibility: Security profiles.
  • Mobile apps through edge. Native apps sign in through edge with DPoP-bound tokens: Native apps.
  • mTLS and private_key_jwt. Clients can authenticate with a certificate or a key, and tokens can be bound to a key or a certificate: Sender-constrained tokens.
  • Admin console. A client creation wizard per client kind, and a page per client: Admin console.
  • A fresh database is required. The migrations were squashed, so a database created by an earlier release is not migrated.
  • Postgres TLS. Connections verify the server certificate by default, and env = "prod" refuses an unverified connection: Configuration.
  • Behaviour changes. The ID token no longer carries claims implied by scope (read them from /userinfo), /userinfo takes the token only from the Authorization header, and phone numbers are stored in E.164 form.
  • Trade-offs for speed. Login state is not written to the WAL, refresh tokens have a fixed lifetime of 180 days by default, and the session cookie carries the access token: Compromises.
  • Operations. A Grafana board, HorizontalPodAutoscaler and PodDisruptionBudget in the Helm chart, and an outbound HTTP client pool you can configure: Operations.

Known limitations in 0.7.0: edge does not attest the app at /native/start, and there are no published FAPI 2.0 conformance results yet.